PHP2Shell RCE (CVE-2026-109618/19): Patch Guide, Aikido Images & Mitigations

PHP2Shell Critical RCE Vulnerabilities

PHP2Shell refers to two severe remote code execution (RCE) vulnerabilities in PHP itself: CVE-2026-109618 and CVE-2026-109619 . Both score 9.2 on CVSS v4.0, allowing unauthenticated attackers to execute code on servers processing PHP requests. Cloudflare reports these vulnerabilities are already being exploited in the wild.

The PHP Group released patched versions on October 21: 8.5.12, 8.4.27, 8.3.36, and 8.2.35 . If you run PHP in your stack, update immediately. For container deployments, Aikido provides free patched PHP images that backport fixes to older versions.

Update to Patched PHP Versions

The only complete fix is updating to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, then restarting all PHP processes and rebuilding all container images. Patching only running containers leaves images exposed. After updating, retain session.upload_progress.enabled=0 in your <PHP-FPM-pool-config-file> (a php.ini applied by PHP-FPM pool or server config before request parsing). This rarely used legacy feature is an entry point for CVE-2026-109619; disabling it eliminates that vector even on patched systems. Restart all workers after setting.

Use Patched Aikido Images

Patched Aikido Images are freely available on the Aikido public Amazon Elastic Container Registry (ECR) . Choose your branch from the list below and pull the latest patch for your variant, e.g. public.ecr.aws/aikido-dev/php:8.5.12-fpm. Base variants are plain tags like php:8.2.35. If upstream has no fix, Aikido backports the patch to your running version so the tag keeps its version number.

5.5 : latest 5.5.38; variants: Apache, CLI, FPM

5.6 : latest 5.6.40; variants: Base, Apache, CLI, FPM

7.0 : latest 7.0.33; variants: Base, Apache, CLI, FPM

7.1 : latest 7.1.33; variants: Base, Apache, CLI, FPM

7.2 : latest 7.2.34; variants: Base, Apache, CLI, FPM

7.3 : latest 7.3.33; variants: Base, Apache, CLI, FPM, CLI-Bullseye

7.4 : latest 7.4.33; variants: Base, Apache, CLI, FPM

8.2 : latest 8.2.35; variants: Base, Apache, FPM, Alpine 3.24, CLI-Alpine 3.24, FPM-Alpine 3.24

8.3 : latest 8.3.36; variants: Apache, CLI

8.4 : latest 8.4.27; variants: base, apache, cli, fpm, trixie, fpm-trixie, alpine3.23, alpine3.24, fpm-alpine3.23, fpm-alpine3.24

8.5 : latest 8.5.12; variants: base, apache, cli, fpm, trixie, fpm-trixie, alpine3.23, alpine3.24, cli-alpine3.23, cli-alpine3.24, fpm-alpine3.23, fpm-alpine3.24

More images are being prepared; you can also update directly to the fixed PHP versions.

Update via OS or Vendor

Linux distributions and long-term support (LTS) vendors received patches early; check your vendor for updated packages first. The official PHP announcement notes that the volunteer-maintained Remi repository (rpms.remirepo.net) has not yet been updated; monitor its status or switch to distro packages or build from source.

If Running PHP 8.1 or Earlier

The PHP project no longer provides updates for these versions. Upgrade to a supported branch or contact your server vendor for backported fixes. The PHP security team released minimal source-code backports for 7.4, 8.0, and 8.1 for teams building from source. Aikido Images cover the 7.x series as well as PHP 5.5 and 5.6 (see list above). PHP 8.2 reaches end-of-life on December 31, 2026; plan migration to a supported branch.

How to Verify Your PHP Installation Is Patched

Use a public scanner. Aikido's free PHP2Shell scanner reports whether a site is vulnerable, mitigated, or patched.

Find all PHP installations. Include parallel PHP branches, containers, CI/CD images, hosting panels (cPanel, 宝塔, Plesk), vendor software, and Windows php.exe and php-cgi.exe binaries.

Do not trust only php -v . It reports the CLI binary, which may differ from the PHP-FPM or Apache module serving your site.

Check vendor changelogs for CVE IDs. Replace package name with your own:

# Ubuntu:
apt changelog php8.3-cli | grep -E "CVE-2026-109618|CVE-2026-109619"

# RHEL, Rocky Linux, AlmaLinux:
rpm -q php-cli --changelog | grep -E "CVE-2026-109618|CVE-2026-109619"

Restart or replace all workers. Restart PHP-FPM, Apache, and all application workers, or redeploy containers, then confirm no workers still run the old version.

Aikido Images: Use the latest patch for your branch listed above.

Restore emergency settings but keep upload progress off. If you applied temporary mitigations, restore original memory_limit values in php.ini and verify all upload limits. Keep session.upload_progress.enabled=0 as is.

If You Cannot Update Immediately

These measures reduce risk for specific attack paths but do not guarantee absolute safety; each addresses only one vulnerability. The PHP security advisory lists all vulnerabilities.

For CVE-2026-109618:

Set memory limit to unlimited: memory_limit=-1, ensuring the application cannot override it (e.g., via php_admin_value in PHP-FPM pool or Apache config). Confirm no pool, directory, or application setting can restore a finite limit. This eliminates the attacker-controllable memory-limit fault, but the underlying allocation fault may still hit vulnerable code, and runaway requests could exhaust server resources due to no cap.

Limit post_max_size : If your application does not need file uploads, set a low value (e.g., 8M or 32M). Keep upload_max_filesize below that. Also enforce request size, field count, multipart parts, header count, and nesting limits at the web server or proxy, including for requests lacking Content-Length.

Use container or cgroup memory limits as availability boundaries , ideally terminating only the affected worker. Do not use RLIMIT_AS or RLIMIT_DATA, as they may trigger the vulnerable allocation failure.

For CVE-2026-109619:

Disable session upload progress: Set session.upload_progress.enabled=0 in PHP-FPM pool or server config (applied before request parsing) and restart all workers. Do not rely on --session-path or ini_set() /

user.ini

--session-path

; this blocks the confirmed session path but not other variants.

In PHP 8.5, set fatal_error_backtraces=0 and restart each worker. This blocks the confirmed fatal-error backtrace path.

Remove invalid or deprecated per-request settings that emit diagnostics before initialization. Hide error messages: set error_reporting and display_errors to 0; do not use the @ operator.

If your application does not use multipart uploads, block multipart/form-data before POST requests reach PHP.

After Patching: Check for Compromise

Look for anomalous requests followed by memory-limit errors or repeated HTTP 500 responses, and check for oversized or malformed PHPSESSID cookies in responses. Then search for web shells, unexpected files, new admin users, modified PHP files, unexpected child processes spawned by PHP or the web server, and unusual outbound connections.

Code execution gives attackers access to everything the PHP process can read, including database credentials and API keys. If compromise is suspected, immediately rotate and revoke secrets on affected systems.

The PHP Foundation and security community will publish further remediation guides. The PHP security advisory contains full technical details: https://www.php.net/archive/2026.php#2026-10-21-5.