cyber.hendryadrian.com
Vulnerability & Exploit · aikido.dev

Aikido Offers Patched PHP Images for PHP2Shell Vulnerabilities

· Original article ↗

Summary

Cloudflare reports exploitation of two critical PHP RCE flaws, CVE-2026-109618 and CVE-2026-109619. PHP issued fixes; Aikido offers free backported container images for older branches and outlines rebuild and mitigation steps.

Key points

  • PHP2Shell comprises CVE-2026-109618 and CVE-2026-109619, each rated 9.2 under CVSS v4.0; the article says either can allow unauthenticated remote code execution.
  • Cloudflare reports that exploitation has started.
  • PHP fixed supported branches in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
  • Aikido offers free patched container images for release lines 5.5 through 8.5, except 8.0, with fixes backported for older branches.
  • After updating, rebuild and redeploy PHP images and ensure no workers are still running the old build.
  • The article recommends keeping session.upload_progress.enabled=0 as a mitigation for one confirmed path to CVE-2026-109619.

Article Details

Vulnerability Types
  • Remote code execution (RCE)
Severity
Critical (CVSS v4.0 9.2)
Exploitation Status
reported
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Set session.upload_progress.enabled=0 in php.ini or the PHP-FPM pool configuration; the article identifies this as a mitigation for one confirmed path to CVE-2026-109619.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThe article describes unauthenticated attackers exploiting PHP vulnerabilities to execute code on servers that handle PHP requests.

CVE

CVE-2026-109618PHP2Shell is a pair of critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on CVSS v4.0, and either one can let an unauthenticated attacker run code on aCVE-2026-109619is a pair of critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on CVSS v4.0, and either one can let an unauthenticated attacker run code on a server

Vendors

Aikido8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are out of support and won’t get an upstream release. Aikido publishes free patched PHP container images for every release line from 5.5 to 8.5 except 8.0, with the

Products

Aikido Images8.2 or newer, update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and follow the steps in our PHP2Shell post. Aikido Images cover most of the older release lines that PHP no longer updates, so you can patch those withoutPHPPHP2Shell is a pair of critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on CVSS v4.0, and either one can let an unauthenticated attacker run code on a

Related Articles