Welcome to Support Portal

Learn how to identify potentially vulnerable PHP workloads, reduce exposure using Aqua Security runtime controls, and remediate affected container images.

Applies to: Aqua Security customers running containerized PHP applications.

Last updated: October 21, 2026

Overview

On October 21, 2026, the PHP security team released emergency security updates addressing two critical remote code execution (RCE) vulnerabilities, collectively referred to as PHP2Shell.

The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are each rated 9.2 (Critical) under CVSS v4.0 and can allow unauthenticated attackers to execute code on affected PHP installations.

The vulnerabilities involve PHP's internal request handling and can affect web-serving PHP environments, including PHP-FPM, Apache with mod_php, and PHP-CGI.

Organizations running PHP should review their environments and prioritize updating affected systems.

For customers using Aqua Security, runtime protection provides an additional layer of defense by restricting unauthorized workload activity while remediation is underway.

Important: Runtime protection helps reduce the impact of exploitation but does not eliminate the underlying vulnerabilities. Applying vendor security updates remains the recommended remediation.

Which PHP versions are affected?

PHP has released the following security updates:

PHP 8.1 and older versions are no longer supported by the PHP project. Customers running these versions should prioritize migration to a supported PHP release.

Some Linux distributions and long-term support vendors may provide security fixes through backported packages. Customers using distribution-managed PHP packages should consult their vendor's security advisory to determine whether a fix has been applied.

For additional details, refer to the official PHP security announcements and PHP supported versions.

Recommended actions for Aqua Security customers

1. Identify PHP workloads

Review your container images and running workloads to identify PHP installations that may be affected.

Using Aqua's image scanning and workload inventory capabilities, identify:

• Container images containing PHP packages or runtimes.
• PHP versions included in application images, base images, and supporting containers.
• Running workloads using affected PHP versions.
• Internet-facing applications that should be prioritized for remediation.
• Workloads using end-of-life PHP versions that require migration.

Where the PHP version cannot be determined from existing scan information, verify it directly through the application or image build configuration.

Prioritize vulnerable images that are actively deployed, particularly those supporting publicly accessible applications.

2. Review Aqua runtime protection policies

Aqua runtime protection can help restrict unauthorized behavior within running containers, even when vulnerability-specific scanning or detection is not yet available.

Review the runtime policies applied to your PHP workloads and consider the following controls:

Restrict unauthorized process execution

Configure runtime policies to restrict PHP workloads from launching unnecessary shells and download utilities, such as sh, bash, curl, and wget.

These restrictions can help interrupt attempts to execute additional commands or download malicious payloads following exploitation.

Enable Drift Prevention

Aqua Drift Prevention can block the execution of executable files that were not present in the original container image.

This helps prevent attackers from running newly introduced executables, such as malicious tools, cryptocurrency miners, or other unauthorized binaries.

Restrict unauthorized network activity

Review network-related runtime controls to restrict unnecessary outbound connections and identify potentially malicious communication.

Depending on the configured controls, these restrictions can help limit reverse-shell activity, communication with attacker-controlled infrastructure, and additional payload downloads.

Protect application files

Review file integrity monitoring (FIM) and file modification restrictions for sensitive application directories, including PHP web roots.

File integrity monitoring can help detect unauthorized file changes, while file modification restrictions can help prevent them when properly configured.

These protections are particularly relevant to PHP applications because malicious PHP web shells may be introduced as scripts and executed by the existing PHP interpreter without requiring a new binary.

3. Validate runtime policies before enforcement

Before applying restrictive runtime controls to production workloads:

1. Review the policies assigned to the affected workloads.
2. Enable the relevant controls in Audit mode where supported.
3. Monitor audit events to identify legitimate application behavior that may be affected.
4. Adjust policy exceptions as necessary.
5. Move validated policies into Enforce mode to actively block unauthorized actions.

Audit mode provides visibility but does not block the monitored activity.

The effectiveness of runtime protection depends on the enabled controls, policy configuration, workload coverage, and attack technique. Customers should validate policy behavior against their application requirements before enabling enforcement.

4. Apply PHP security updates

Update affected PHP installations using the fixed releases provided by PHP or security-patched packages supplied by the applicable Linux distribution or support vendor.

For containerized applications:

1. Identify the affected PHP packages and base images.
2. Update the PHP packages or rebuild application images using fixed base images.
3. Test the updated applications for compatibility.
4. Redeploy the updated images.
5. Verify that the running workloads use the corrected PHP packages or versions.

Prioritize internet-facing and business-critical applications.

Customers unable to patch immediately should review the temporary exposure-reduction measures described in PHP's official advisory. These measures do not provide complete protection and should not replace updating affected installations.

5. Run a Full Scan and verify remediation

Once PHP2Shell vulnerability detection is available for your Aqua deployment, perform a Full Scan of your container images to ensure all affected PHP components are identified.

Important: A Full Scan is required to detect affected PHP-FPM binaries. A standard Rescan can detect other affected PHP packages and binaries but may not identify PHP-FPM vulnerabilities.

We recommend performing a Full Scan to ensure comprehensive detection coverage.

Review:

• Registry images containing affected PHP components.
• Images associated with currently running workloads.
• Vulnerability findings for CVE-2026-109618 and CVE-2026-109619.
• Remaining affected images and their deployment status.

Use Aqua's workload and vulnerability context to prioritize remediation, particularly for internet-facing applications.

After applying the necessary security updates and redeploying affected workloads, perform another Full Scan to verify remediation.

Detection coverage and scan results may depend on package identification, vulnerability database updates, and distribution-specific security backports.

How does Aqua runtime protection help?

Aqua runtime protection provides behavioral security controls for running workloads. Unlike vulnerability scanning, which identifies known vulnerable components, runtime controls can restrict certain unauthorized actions without requiring a signature for the specific vulnerability.

For example, an attacker exploiting a PHP application may attempt to start a shell, execute a downloaded binary, modify application files, or establish an unauthorized outbound connection.

When appropriate Aqua runtime policies are enabled and enforced, these activities may be detected or blocked.

However, not every exploitation technique requires a separate shell, newly introduced executable, or network connection. Runtime policies should therefore be treated as complementary controls rather than complete protection against PHP2Shell.

The recommended approach is to combine vulnerability scanning, runtime enforcement, and timely patching to reduce exposure and improve workload security.

When can I scan for PHP2Shell vulnerabilities?

Aqua Security provides vulnerability detection for CVE-2026-109618 and CVE-2026-109619 across supported PHP workloads, including container images using standard Linux distribution packages and official PHP images.

Detection availability:

Customers can use Aqua's vulnerability scanning capabilities to identify affected PHP versions and prioritize remediation based on which vulnerable images are currently running in their environments.

Scan requirements

To ensure all affected PHP components are identified, we recommend performing a Full Scan of your container images once detection is available for your deployment.

• Full Scan: Required to detect affected PHP-FPM binaries and recommended for comprehensive PHP2Shell detection.
• Rescan: Supports detection of other affected PHP packages and binaries. However, a Rescan alone is not sufficient for PHP-FPM detection

Recommended actions:

1. Perform a Full Scan of your container images to identify PHP2Shell vulnerabilities.
2. Review vulnerability findings and prioritize affected workloads, particularly internet-facing applications.
3. Update affected PHP installations to the fixed versions and redeploy the updated images.
4. Perform another Full Scan to verify remediation.

For customers using Offline CyberCenter, ensure the applicable vulnerability database updates have been applied before scanning.

For additional assistance with vulnerability detection or remediation, contact Aqua Support or your Aqua account team.

Additional Resources

PHP official security announcements

PHP supported versions

Aqua Security blog