How to patch PHP2Shell with free Aikido Images
Aikido releases free patched PHP container images for PHP2Shell RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619.
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) are critical RCE vulnerabilities (CVSS 9.2) affecting PHP, with exploitation already reported by Cloudflare. Official fixes landed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026, but older unsupported PHP versions receive no upstream patches. Aikido provides free pre-patched PHP container images covering PHP 5.5 through 8.5 (except 8.0) with PHP2Shell fixes backported, enabling users to patch without upgrading major versions.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Aikido?
Get an email when a new story names Aikido, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonPHP2Shell (CVE-2026-109618 and CVE-2026-109619) are critical remote code execution vulnerabilities scoring 9.2 on the CVSS scale, with active exploitation already confirmed in the wild by Cloudflare. Official patches were released for supported PHP branches (8.2–8.5), but organizations running older, unsupported PHP versions are left exposed with no upstream remediation path. This situation is alarmingly common — many production environments lag behind on runtime upgrades due to compatibility concerns, leaving them vulnerable to catastrophic attacks. The availability of third-party backported patches from vendors like Aikido underscores that patch management must extend beyond official vendor support lifecycles, especially for internet-facing workloads.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-109618
- cve — CVE-2026-109619