CVE-2018-11756: In PHP Runtime for Apache OpenWhisk, a Docker action inheriting one of the Docker tags openwhisk/action-php...

Security readout for executives and security teams

This issue affects specific Apache OpenWhisk PHP runtime Docker images. If an organization built actions from the vulnerable PHP runtime tag and the action code also has a code-exploitation weakness, an attacker may be able to replace the user function inside the container. Exposure is limited to Apache OpenWhisk PHP actions or custom images inheriting the listed Docker tags. Organizations not using OpenWhisk PHP runtime images, or not using these affected tags, are not indicated as affected by the provided sources. Treat this as targeted remediation for teams using Apache OpenWhisk PHP runtimes. It is not documented as actively exploited in the supplied sources, but affected serverless workloads should be inventoried and rebuilt because the impact is function integrity compromise. Mitigation focus: Inventory OpenWhisk PHP actions and base images for the affected Docker tags.; Stop building new actions from the listed vulnerable runtime tags.; Review Apache advisory and commit guidance for corrected runtime image handling..

Prepared

Jun 7, 2026, 05:54 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.