The vulnerabilities allow attackers to execute code remotely in PHP core, and they affect PHP packages going back to version 5.4: the supported versions 8.2 through 8.5, and the end-of-life versions 5.x, 7.x, 8.0, and 8.1. To address these vulnerabilities, PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and advised anyone running PHP to update to the latest version immediately.
Although this is a vulnerability in PHP itself, not in Docker’s systems, it nonetheless affects Docker users who build on PHP images and packages. In response, we have updated the Docker Hardened Images and Docker Official Images on Docker Hub, and advise customers to immediately update.
