[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4Std01UkJPRKFTeGrhmJVuKfgP7H6nyjAWhfe0pF9u0":3},{"article":4,"iocs":54,"watch_terms":62,"solutions":63,"lesson":125},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"8224030e-dd23-4d6f-954c-f67b99d78f3e","How to patch PHP2Shell with free Aikido Images","how-to-patch-php2shell-with-free-aikido-images-83a7bc","Patch PHP2Shell (CVE-2026-109618 and CVE-2026-109619) with free Aikido Images for PHP 5.5 to 8.5. Stay on your current version with backported fixes. Category: Product Updates","PHP2Shell (CVE-2026-109618 and CVE-2026-109619) are critical RCE vulnerabilities (CVSS 9.2) affecting PHP, with exploitation already reported by Cloudflare. Official fixes landed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026, but older unsupported PHP versions receive no upstream patches. Aikido provides free pre-patched PHP container images covering PHP 5.5 through 8.5 (except 8.0) with PHP2Shell fixes backported, enabling users to patch without upgrading major versions.","Aikido releases free patched PHP container images for PHP2Shell RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619.","https:\u002F\u002Fwww.aikido.dev\u002Fblog\u002Fhow-to-patch-php2shell-with-free-aikido-images","https:\u002F\u002Fcdn.prod.website-files.com\u002F642adcaf364024654c71df23\u002F6adfd47872cf022fdb5fde3f_Aikido_Feature.jpg","2026-10-26T22:15:00+00:00","2026-10-26T23:00:09.093309+00:00",8,[17,20,23,25,28,31],{"name":18,"type":19},"PHP","product",{"name":21,"type":22},"Aikido","vendor",{"name":24,"type":22},"Cloudflare",{"name":26,"type":27},"PHP2Shell","campaign",{"name":29,"type":30},"Docker container images","technology",{"name":32,"type":30},"Amazon ECR","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":33,"icon":35,"name":36,"slug":37},null,"Vulnerabilities","vulnerabilities",[39,44,49],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[55,59],{"type":56,"value":57,"context":58},"cve","CVE-2026-109618","Critical PHP remote code execution vulnerability, CVSS 9.2",{"type":56,"value":60,"context":61},"CVE-2026-109619","Critical PHP remote code execution vulnerability, CVSS 9.2, related to session.upload_progress.enabled",[21,24,18],{"controls":64,"vendors":119},[65,94],{"slug":66,"name":67,"problem":68,"products":69},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":95,"name":96,"problem":97,"products":98},"patch-management","Automated patch management","Known holes get closed in days, not months.",[99,107,111],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":95,"product_name":108,"url":109,"description":110},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[120],{"slug":121,"name":24,"logo_path":122,"roles":123},"cloudflare","\u002Fvendor-logos\u002Fcloudflare.png",[124],"reported_by",{"slug":126,"title":127,"body":128,"framework_refs":129,"framework_notes":137},"critical-php-rce-vulnerabilities-highlight-risks-of-running-unsupported-versions","Critical PHP RCE Vulnerabilities Highlight Risks of Running Unsupported Versions","PHP2Shell (CVE-2026-109618 and CVE-2026-109619) are critical remote code execution vulnerabilities scoring 9.2 on the CVSS scale, with active exploitation already confirmed in the wild by Cloudflare. Official patches were released for supported PHP branches (8.2–8.5), but organizations running older, unsupported PHP versions are left exposed with no upstream remediation path. This situation is alarmingly common — many production environments lag behind on runtime upgrades due to compatibility concerns, leaving them vulnerable to catastrophic attacks. The availability of third-party backported patches from vendors like Aikido underscores that patch management must extend beyond official vendor support lifecycles, especially for internet-facing workloads.",[130,131,132,133,134,135,136],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","PCI DSS Requirement 6","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":138,"PCI DSS Requirement 6":139,"NIST SP 800-53 SI-2: Flaw Remediation":140,"CIS Control 17: Incident Response Management":141,"OWASP A06:2021 Vulnerable and Outdated Components":142,"CIS Control 7: Continuous Vulnerability Management":143,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":144},"NIS2 obligates essential and important entities to implement incident handling and vulnerability management measures; running actively exploited, unpatched PHP on internet-facing infrastructure represents a direct failure of this obligation.","Requirement 6 mandates that all system components are protected from known vulnerabilities by installing applicable security patches, with critical patches deployed within one month — a standard that would have driven PHP2Shell remediation before exploitation occurred.","SI-2 requires organizations to identify, report, and correct information system flaws, including installing security patches within defined timeframes — directly applicable to the delayed or absent patching of end-of-life PHP versions exposed here.","With active exploitation confirmed by Cloudflare, organizations needed a tested incident response plan to rapidly assess compromise, deploy compensating controls, and prioritize emergency patching — capabilities that CIS Control 17 builds and validates.","Running unsupported PHP versions with no upstream patch availability is a textbook instance of A06, where using components with known vulnerabilities or beyond their support lifecycle directly enables critical RCE attacks.","Active exploitation of PHP2Shell was reported before many organizations patched; a continuous vulnerability management program with defined SLAs for critical CVEs would mandate emergency remediation within hours of disclosure.","A.8.8 requires timely identification and remediation of technical vulnerabilities; organizations without a process to track EOL runtimes and apply backported or third-party patches failed this control entirely."]