Bulletin ID: 2026-143-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/21/2026 14:30 PM PDT
Summary:
Two critical issues have been identified in PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) that can allow an unauthenticated actor to run code on affected systems. A remote caller can send crafted web requests to affected PHP workers and execute arbitrary code, read process-accessible data, or cause denial of service.
AWS services are not impacted by these issues. Customers using the affected versions of PHP within the services listed below could be impacted and should review the guidance provided.
Affected versions:
- PHP 8.5: Affected versions 8.5.0–8.5.11 · First fixed version: 8.5.12
- PHP 8.4: Affected versions 8.4.0–8.4.26 · First fixed version: 8.4.27
- PHP 8.3: Affected versions 8.3.0–8.3.35 · First fixed version: 8.3.36
- PHP 8.2: Affected versions 8.2.0–8.2.34 · First fixed version: 8.2.35
- PHP 5.4–8.1: No upstream fix released. End-of-life and have no planned fix. Migration to a supported branch is required.
Impact:
This issue is accessible remotely by an actor without authentication over the internet-to-customer-application boundary, which can result in code execution, unintended access to process-accessible data, or denial of service on the targeted PHP worker. The issue is bounded to the affected worker and its application-level permissions; no cross-customer propagation has been established to date.
Current Mitigation Status:
- Amazon WorkMail: AWS has applied configuration-level controls that limit the conditions under which these issues can be reached. The upgrade to PHP 8.3.36 is targeted for 2026-10-22. No customer action is required.
- AWS Elastic Beanstalk: AWS released updated PHP platform versions (v4.13.12) on 2026-10-21 that address both CVEs. A follow-on platform release containing the upstream PHP fix is targeted for 2026-10-22. Customers with Managed Platform Updates enabled will receive the update automatically during their next maintenance window. Customers who have not enabled Managed Platform Updates should update their environment's platform version by following the documentation.
- Amazon Linux: Updated PHP packages are targeted for 2026-10-22. Customers running PHP on Amazon Linux should apply the updated packages as soon as they are available. Please follow CVE-2026-109618 and CVE-2026-109619 in the Amazon Linux Security Center for details.
- Amazon Lightsail: Updated Lightsail blueprints are expected on 2026-10-21. AWS cannot update running Lightsail instances in place. Customers running PHP workloads on Lightsail should create new instances from the updated blueprints and migrate their applications following the documentation.
Mitigation Guidance:
- Upgrading immediately to a patched PHP release is the only complete fix: 8.5.12, 8.4.27, 8.3.36, or 8.2.35. The configuration changes below may reduce impact for customers who cannot update immediately, but none is a complete mitigation.
- Refer to Security advisory: Critical remote code execution vulnerabilities, update now for additional mitigations.
- End-of-life runtimes 5.4–8.1: Apply interim configuration controls for CVE-2026-109619 where effective, restart PHP workers, and begin migration to a supported, fixed PHP branch immediately. No fix is available for CVE-2026-109618 on end-of-life branches.
- Compensating controls if using AWS WAF:
- For CVE-2026-109618 Use the SizeRestrictions_BODY rule in the AWS WAF Core rule set (CRS) managed rule group that blocks request bodies that are over 8 KB (8,192 bytes).
- For CVE-2026-109619 Add the following custom rule to your WebACL to protect your application against the leverage attempts until your application is patched. The rule matches on POST requests that contain the PHP_SESSION_UPLOAD_PROGRESS in the body, and PHPSESSID in either the body or cookie. We will be updating the AWS WAF PHP Managed Rule Group shortly.
Custom rule for CVE-2026-109619
{
"Name": "PHP2Shell",
"Priority": 0,
"Statement": {
"AndStatement": {
"Statements": [
{
"ByteMatchStatement": {
"SearchString": "POST",
"FieldToMatch": {
"Method": {}
},
"TextTransformations": [
{
"Priority": 0,
"Type": "NONE"
}
],
"PositionalConstraint": "EXACTLY"
}
},
{
"OrStatement": {
"Statements": [
{
"ByteMatchStatement": {
"SearchString": "PHPSESSID",
"FieldToMatch": {
"Cookies": {
"MatchPattern": {
"All": {}
},
"MatchScope": "KEY",
"OversizeHandling": "CONTINUE"
}
},
"TextTransformations": [
{
"Priority": 0,
"Type": "NONE"
}
],
"PositionalConstraint": "EXACTLY"
}
},
{
"ByteMatchStatement": {
"SearchString": "PHPSESSID",
"FieldToMatch": {
"Body": {
"OversizeHandling": "CONTINUE"
}
},
"TextTransformations": [
{
"Priority": 0,
"Type": "NONE"
}
],
"PositionalConstraint": "CONTAINS"
}
}
]
}
},
{
"ByteMatchStatement": {
"SearchString": "PHP_SESSION_UPLOAD_PROGRESS",
"FieldToMatch": {
"Body": {
"OversizeHandling": "CONTINUE"
}
},
"TextTransformations": [
{
"Priority": 0,
"Type": "NONE"
}
],
"PositionalConstraint": "CONTAINS"
}
}
]
}
},
"Action": {
"Block": {}
},
"VisibilityConfig": {
"SampledRequestsEnabled": true,
"CloudWatchMetricsEnabled": true,
"MetricName": "PHP2Shell"
}
}
References:
- CVE-2026-109618
- CVE-2026-109619
- GHSA-w8hw-w9fx-j79w
- GHSA-6wmf-4rv5-p3rp
- https://www.php.net/archive/2026.php#2026-10-21-5
Please email aws-security@amazon.com with any security questions or concerns.