PHP2Shell is a pair of critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on CVSS v4.0, and either one can let an unauthenticated attacker run code on a server that handles PHP requests. Cloudflare reports that exploitation has started.
PHP shipped fixes on October 21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are out of support and won’t get an upstream release. Aikido publishes free patched PHP container images for every release line from 5.5 to 8.5 except 8.0, with the PHP2Shell fixes backported into the version you already run.
If you haven’t patched PHP2Shell yet, do it now. On PHP 8.2 or newer, update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and follow the steps in our PHP2Shell post. Aikido Images cover most of the older release lines that PHP no longer updates, so you can patch those without upgrading to a supported branch first.
Why use Aikido Images for PHP2Shell
Moving an application across PHP major versions takes time, and a legacy app on PHP 5.6 or 7.4 can’t jump to 8.2 overnight. Aikido Images keep you on your current release line. Where upstream doesn’t have a fix, we backport the PHP2Shell patches into the version you run, so the tag keeps its version number and you don’t have to port your application first.
For supported branches, the images match the upstream fixed versions, so updating comes down to changing the base image in your Dockerfile.
Available images
Aikido Images are free on the Aikido public Amazon Elastic Container Registry (ECR) at public.ecr.aws/aikido-dev/php. Find your release line below and pull the latest patch in the variant you use.
Aikido also publishes patched builds of some earlier patch releases, including 8.2.34, 8.3.35, 8.4.26 and 8.5.11, so you can stay on the exact version you run. Browse the full tag list in the public ECR gallery.
How to pull an image
Tags combine the version and the variant. For PHP 8.5 with FPM:
docker pull public.ecr.aws/aikido-dev/php:8.5.12-fpm
The base variant uses the plain version tag, such as php:8.2.35. In a Dockerfile, change the FROM line:
FROM public.ecr.aws/aikido-dev/php:7.4.33-apache
For the latest patched Alpine build without pinning a version, use php:alpine or php:fpm-alpine.
After you switch images
Patching a running container leaves the image exposed, so rebuild every image that uses PHP and redeploy. Then:
- Restart PHP-FPM and Apache workers, or redeploy containers, and confirm no worker still runs the old build.
- Keep session.upload_progress.enabled=0 in php.ini or your PHP-FPM pool configuration. It’s a rarely used legacy feature and one confirmed path to CVE-2026-109619.
- Test your public URL with Aikido’s free PHP2Shell checker, which reports the site’s PHP2Shell status.
- Look for signs of compromise. Our PHP2Shell post lists what to check.
If your version isn’t listed yet
PHP 8.0 doesn’t have an Aikido Image yet, and some release lines have only a few variants, such as 8.1. We’re preparing more images. Until yours is available, update to a fixed PHP version or ask your vendor for a backported fix. PHP’s security team has also published minimal source backports for PHP 7.4 through 8.1 for teams that build from source.
For details on both CVEs and temporary mitigations if you can’t update yet, see our PHP2Shell post.
For a walkthrough of how to check your exposure and patch PHP2Shell, including with Aikido Images, watch the video below.
