SHIFTWIRE
Log inGet Early Access
BACK TO THE WIRE
SW-000351AMAZON WEB SERVICES · AWS · PHP WEB RUNTIMESCRITICALACTION REQUIRED

AWS bulletin: critical PHP RCE CVEs 2026-109618/109619 affect hosted PHP runtimes

AWS issued a security bulletin for two critical, unauthenticated remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PHP web runtimes used within several AWS services, including Amazon WorkMail, Elastic Beanstalk, Amazon Linux, and Lightsail. AWS states its own services are not impacted, but customers running affected PHP versions within these services must apply patches or mitigations.

SECURITY · CLOUD · VULNERABILITY · SECURITY ADVISORY

PUBLISHED OCT 23, 2026 19:47 UTC

WHAT CHANGED

The bulletin identifies two critical PHP vulnerabilities allowing an unauthenticated remote caller to execute arbitrary code, read process memory, or cause denial of service via crafted web requests to PHP workers. Affected versions span PHP 8.2 through 8.5 (with fixed releases 8.2.35, 8.3.36, 8.4.27, and 8.5.12) and PHP 5.4–8.1, which are end-of-life with no planned fix. AWS has begun service-specific mitigations: Amazon WorkMail applied configuration-level controls and plans a PHP 8.3.36 upgrade targeted for 2026-10-22; AWS Elastic Beanstalk released updated PHP platform v4.13.12 on 2026-10-21 addressing both CVEs, with a further upstream-fix release targeted for 2026-10-22; Amazon Linux has updated packages available for commercial regions, with non-commercial regions targeted for 2026-10-22; and Amazon Lightsail blueprints were expected to update on 2026-10-21, requiring customers to migrate to new instances since existing ones cannot be patched in place. AWS also published WAF Managed Rule Group v2.3 (promoted to default) adding protection for CVE-2026-109619, and provided a custom WAF rule example and CRS SizeRestrictions_BODY guidance for CVE-2026-109618.

WHY IT MATTERS

These are critical, internet-reachable, unauthenticated RCE vulnerabilities in widely used PHP runtimes underlying several AWS-hosted services. Administrators running PHP workloads on affected AWS services must verify whether automatic platform updates apply to their environment, manually upgrade where they do not, or migrate Lightsail instances, since AWS cannot patch running instances in place. End-of-life PHP branches (5.4–8.1) have no vendor fix, requiring urgent migration to a supported branch, and WAF-based mitigations are only partial stopgaps until patching is complete.

WHO IS AFFECTED

ROLES
Administrators managing PHP workloads on AWSSecurity teams responsible for WAF configuration
PRODUCTS
PHP 8.5 (8.5.0–8.5.11)PHP 8.4 (8.4.0–8.4.26)PHP 8.3 (8.3.0–8.3.35)PHP 8.2 (8.2.0–8.2.34)PHP 5.4–8.1 (end-of-life)Amazon WorkMailAWS Elastic BeanstalkAmazon LinuxAmazon LightsailAWS WAF
FEATURES
PHP web runtimeAWS WAF Core Rule Set (CRS)AWS WAF PHP Managed Rule Group
CONFIGURATIONS
Elastic Beanstalk Managed Platform UpdatesAmazon Linux PHP packagesLightsail PHP blueprintsAWS WAF custom WebACL rules
REGIONS
AWS commercial regionsAWS non-commercial regions
ENVIRONMENTS
Customer-managed PHP deployments on AWS services
EXCLUSIONS
AWS services themselves are stated as not impacted by these issues

WHAT TO DO

  1. 01
    CRITICAL

    Upgrade PHP to a patched release (8.5.12, 8.4.27, 8.3.36, or 8.2.35) immediately as the only complete fix for CVE-2026-109618 and CVE-2026-109619.

  2. 02
    CRITICAL

    For end-of-life PHP versions 5.4–8.1, apply available interim configuration controls for CVE-2026-109619, restart PHP workers, and begin immediate migration to a supported, patched PHP branch; note no fix exists for CVE-2026-109618 on these branches.

  3. 03
    HIGHAUTOMATABLE

    Add the SizeRestrictions_BODY rule from the AWS WAF Core Rule Set (CRS) managed rule group to block request bodies over 8 KB as a compensating control for CVE-2026-109618.

  4. 04
    HIGHAUTOMATABLE

    Add the published custom WAF rule (PHP2Shell) or upgrade to AWS WAF PHP Managed Rule Group version 2.3 (now default) to block POST requests containing PHP_SESSION_UPLOAD_PROGRESS and PHPSESSID as a compensating control for CVE-2026-109619.

  5. 05
    HIGHAUTOMATABLE

    If Elastic Beanstalk Managed Platform Updates are not enabled, manually update the environment's platform version to v4.13.12 (or the follow-on release) to apply the PHP fixes.

  6. 06
    MEDIUMAUTOMATABLE

    Apply updated PHP packages on Amazon Linux as soon as they are available, and monitor the Amazon Linux Security Center entries for CVE-2026-109618 and CVE-2026-109619 for non-commercial region updates.

  7. 07
    MEDIUM

    For PHP workloads running on Amazon Lightsail, create new instances from the updated blueprints and migrate applications, since existing instances cannot be patched in place.

TIMELINE

ANNOUNCED
OCT 21, 2026

SOURCES

  • PRIMARY SOURCEAMAZON WEB SERVICES

    PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

    PUBLISHED OCT 21, 2026VIEW SOURCE

VERIFICATION

HUMAN VERIFIEDLAST VERIFIED OCT 23, 2026 19:47 UTCREVISION 2

ShiftWire summarizes and analyzes changes from the cited sources. Always review the primary source before implementing material changes.

WAS THIS USEFUL?