PHP2Shell and eMudhra Patched

On October 20, 2026 Docker flagged two zero‑day PHP flaws—collectively called PHP2Shell—and simultaneously learned that the eMudhra certificate used to sign many of its images had been compromised. Within a day Docker pushed a new PHP base image that removes the back‑door code, and it regenerated the entire trust store for every official image in its catalog. The rapid turnaround matters because Docker’s public registry powers millions of production workloads; a compromised certificate could have allowed attackers to inject malicious layers into any downstream image, while the PHP bugs themselves could grant remote code execution on any container running the vulnerable interpreter.

The twin incidents sit squarely in the broader wave of supply‑chain attacks that have forced container vendors to treat image signing and dependency hygiene as first‑class security concerns. Docker’s response mirrors the industry’s shift toward “immutable” builds and automated remediation pipelines, a trend echoed by rivals such as GitHub Container Registry and AWS ECR, which have also begun offering real‑time vulnerability alerts. By partnering with ActiveState—a company that provides curated, hardened language runtimes—Docker is signaling that it will embed more proactive security layers into its ecosystem rather than relying solely on reactive patches.

For Docker customers, the immediate task is to verify that they are pulling the newly signed PHP image and to audit any containers that may still be running the vulnerable version. The rebuilt trust store means older signatures are now invalid, so CI/CD pipelines that cache image digests must be refreshed. Going forward, watch for Docker’s next security bulletin: the company may tighten its certificate issuance workflow, introduce stricter key‑rotation policies, or roll out automated re‑signing tools. Enterprises that have not yet integrated image‑signing verification into their deployment processes should treat this episode as a deadline to do so.