Two significant security incidents occurred concurrently this week: the PHP2Shell vulnerability and the eMudhra certificate compromise. These issues affected the underlying foundations upon which applications are constructed.
PHP2Shell involves critical flaws within the PHP engine itself, identified as CVE-2026-109618 and CVE-2026-109619. These flaws permit an unauthenticated request to achieve code execution on a server, regardless of how carefully the application code is written. PHP powers approximately 69% of websites whose server-side language is known.
The eMudhra compromise presents a distinct problem. Eight intermediate certificates from the eMudhra certificate authority were found to possess private keys computable from their public certificates. This allowed unauthorized issuance of certificates for any website, which browsers typically revoke, but container images maintain their own trust stores, continuing to trust these until rebuilt.
Docker Hardened Images addressed the situation by rebuilding a fixed PHP image and publishing it early on October 22, within 24 hours of the upstream release, following DHI testing and verification. Pulling the current tag ensures the use of the corrected version.
The certificate compromise necessitated a catalog-wide update because every image contains a trust store. Within 48 hours of the PHP release, the DHI build system executed 16,567 package and image builds across the catalog. By 10pm UTC on October 22, nearly all catalog tags reflected the fixed CA store, with the remainder in the build queue, verifiable via the SBOM accompanying each image.
For operators utilizing Docker Hardened Images running PHP, the recommended action is to pull the current tag for the branch and redeploy, rebuilding any applications built on top of a DHI image to incorporate the new base layer. Customizations within the DHI Enterprise workflow are automatically rebuilt when the base layer is patched.
If an organization employs PHP in any other container, they must check the PHP version running internally, not just the external tag, and subsequently rebuild it using a patched base.
These recurring events underscore the necessity of a trusted foundation for infrastructure. If organizations are not yet utilizing hardened images, this week serves as a critical impetus to begin.
The mechanism of Docker Hardened Images is designed precisely for this scenario. Docker builds, patches, and maintains system packages inside each image directly from source. The build system is event-driven, meaning an upstream release or package change automatically triggers rebuilds for all dependent components.
Market participants benefit from the catalog's features, including signed images, an SBOM, SLSA Build Level 3 provenance, and VEX data, enabling measurable auditing of such large-scale rebuilds. The catalog remains free and open source under Apache 2.0 and maintains compatibility with Alpine and Debian environments, requiring only a minor adjustment to the FROM line in a Dockerfile.
