Fix php2shell in Docker and Kubernetes

1. Find the PHP version in each container

Which images are running:

docker ps --format '{{.Names}}\t{{.Image}}'

PHP version inside a container:

docker exec <container> php -r 'echo PHP_VERSION, PHP_EOL;'

Kubernetes: images used by your pods:

kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\t"}{.spec.containers[*].image}{"\n"}{end}'

2. Rebuild on a fixed base image

Pin the fixed patch version in your Dockerfile (official image, 8.3.36 as an example):

FROM php:8.3.36-fpm

Floating tags such as php:8.3-fpm move to the fixed release, but only after you pull them again. Rebuild with a fresh base:

docker compose build --pull

Images built on Ubuntu or Debian with apt packages: rebuild so the image gets the patched packages (see the Ubuntu and Debian guides for versions).

docker build --pull --no-cache -t <image> .

3. Replace the running containers

Docker Compose:

docker compose up -d

Kubernetes: push the new tag, update the deployment and wait for the rollout:

kubectl set image deployment/<name> <container>=<image>:<new-tag> && kubectl rollout status deployment/<name>

4. Verify

Check the version in the new container:

docker compose exec <service> php -r 'echo PHP_VERSION, PHP_EOL;'

Repeat for every service and CI image that runs PHP behind a web server.