PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

What it is

AWS bulletin 2026-143-AWS, published 21 October 2026, covers two critical PHP web runtime flaws, CVE-2026-109618 and CVE-2026-109619. An unauthenticated remote caller can send crafted web requests to a PHP worker and run code, read process-accessible data or cause denial of service. AWS says its own services are not impacted, but customer workloads running affected PHP are.

Preconditions / Affected

• Affected and first fixed: PHP 8.5.0 to 8.5.11 (8.5.12), 8.4.0 to 8.4.26 (8.4.27), 8.3.0 to 8.3.35 (8.3.36), 8.2.0 to 8.2.34 (8.2.35).
• PHP 5.4 to 8.1 is end of life with no planned fix.
• Impact is bounded to the affected worker and its application-level permissions. AWS says no cross-customer propagation has been established.

What to do

Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The bulletin calls this the only complete fix.

Service status:

• Amazon WorkMail: AWS applied configuration controls and targets PHP 8.3.36 on 22 October 2026. No customer action.
• Elastic Beanstalk: PHP platform v4.13.12 was released 21 October 2026 and addresses both CVEs. A release with the upstream fix is targeted for 22 October. Managed Platform Updates users get it in their next maintenance window. Others must update the environment's platform version.
• Amazon Linux: updated PHP packages are targeted for 22 October. Track both CVEs in the Amazon Linux Security Center.
• Lightsail: new blueprints were expected 21 October. Running instances cannot be updated in place, so create new instances from the blueprints and migrate the application.

End-of-life branches (5.4 to 8.1): apply interim configuration controls for CVE-2026-109619 where effective, restart PHP workers, and start migrating. CVE-2026-109618 has no fix on these branches.

AWS WAF compensating controls, one per CVE:

• CVE-2026-109618: enable the SizeRestrictions_BODY rule in the Core rule set (CRS) managed rule group, which blocks request bodies over 8 KB (8,192 bytes).
• CVE-2026-109619: add a custom WebACL rule named PHP2Shell at priority 0 with action Block, sampled requests and CloudWatch metrics enabled. It matches when all three hold: the method is exactly POST; PHPSESSID is an exact cookie key or is contained in the body; and the body contains PHP_SESSION_UPLOAD_PROGRESS. All matches use NONE as the text transformation and CONTINUE for oversize handling. The full JSON is in the bulletin.

Caveats

• The configuration changes and WAF rules reduce impact only. The bulletin says none is a complete mitigation.
• The 8 KB body limit will also block legitimate large requests such as uploads, so check it against your traffic. The bulletin does not discuss this.
• AWS says it will update the AWS WAF PHP Managed Rule Group "shortly", which would replace the custom rule.
• The bulletin does not describe the underlying mechanism of either CVE. It refers readers to a separate advisory, "Security advisory: Critical remote code execution vulnerabilities, update now", for further mitigations.