How to patch PHP2Shell with free Aikido Images

What it is

Aikido Images are free patched PHP container images on public ECR (public.ecr.aws/aikido-dev/php) that carry the PHP2Shell fixes for CVE-2026-109618 and CVE-2026-109619. Both CVEs score 9.2 on CVSS v4.0, and either lets an unauthenticated attacker run code on a server that handles PHP requests. Cloudflare reports that exploitation has started.

Preconditions / Affected

PHP fixed 8.2 to 8.5 on 21 October 2026, in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are out of support and get no upstream release. Aikido covers every release line from 5.5 to 8.5 except 8.0. Some lines, such as 8.1, have only a few variants.

One confirmed path to CVE-2026-109619 is session.upload_progress, a rarely used legacy feature.

What to do

Choose by release line:

• PHP 8.2 or newer: update to a fixed upstream version, or switch to the matching Aikido image, which matches upstream fixes.
• PHP 8.1 and older (except 8.0): switch to the Aikido image. The backport keeps your version number, so no application port is needed first.
• PHP 8.0: no Aikido image exists. Update to a fixed PHP version, ask your vendor for a backport, or build from source using the minimal backports PHP's security team published for 7.4 through 8.1.

Tags combine version and variant. Pull example:

docker pull public.ecr.aws/aikido-dev/php:8.5.12-fpm

Dockerfile change:

FROM public.ecr.aws/aikido-dev/php:7.4.33-apache

The base variant uses a plain version tag, such as php:8.2.35. Unpinned latest patched Alpine builds are php:alpine and php:fpm-alpine. Patched builds of earlier patch releases also exist (8.2.34, 8.3.35, 8.4.26, 8.5.11), so you can stay on your exact version.

After switching:

1. Rebuild every image that uses PHP and redeploy. Patching a running container leaves the image exposed.
2. Restart PHP-FPM and Apache workers or redeploy containers, and confirm no worker still runs the old build.
3. Keep session.upload_progress.enabled=0 in php.ini or the PHP-FPM pool configuration.
4. Test your public URL with Aikido's free PHP2Shell checker.
5. Check for signs of compromise, using the list in Aikido's separate PHP2Shell post.

Caveats

The post defers CVE mechanism details, temporary mitigations and the compromise checklist to Aikido's PHP2Shell post, so none are covered here. Aikido says more images are in preparation. The images come from a vendor selling security products, and the post gives no independent verification of the backports.