OpenEMR php2shell Advisory
Oct 21, 2026 ·
A critical, actively-exploited PHP vulnerability (php2shell — CVE-2026-109618 / CVE-2026-109619) allows unauthenticated remote code execution. OpenEMR 8.4.x Docker deployments can be fixed now with an in-container package update; 8.3.x / 8.2.x and 8.0.x have no in-container fix yet and need the steps below.
The vulnerability
php2shell (CVE-2026-109618 and CVE-2026-109619) is a pair of critical flaws in PHP core, rated CVSS v4.0 9.2, both leading to unauthenticated remote code execution. They were disclosed on 2026-10-21 and are being actively exploited, with public proof-of-concept code.
- CVE-2026-109618 — out-of-memory handling during multipart (rfc1867) request parsing can leave request data partially initialized, and cleanup then treats it as valid.
- CVE-2026-109619 — request-owned internal state can survive after its memory is freed and be reused by a later request on the same worker (confirmed via the session upload-progress feature).
Any site with sessions or file uploads enabled — both on by default — is exploitable. The fix is PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35; PHP states there is no complete mitigation short of updating.
More details can be found on the PHP’s security advisory here: https://www.php.net/archive/2026.php#2026-10-21-5
Affected images and fix status
Whether an in-container fix exists depends on the Alpine base each image ships, which we confirmed by inspecting the published images.
| OpenEMR image | PHP | Alpine base | In-container apk fix today |
|---|---|---|---|
8.4.x (latest) |
8.5 | 3.24 | Yes — php85 8.5.12 is published for Alpine 3.24 |
| 8.3.x | 8.5 | 3.23 | Not yet — awaiting the Alpine 3.23 backport |
| 8.2.x | 8.5 | 3.23 | Not yet — awaiting the Alpine 3.23 backport |
| 8.0.x | 8.4 | 3.22 | No — Alpine 3.22 community is end-of-life; no backport planned |
Alpine supports community-repository packages (which include PHP) only until the next stable release, so only the current stable (3.24) is guaranteed the fix.
OpenEMR 8.4.x — fix available now
These images run PHP 8.5 on Alpine 3.24, and Alpine has published the fixed packages (8.5.12). Apply the fix to a running deployment immediately — no OpenEMR version change and effectively no downtime:
docker compose exec openemr sh -lc '/sbin/apk update && /sbin/apk upgrade $(/sbin/apk info -q | grep "^php85")'
docker compose restart openemr
Verify with docker compose exec openemr php -v (expect 8.5.12 or higher).
Pulling the latest image does not apply the fix on its own. The currently published 8.4.x image was built before the fix was available, so pulling or updating to it still ships unpatched PHP — you must run the commands above regardless, until a rebuilt image is published. This in-container update lives in the container’s writable layer: use restart, not down / up --force-recreate, which would revert it.
OpenEMR 8.3.x / 8.2.x — awaiting the Alpine 3.23 backport
These images run PHP 8.5 on Alpine 3.23. Alpine released the 8.5.12 fix for its current stable (3.24) but not yet for 3.23, so there is no in-container update for these images today. Alpine maintainers are preparing the 3.23 backport; once it lands, apply the fix exactly as 8.4.x users do:
docker compose exec openemr sh -lc '/sbin/apk update && /sbin/apk upgrade $(/sbin/apk info -q | grep "^php85")'
docker compose restart openemr
Options, in order of ease:
- Wait for the 3.23 backport — we are monitoring it and will refresh our images as soon as it lands.
- Move to an OpenEMR 8.4.x image (Alpine 3.24, already fixed) and run the commands above; the same “pulling the image alone is not enough” caveat applies.
- As a last resort, build PHP 8.5.12 for Alpine and apply it yourself.
OpenEMR 8.0.x — Alpine 3.22 base is end-of-life
These images run PHP 8.4 on Alpine 3.22, whose community repository is end-of-life — Alpine has no plans to backport the fix. You will need to move to a supported image (8.4.x on Alpine 3.24) or build PHP 8.4.27 for Alpine yourself.
If you cannot deploy a fix
Until a fix is in place, reduce exposure:
- Disconnect OpenEMR from any public-facing internet — it holds PHI and should not be directly reachable.
- Evaluate your exposure to internal users and restrict access to trusted networks or VPN.
- If necessary, take OpenEMR offline until a fix is available.
These are containment measures, not a fix; PHP states there is no complete mitigation short of updating.
Build and release status
Our Docker image build infrastructure is temporarily offline due to an upstream Ubuntu/Launchpad PPA outage affecting our build pipeline, so we cannot publish rebuilt images right now. The in-container apk update for 8.4.x does not depend on our build pipeline and is available now. We will notify users when our build infrastructure is restored and refreshed images are published. The 8.3.x / 8.2.x rebuilds additionally depend on the pending Alpine 3.23 backport.
What we are tracking
We are monitoring the following and will update this advisory as each changes:
- Alpine 3.23
php85— moves past 8.5.6 when the 8.3.x / 8.2.x backport lands. - Alpine 3.24
php85— a move past 8.5.12 would indicate a follow-up PHP release (8.5.13) with additional hardening, which has been discussed upstream. - Build pipeline — recovery of the Ubuntu/Launchpad PPA host, after which we rebuild and republish images.