Security: Vulnerable PHP version (CVE-2026-109618 / CVE-2026-109619) in current Docker images
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- docker, php
- Domain
- infrastructure, security
Research direction
Start by reading the Docker build files that select the PHP version and identify how the official images inherit or install PHP. Update the image to use a patched version listed in the issue, then build the affected image and confirm it contains that version. The payload does not name specific files or tests.
Written by the indexing model from the issue text.
Description
Bug Description
The current official Docker images for MISP (including the latest v2.5.50 tag) are built with a PHP version that is vulnerable to the recently disclosed critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell", published on October 21, 2026).
Because the images were built before the release of the PHP patch, they bundle an outdated PHP version (e.g., PHP 8.4.24).
The Docker images should be updated to use one of the patched PHP versions:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Security Impact
Critical. An attacker could exploit the PHP vulnerabilities to achieve Remote Code Execution (RCE) on the MISP container.
- Dominant language
- Shell
- Stars
- 396
- Forks
- 200
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 13
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from MISP/misp-docker
-
Change for rsyslogMay be free again @cudeso claimed this 572 days ago, and no pull request is open. Opendocumentation
MISP/misp-docker#213 · 2 comments · 1 assignee ·
Maintainers usually reply within 1 day
All issues in MISP/misp-docker
Similar issues
-
0. to triage
Difficulty 1/5 Under an hour Newbie friendliness 67/100
roundcube/roundcubemail-docker#478 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
level/task type/enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
wazuh/wazuh-installation-assistant#1177 ·
Maintainers usually reply within 1 day
-
package-update
Difficulty 2/5 1-3 hours Newbie friendliness 63/100
Maintainers usually reply within 1 day