Thorn Tech Marketing Ad
Skip to main content
Version: 1.3.1

PHP2Shell (CVE-2026-109618 / CVE-2026-109619): StorageLink is not affected

TLDR - Quick Summary

What: "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619) are two unauthenticated remote code execution flaws in the PHP runtime (PHP-FPM, mod_php, php-cgi), disclosed October 21, 2026 and fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Affected: None. StorageLink does not include PHP in any form, on any platform.

Action: Nothing to do on your StorageLink servers or containers. If you run PHP elsewhere in your environment, patch it there.

Overview​

PHP2Shell is a pair of vulnerabilities in the PHP language runtime itself. A request crafted to a server that executes PHP through PHP-FPM, Apache's mod_php, or php-cgi can run arbitrary code without authentication. Because the flaws are in mainstream press coverage, customers have asked whether StorageLink is exposed.

It is not. StorageLink is a Java application. Its web interface is a set of static files served by nginx. No PHP interpreter, PHP-FPM process, Apache module, or CGI handler is installed, so there is nothing for the exploit to reach.

(Last updated 2026-10-22)

  • The StorageLink service is a Java application running on the Amazon Corretto 21 / OpenJDK 21 runtime.
  • The web interface is pre-built static HTML, CSS and JavaScript served directly by nginx. nginx does not execute PHP unless it is configured to hand requests to a separate PHP-FPM process, and no such process or configuration exists on StorageLink images.
  • No marketplace VM image or container image ships a PHP package or binary.

What we checked​

We verified the claim above on October 22, 2026 against the current build sources and the published images, rather than relying on product knowledge alone:

  • Marketplace VM images. The Packer templates and image-setup scripts that build the AWS (Amazon Linux 2023), Azure, Google Cloud and Alibaba Cloud images install the Java runtime, nginx and operating-system tooling only. No php, php-fpm, php-cgi or libphp package is installed by any of them. The only occurrences of the string "php" in the build sources are commented-out example lines in nginx's stock configuration template, which are inactive.
  • Container images. The backend image is built from the Amazon Corretto 21 hardened Alpine base image and the UI image from the nginx hardened Alpine base image. We inspected the published images (thorntech/storagelink-backend:1.3.1 and thorntech/storagelink-ui:1.3.1) inside a running container: no PHP binary on the PATH, no files named php*, php-fpm*, php-cgi*, libphp* or mod_php* anywhere on the filesystem, no PHP package in the package database, and nginx built without any PHP-related module.

If your own security scanner flags PHP on a StorageLink host, it is reporting something installed outside the product. Check for software you or a third-party agent added after launch.

What to do​

No action is required for StorageLink. Apply the PHP vendor fixes to any other systems in your environment that run PHP, such as content-management or web-application servers.

References​