A source-built PHP 7.4 CLI/FPM image for investigating, testing and migrating legacy applications.
The repository keeps the runtime work visible: pinned PHP sources, ordered backports, native dependency locks, build instructions and recorded test evidence. You can inspect the inputs, rebuild the image and compare behavior with your application.
UNVERIFIED development preview — production_ready=false. PHP 7.4 is end of life, and detailed independent mysqlnd review remains unfinished. Backports do not restore official support or prove that every historical vulnerability has been resolved.
PHP OpenSSL is unavailable in this variant. Native
openssl_*functions and TLS/HTTPS stream wrappers are absent. HTTPS through cURL uses the pinned native TLS provider. mysqlnd TLS and OpenSSL-dependent authentication are limited; do not replace verification with an insecure fallback.
Docker Hub · Build workflow · Security status · Historical evidence
This image includes targeted fixes for CVE-2026-109618 and CVE-2026-109619 through PHP's official minimal end-of-life backport for PHP 7.4.
| CVE | Upstream issue | Included implementation |
|---|---|---|
| CVE-2026-109618 | Request-state corruption during out-of-memory handling | Official minimal PHP 7.4 EOL backport |
| CVE-2026-109619 | Reuse of stale request-owned global state after its memory is freed | Official minimal PHP 7.4 EOL backport |
The selected upstream commit is 712e60f9edfd03f0960fc4fc3c2c375f42b90aa2. Upstream explicitly identifies both CVE fixes and describes the patch as a minimal mitigation for an EOL version. The build verifies the archive/patch checksums and replays the complete source patch chain. Inputs are locked in source.env; see patch provenance.
This EOL implementation immediately terminates the worker on affected allocation failures without normal shutdown callbacks and disables session upload progress in source and configuration. Applications must tolerate interrupted requests.
These targeted fixes do not restore official support or establish complete security clearance. The image remains UNVERIFIED, the production gate stays closed, and the detailed independent mysqlnd review is still unfinished.
| Item | Value |
|---|---|
| PHP | 7.4.33 with pinned downstream backports |
| Runtime | CLI and foreground PHP-FPM |
| Platform | Linux amd64 |
| Preview image | shellharbor/php-7.4-cve-2026-docker:7.4.33-backport.3-fpm-unverified |
| User/group | 10001:10001 |
| FPM port | 9000, FastCGI |
| Production gate | Denied while UNVERIFIED |
Pull the preview and check the version in an isolated container:
docker pull shellharbor/php-7.4-cve-2026-docker:7.4.33-backport.3-fpm-unverified
docker run --rm --platform linux/amd64 --network none --read-only \
--tmpfs /tmp:rw,nosuid,nodev,size=128m \
--cap-drop ALL --security-opt no-new-privileges \
--memory 512m --pids-limit 64 \
shellharbor/php-7.4-cve-2026-docker:7.4.33-backport.3-fpm-unverified php -vUse php -m instead of php -v to inspect extensions. The PHP version string remains 7.4.33; the downstream tag, digest and embedded metadata identify this build.
Without a command override, the container starts FPM. Port 9000 speaks FastCGI, not HTTP. Keep it private and put a web server in front of it. Use a registry digest when exact image identity matters; no latest or production-ready tag is provided.
The Compose example connects non-root Nginx to FPM and mounts a small application read-only. It does not include a database.
git clone https://github.com/shellharbor/php-7.4-cve-2026-docker.git
cd php-7.4-cve-2026-docker
docker compose -p php74-preview -f examples/compose.yml up -d --no-build --wait
curl http://127.0.0.1:8074/
docker compose -p php74-preview -f examples/compose.yml logs --tail 100
docker compose -p php74-preview -f examples/compose.yml downThe demo returns JSON containing the PHP version, SAPI, disabled upload-progress setting and UNVERIFIED status. Nginx binds only to loopback port 8074. Its PHP backend network is isolated; database/outbound access and persistent storage require explicit application configuration.
The Dockerfile starts from checksum-pinned official PHP sources, applies the minimal EOL patch and replays the complete ordered historical backport manifest. Source verification checks hashes, zero-fuzz patch application and affected file bytes. See source.env and patch provenance.
Native inputs are separately pinned in native-sources.json:
| Library | Selected input |
|---|---|
| OpenSSL | 3.5.9, used by native cURL; PHP OpenSSL extension omitted |
| cURL | 8.23.0 |
| libxml2 | 2.15.4 with a checksum-locked PHP 7.4 API compatibility patch |
| SQLite | 3.54.1 with column metadata enabled |
| OpenLDAP | Signed Debian source and two pinned upstream security patches |
| PCRE2 | Signed Debian external PCRE2 10.42-1+deb12u2 |
Includes mysqli, PDO MySQL/PostgreSQL/SQLite, mbstring, curl, GD, intl, zip, OPcache, bcmath, sockets, pcntl and exif, alongside configured upstream defaults. The runtime excludes compilers, Python and package managers. Build metadata, licenses and runtime file hashes are embedded under /usr/local/share/php-cve/.
- Session upload progress is disabled in source and configuration.
- A PHP memory-limit failure immediately terminates the worker without normal shutdown callbacks.
- The internal mysqlnd C ABI changed; stock prebuilt third-party extensions require rebuilding and review.
- Native TLS uses OpenSSL implicit rejection for invalid RSA PKCS#1 padding.
- Empty cURL certificate-blob setters fail; native cURL RTMP/SMB protocols are unavailable.
- Modern libxml behavior and SQLite defaults differ from older installations.
These differences and the missing PHP OpenSSL extension can affect applications. Real database/application interoperability remains unverified.
The image works with a read-only root filesystem and writable /tmp. Application files mounted at /app must be readable by UID/GID 10001:10001.
| Setting | Default |
|---|---|
| PHP memory limit | 128 MiB |
| Maximum POST/upload | 8 MiB / 4 MiB |
| FPM maximum workers | 4 |
| Logs | stderr |
| Session files | /tmp/sessions |
| Healthcheck | Real FastCGI ping |
| Graceful stop signal | SIGQUIT |
Sessions/uploads under /tmp are ephemeral. Use suitable storage/session backends for persistence and multiple replicas. The 512 MiB container limit in the examples is an initial estimate, not workload sizing guidance.
Configuration sources are php.ini and php-fpm.conf. Image paths are /usr/local/etc/php/php.ini and /usr/local/etc/php-fpm.conf; extra INI files are read from /usr/local/etc/php/conf.d/. FPM clears inherited environment variables by default, so expose only the variables your application needs through deliberate pool configuration.
Keep TLS verification and existing source/configuration protections enabled. The Kubernetes template is for development; no production cluster validation is claimed.
Use Docker Engine with Buildx and run commands from this repository root. Create a dedicated builder once:
docker buildx create --name php74-cve-builder --driver docker-container \
--driver-opt image=moby/buildkit@sha256:cec9f139f45e93c5c69c60f8b07cfad9f43f4ef6b6a6cd917527fea5ff2e3dea
sh scripts/verify.sh
sh scripts/build.sh
sh scripts/test.sh
sh scripts/scan.shThe steps verify sources, build runtime/test targets, run focused regressions and collect raw Trivy plus CycloneDX SBOM evidence. Set BUILDER, IMAGE, TEST_IMAGE or BUILD_JOBS to override the dedicated builder, local tags or compile parallelism; BUILD_JOBS defaults to 2.
On Windows PowerShell, after creating the builder:
./scripts/build.ps1 -TestThe PowerShell wrapper supports -Builder, -Image, -Jobs and -ReportDirectory. POSIX wrappers require a POSIX shell. Building a local image does not upload it.
CI builds on a clean Linux amd64 runner, runs focused checks, collects scanner/SBOM artifacts and confirms that production release is denied. Actions are pinned by commit SHA, CI has read-only repository permissions, and no registry credential is stored in the source. Artifacts have a 14-day retention period.
security-report.json is the preserved report for the prior local image dated 2026-10-30. Its exact image identities, outcomes and references are historical. The earlier configured upstream run retained 44 FAIL and 1 WARN; see docs/HISTORY.md for scope and original receipts.
Fresh builds/scans have their own image-bound reports. Local publication outputs use reports/publication-2026-10-31/ so existing reports are preserved. CI writes reports/ in its own checkout. Focused regressions do not replace the complete upstream suite, which has a separate upstream-test build target.
The earlier raw native scan retained 3 CRITICAL and 14 HIGH findings. Applicability assessments do not suppress findings or grant a production waiver. Detailed independent mysqlnd review remains unfinished and is not retried by packaging/publication. A green CI run means its build and checks completed; it does not certify complete security coverage.
Include the image digest, platform, relevant logs and a small reproducer in a GitHub issue. Remove credentials and private application data before sharing.
For source/patch inputs, start with docker/ and patches/. For runtime defaults, use config/. Build/test helpers are in scripts/ and tests/. Read SECURITY.md before evaluating production readiness and NOTICE.md for upstream notices.