OFFICIAL REMEDIATION GUIDE
Patching PHP2Shell in Docker Containers & Kubernetes Pods
Running Docker containers never update themselves. Learn how to pull official php:8.3.36-fpm and php:8.4.27-fpm tags and execute clean compose rebuilds.
A running Docker container never updates itself. Running apt update inside a container is an anti-pattern and will be wiped on restart. You must update your base image in the Dockerfile and rebuild.
Step 1: Check Current Container Image and Version
List all running containers and test their PHP version:
docker ps --format "table {{.Names}}\t{{.Image}}\t{{.Status}}"
docker exec <container_name> php -vStep 2: Update Dockerfile Base Image to Patched Tags
Update your Dockerfile to use verified secure upstream tags:
# Secure base image tags:
FROM php:8.4.27-fpm-alpine
# OR:
FROM php:8.3.36-fpm-bookwormStep 3: Pull New Image and Rebuild Compose Stack
Force pulling the updated remote digest and restart services:
docker compose pull
docker compose build --no-cache --pull
docker compose up -d --force-recreate