If you use my alpine-lighttpd-php Docker image, please pull :latest again and recreate your container. The image now runs PHP 8.4.27, which fixes the php2shell vulnerabilities.

docker pull alastairhm/alpine-lighttpd-php:latest
# or
docker pull ghcr.io/alastairhm/alpine-lighttpd-php:latest

What is php2shell?

php2shell is the name for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are critical, and both allow remote code execution with no authentication. PHP published a security advisory on 21 October, alongside fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Inktober 2026 22, Beacon

It took hours. Cutting torches, pry bars, and the hero’s bare hands on the worst of the beams. Finally the debris shifted and there it was, wedged under a collapsed bulkhead: SOSi.

Bashed, scorched, one panel hanging by a hinge, a long scrape down its flank. Nobody dared say it out loud.

Then the status lights stuttered on, one by one, and the little unit gave a groan of servos and hauled itself upright. It shambled off across the wreckage on its four stubby legs, limping on the left rear, and climbed to the highest ground it could find.

Inktober 2026 21, Hero

Scream of metal. Deck plates buckling underfoot. The hull is tearing open and the air is going, and someone is screaming for a medic, and it might be me.

Then through the smoke and steam, a shape. Massive. Unmoving. Power armour, scorched but standing, the skull on its chest glowing through the haze.

We’re not dead. He came. The hero came.

Hero.