v1.0.0 — PHP 7.4.33 (UNVERIFIED preview)

v1.0.0 — PHP 7.4.33 security backports

UNVERIFIED development preview. Production release remains denied.

This first repository release identifies the existing PHP 7.4.33 CLI/FPM source and published Linux amd64 image. The v1.0.0 tag versions this repository; the contained PHP version remains 7.4.33.

PHP OpenSSL is unavailable in this variant. Native openssl_* functions and PHP TLS/HTTPS stream wrappers are absent. HTTPS through cURL uses the pinned native TLS provider. mysqlnd TLS and OpenSSL-dependent authentication remain limited; no insecure fallback is recommended.

CVE-2026-109618 and CVE-2026-109619

This image includes targeted fixes for CVE-2026-109618 and CVE-2026-109619 through PHP's official minimal end-of-life backport for PHP 7.4.

CVE	Upstream issue	Included implementation
CVE-2026-109618	Request-state corruption during out-of-memory handling	Official minimal PHP 7.4 EOL backport
CVE-2026-109619	Reuse of stale request-owned global state after its memory is freed	Official minimal PHP 7.4 EOL backport

The selected upstream commit is 712e60f9edfd03f0960fc4fc3c2c375f42b90aa2. Upstream explicitly identifies both CVE fixes and describes the patch as a minimal mitigation for an EOL version. The build verifies the archive/patch checksums and replays the complete source patch chain. Inputs are locked in source.env; see patch provenance.

This EOL implementation immediately terminates the worker on affected allocation failures without normal shutdown callbacks and disables session upload progress in source and configuration. Applications must tolerate interrupted requests.

These targeted fixes do not restore official support or establish complete security clearance. The image remains UNVERIFIED, the production gate stays closed, and the detailed independent mysqlnd review is still unfinished.

Source and image

• Source commit: 086f85ef9a84145204b1ae98974ce1f74a43ceb3.
• Docker Hub.
• Preview tag: shellharbor/php-7.4-cve-2026-docker:7.4.33-backport.3-fpm-unverified.
• Commit-qualified tag: shellharbor/php-7.4-cve-2026-docker:7.4.33-backport.3-fpm-unverified-086f85ef9a84.
• Published manifest: sha256:aacf3c726d415a96f7694e74f61cd7c6a9ae59aa2bbfe3206daae9ce923300bb.

Pull the exact published image:

docker pull shellharbor/php-7.4-cve-2026-docker@sha256:aacf3c726d415a96f7694e74f61cd7c6a9ae59aa2bbfe3206daae9ce923300bb

Included work

• Pinned PHP release archive, minimal EOL patch and ordered historical backport manifest with checksum verification.
• Updated native libraries: OpenSSL 3.5.9 for native cURL TLS, cURL 8.23.0, libxml2 2.15.4, SQLite 3.54.1, patched OpenLDAP and signed Debian external PCRE2. The PHP 7.4 libxml2 API compatibility patch is separately checksum-locked.
• Non-root FPM/CLI runtime, read-only root support, real FastCGI healthcheck and graceful shutdown.
• Linux/Windows build wrappers, Nginx Compose example on loopback port 8074, development Kubernetes template and pinned GitHub CI.

Validation

Existing publication checks on 2026-10-31:

• Source verification replayed the complete patch chain and checked 139 final source hashes.
• 66 focused PASS records locally and 66 on a clean GitHub hosted build.
• Local standalone FPM and Compose checks passed.
• Anonymous pull and PHP execution from the published digest passed.
• Five native components and 19 recorded native file hashes matched the prior local runtime.
• GitHub CI succeeded and uploaded raw scanner/SBOM reports with 14-day retention. Its hosted rebuild has a separate build identity from the locally published image.
• Raw Trivy retained 148 findings: 3 CRITICAL, 14 HIGH, 52 MEDIUM, 78 LOW and 1 UNKNOWN. The production gate still denies release.

Remaining limits

PHP 7.4 is end of life. Detailed independent mysqlnd review is unfinished. This release does not certify that all historical vulnerabilities are fixed or that the image is production-ready.

The earlier full upstream suite retained 44 FAIL and 1 WARN. Those results belong to an earlier image; no new full upstream suite was run for publication. Focused checks do not replace that suite. Real application/database compatibility and production Kubernetes deployment remain unverified.

Session upload progress remains disabled in source and configuration. OOM hard-exit behavior, TLS verification and existing protections are retained. Prebuilt third-party mysqlnd extensions require rebuilding and review because the internal C ABI changed.

See security policy and historical evidence.