How to patch PHP2Shell with free Aikido Images
Summary
- Published
- Collected
📦 Full-Text Content Snapshot
R2 Archive · Full Article PreservedPublished on: 2026-10-26 · Source: aikido.dev
How to patch PHP2Shell with free Aikido Images
How to patch PHP2Shell with free Aikido Images
Get secure now for free
Written by
Published on:
Oct 26, 2026
Last updated on:
Oct 27, 2026
PHP2Shell is a pair of critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on CVSS v4.0, and either one can let an unauthenticated attacker run code on a server that handles PHP requests. Cloudflare reports that exploitation has started.
PHP shipped fixes on October 21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are out of support and won’t get an upstream release. Aikido publishes free patched PHP container images for every release line from 5.5 to 8.5 except 8.0, with the PHP2Shell fixes backported into the version you already run.
If you haven’t patched PHP2Shell yet, do it now. On PHP 8.2 or newer, update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and follow the steps in our PHP2Shell post. Aikido Images cover most of the older release lines that PHP no longer updates, so you can patch those without upgrading to a supported branch first.
Why use Aikido Images for PHP2Shell
Moving an application across PHP major versions takes time, and a legacy app on PHP 5.6 or 7.4 can’t jump to 8.2 overnight. Aikido Images keep you on your current release line. Where upstream doesn’t have a fix, we backport the PHP2Shell patches into the version you run, so the tag keeps its version number and you don’t have to port your application first.
For supported branches, the images match the upstream fixed versions, so updating comes down to changing the base image in your Dockerfile.
Available images
Aikido Images are free on the Aikido public Amazon Elastic Container Registry (ECR) at public.ecr.aws/aikido-dev/php. Find your release line below and pull the latest patch in the variant you use.
| Release line | Latest version | Variants available | Floating tags |
|---|---|---|---|
| 5.5 | 5.5.38 | apache, cli, fpm | |
| 5.6 | 5.6.40 | base, apache, cli, fpm | |
| 7.0 | 7.0.33 | base, apache, cli, fpm | |
| 7.1 | 7.1.33 | base, apache, cli, fpm | |
| 7.2 | 7.2.34 | base, apache, cli, fpm | |
| 7.3 | 7.3.33 | base, apache, cli, fpm, cli-bullseye | 7.3-apache |
| 7.4 | 7.4.33 | base, apache, cli, fpm | 7.4-apache, 7.4-fpm-bullseye |
| 8.1 | 8.1 | cli, fpm-alpine3.21 | 8.1-cli, 8.1-fpm-alpine3.21 |
| 8.2 | 8.2.35 | base, apache, fpm, alpine3.24, cli-alpine3.24, fpm-alpine3.24 | 8.2-fpm-alpine, 8.2-fpm-bookworm |
| 8.3 | 8.3.36 | apache, cli | 8.3-apache-bookworm, 8.3-fpm-bookworm |
| 8.4 | 8.4.27 | base, apache, cli, fpm, trixie, fpm-trixie, alpine3.23, alpine3.24, fpm-alpine3.23, fpm-alpine3.24 | 8.4-apache, 8.4-cli, 8.4-fpm-bookworm |
| 8.5 | 8.5.12 | base, apache, cli, fpm, trixie, fpm-trixie, alpine3.23, alpine3.24, cli-alpine3.23, cli-alpine3.24, fpm-alpine3.23, fpm-alpine3.24 | 8.5-apache-trixie |
Aikido also publishes patched builds of some earlier patch releases, including 8.2.34, 8.3.35, 8.4.26 and 8.5.11, so you can stay on the exact version you run. Browse the full tag list in the public ECR gallery.
How to pull an image
Tags combine the version and the variant. For PHP 8.5 with FPM:
docker pull public.ecr.aws/aikido-dev/php:8.5.12-fpm
The base variant uses the plain version tag, such as php:8.2.35. In a Dockerfile, change the FROM line:
FROM public.ecr.aws/aikido-dev/php:7.4.33-apache
For the latest patched Alpine build without pinning a version, use php:alpine or php:fpm-alpine.
After you switch images
Patching a running container leaves the image exposed, so rebuild every image that uses PHP and redeploy. Then:
- Restart PHP-FPM and Apache workers, or redeploy containers, and confirm no worker still runs the old build.
- Keep session.upload_progress.enabled=0 in php.ini or your PHP-FPM pool configuration. It’s a rarely used legacy feature and one confirmed path to CVE-2026-109619.
- Test your public URL with Aikido’s free PHP2Shell checker, which reports the site’s PHP2Shell status.
- Look for signs of compromise. Our PHP2Shell post lists what to check.
If your version isn’t listed yet
PHP 8.0 doesn’t have an Aikido Image yet, and some release lines have only a few variants, such as 8.1. We’re preparing more images. Until yours is available, update to a fixed PHP version or ask your vendor for a backported fix. PHP’s security team has also published minimal source backports for PHP 7.4 through 8.1 for teams that build from source.
For details on both CVEs and temporary mitigations if you can’t update yet, see our PHP2Shell post.
For a walkthrough of how to check your exposure and patch PHP2Shell, including with Aikido Images, watch the video below.
Share:
[](https://www.aikido.dev/blog/how-to-patch-php2shell-with-free-aikido-images#)[](https://www.aikido.dev/blog/how-to-patch-php2shell-with-free-aikido-images#)[](https://www.aikido.dev/blog/how-to-patch-php2shell-with-free-aikido-images#)
https://www.aikido.dev/blog/how-to-patch-php2shell-with-free-aikido-images
Subscribe for news
4.7/5
Tired of false positives? Try Aikido like 100k others.
Get a personalized walkthrough
Trusted by 100k+ teams
Scan your app for IDORs and real attack paths
Trusted by 100k+ teams
See how AI pentests your app
Trusted by 100k+ teams
No items found.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
Trusted by 150k+ orgs
📦 Full-Text Markdown Snapshot archived by Phying News · Original source: aikido.dev
--- id: 10371 canonical_url: "https://phying.com/item/10371" title: "How to patch PHP2Shell with free Aikido Images" type: "blog" cve: null cvss: null severity: "unknown" vendor: null product: null affected_versions: null source_domain: "aikido.dev" source_url: "https://www.aikido.dev/blog/how-to-patch-php2shell-with-free-aikido-images" published_at: "2026-10-26T00:00:00Z" snapshot_at: "2026-10-27T15:03:14Z" archived_by: "Phying News (https://phying.com/item/10371)" lang: "en" --- # How to patch PHP2Shell with free Aikido Images *Published on: 2026-10-26 · Source: [aikido.dev](https://www.aikido.dev/blog/how-to-patch-php2shell-with-free-aikido-images)* [Blog](https://www.aikido.dev/blog)[Product Updates](https://www.aikido.dev/category/product-updates) How to patch PHP2Shell with free Aikido Images # How to patch PHP2Shell with free Aikido Images Get secure now for free Written by [Madeline Lawrence](https://www.aikido.dev/team-members/madeline-lawrence) Published on: Oct 26, 2026 Last updated on: Oct 27, 2026 [PHP2Shell](https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell) is a pair of critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on CVSS v4.0, and either one can let an unauthenticated attacker run code on a server that handles PHP requests. Cloudflare reports that exploitation has started. PHP shipped fixes on October 21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are out of support and won’t get an upstream release. Aikido publishes free patched PHP container images for every release line from 5.5 to 8.5 except 8.0, with the PHP2Shell fixes backported into the version you already run. If you haven’t patched PHP2Shell yet, **do it now**. On PHP 8.2 or newer, update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and follow the steps in our [PHP2Shell post](https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell). Aikido Images cover most of the older release lines that PHP no longer updates, so you can patch those without upgrading to a supported branch first. ### Why use Aikido Images for PHP2Shell Moving an application across PHP major versions takes time, and a legacy app on PHP 5.6 or 7.4 can’t jump to 8.2 overnight. Aikido Images keep you on your current release line. Where upstream doesn’t have a fix, we backport the PHP2Shell patches into the version you run, so the tag keeps its version number and you don’t have to port your application first. For supported branches, the images match the upstream fixed versions, so updating comes down to changing the base image in your Dockerfile. ### Available images [Aikido Images](https://help.aikido.dev/autofix-and-remediation/aikido-images) are free on the [Aikido public Amazon Elastic Container Registry (ECR)](https://gallery.ecr.aws/aikido-dev/php) at public.ecr.aws/aikido-dev/php. Find your release line below and pull the latest patch in the variant you use. Release line | Latest version | Variants available | Floating tags ---|---|---|--- 5.5 | 5.5.38 | apache, cli, fpm | 5.6 | 5.6.40 | base, apache, cli, fpm | 7.0 | 7.0.33 | base, apache, cli, fpm | 7.1 | 7.1.33 | base, apache, cli, fpm | 7.2 | 7.2.34 | base, apache, cli, fpm | 7.3 | 7.3.33 | base, apache, cli, fpm, cli-bullseye | 7.3-apache 7.4 | 7.4.33 | base, apache, cli, fpm | 7.4-apache, 7.4-fpm-bullseye 8.1 | 8.1 | cli, fpm-alpine3.21 | 8.1-cli, 8.1-fpm-alpine3.21 8.2 | 8.2.35 | base, apache, fpm, alpine3.24, cli-alpine3.24, fpm-alpine3.24 | 8.2-fpm-alpine, 8.2-fpm-bookworm 8.3 | 8.3.36 | apache, cli | 8.3-apache-bookworm, 8.3-fpm-bookworm 8.4 | 8.4.27 | base, apache, cli, fpm, trixie, fpm-trixie, alpine3.23, alpine3.24, fpm-alpine3.23, fpm-alpine3.24 | 8.4-apache, 8.4-cli, 8.4-fpm-bookworm 8.5 | 8.5.12 | base, apache, cli, fpm, trixie, fpm-trixie, alpine3.23, alpine3.24, cli-alpine3.23, cli-alpine3.24, fpm-alpine3.23, fpm-alpine3.24 | 8.5-apache-trixie Aikido also publishes patched builds of some earlier patch releases, including 8.2.34, 8.3.35, 8.4.26 and 8.5.11, so you can stay on the exact version you run. Browse the full tag list in the [public ECR gallery](https://gallery.ecr.aws/aikido-dev/php). ### How to pull an image Tags combine the version and the variant. For PHP 8.5 with FPM: `docker pull public.ecr.aws/aikido-dev/php:8.5.12-fpm` The base variant uses the plain version tag, such as php:8.2.35. In a Dockerfile, change the FROM line: `FROM public.ecr.aws/aikido-dev/php:7.4.33-apache` For the latest patched Alpine build without pinning a version, use php:alpine or php:fpm-alpine. ### After you switch images Patching a running container leaves the image exposed, so rebuild every image that uses PHP and redeploy. Then: 1. Restart PHP-FPM and Apache workers, or redeploy containers, and confirm no worker still runs the old build. 2. Keep session.upload_progress.enabled=0 in php.ini or your PHP-FPM pool configuration. It’s a rarely used legacy feature and one confirmed path to CVE-2026-109619. 3. Test your public URL with Aikido’s free [PHP2Shell checker](https://php2shell.aikido.io/), which reports the site’s PHP2Shell status. 4. Look for signs of compromise. Our [PHP2Shell post](https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell) lists what to check. ### If your version isn’t listed yet PHP 8.0 doesn’t have an Aikido Image yet, and some release lines have only a few variants, such as 8.1. We’re preparing more images. Until yours is available, update to a fixed PHP version or ask your vendor for a backported fix. PHP’s security team has also published minimal source backports for PHP 7.4 through 8.1 for teams that build from source. For details on both CVEs and temporary mitigations if you can’t update yet, see our [PHP2Shell post](https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell). For a [walkthrough](https://www.youtube.com/watch?v=BAoKuAB2h_E) of how to check your exposure and patch PHP2Shell, including with Aikido Images, watch the video below. Share: [](https://www.aikido.dev/blog/how-to-patch-php2shell-with-free-aikido-images#)[](https://www.aikido.dev/blog/how-to-patch-php2shell-with-free-aikido-images#)[](https://www.aikido.dev/blog/how-to-patch-php2shell-with-free-aikido-images#) https://www.aikido.dev/blog/how-to-patch-php2shell-with-free-aikido-images [Text Link](https://www.aikido.dev/blog/how-to-patch-php2shell-with-free-aikido-images#) ### Subscribe for news 4.7/**5** Tired of false positives? Try Aikido like 100k others. [Start Now](https://app.aikido.dev/login) Get a personalized walkthrough Trusted by 100k+ teams [Book Now](https://www.aikido.dev/book/demo) Scan your app for IDORs and real attack paths Trusted by 100k+ teams [Start Scanning](https://app.aikido.dev/login) See how AI pentests your app Trusted by 100k+ teams [Start Testing](https://app.aikido.dev/login) [Start Now](https://app.aikido.dev/login) [Similar Posts](https://www.aikido.dev/blog/how-to-patch-php2shell-with-free-aikido-images#)[See all](https://www.aikido.dev/blog) No items found. ## Get secure today, quickly and for free. Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase. [Start for Free](https://www.aikido.dev/blog/how-to-patch-php2shell-with-free-aikido-images#) No credit card required | Scan results in 32 seconds. Trusted by 150k+ orgs       --- > 📦 **Full-Text Markdown Snapshot** archived by [Phying News](https://phying.com/item/10371) · Original source: [aikido.dev](https://www.aikido.dev/blog/how-to-patch-php2shell-with-free-aikido-images)