PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) Skip to main content Filter: All English Contact us AWS Marketplace Support My account re:Invent Discover AWS Products Solutions Pricing Resources Search Filter: All Sign in to console Create account Explore topics re:Invent 2026 The sessions are set and your seat is waiting. Register now Build & Deploy AI Agents 88% of agent pilots stall.
Learn what the rest do differently Get started Sign up free, connect your coding agent, and start building Data for agentic AI The 7 essential data capabilities to scale agentic AI Analyst Report AWS named a Leader in the 2026 Gartner Magic Quadrant for SCPS AI for Small Businesses Solutions designed for your business.
Delivered by AWS Partners News & announcements AWS blog About AWS AWS is the world's most comprehensive cloud, enabling organizations to accelerate innovation, reduce costs, and scale more efficiently Why AWS Getting Started Security Compliance Trust Center Sustainability Global Infrastructure Careers Featured Products Analytics Application Integration Artificial Intelligence Business Applications Compute Customer Experience Databases Developer Tools End User Computing Game Tech Management Tools Media Services Migration & Modernization Multicloud & Hybrid Networking & Content Delivery Operations Security & Identity Storage Supply Chain Browse all products Transformation Hubs Migrate to modernize → Modernize to unlock data → unlock data to run AI Migrate & Modernize Clear technical debt, modernize infrastructure, and move to the cloud Data & Analytics Future proof your data foundation for agentic AI Artificial Intelligence Get production-ready AI that automates, builds, creates, decides, and engages at scale Featured Products Get started with one of these featured services or browse all Browse all products Amazon Quick AI-powered assistant for work with research, business insights, automation, and no-code app building Transform Eliminate tech debt with agentic AI to modernize legacy systems and code Aurora Serverless relational database service for PostgreSQL, MySQL, and DSQL Amazon Bedrock The end-to-end platform for building generative AI applications and agents Amazon Connect Customer AI-native solution for delivering exceptional experiences across customer interactions EC2 Secure and resizable compute capacity for virtually any workload What’s new Explore new capabilities and the latest technologies Customer success stories Learn how customers around the world accelerate their cloud Featured By industry By organization type Solutions Library Solutions for any organization From startups to enterprises, find AWS solutions scaled to your needs.
Access tailored resources, pricing models, and support levels.
Analytics Solutions Discover curated Solutions that address varied analytics use cases AI Solutions Discover curated Solutions that address varied artificial intelligence use cases Migration & Modernization Solutions Discover curated Solutions that address varied migration and modernization use cases What's new Explore new capabilities and the latest technologies Customer success stories Learn how customers around the world accelerate their cloud Pricing overview & tools AWS Pricing Learn about pricing and plans in one place AWS Pricing Calculator Estimate the cost for your architecture solution AWS Free Tier Get free, hands-on experience with AWS products and services AWS Offers Explore different offer programs to gain hands-on experience AWS Savings Plans Flexible pricing model offering lower prices Single-product pricing Amazon S3 Amazon Bedrock Amazon RDS Amazon EC2 Amazon SageMaker Browse all product pricing Learn Documentation Get detailed technical guides and references for all AWS services and tools Training & Certification Build and validate your AWS cloud skills and technical expertise Cloud term glossary Learn more about key cloud computing concepts Whitepapers Expand your knowledge of the cloud with expert guides and diagrams Cloud fundamentals Step-by-step instructions for common AWS tasks Tutorials Get started with step-by-step instructions Connect & Support Builder Center Learn, build, and connect with builders in the AWS community Events and webinars Connect, collaborate, and learn from AWS experts in the cloud computing community Partner Network Collaborate with AWS partners to grow your business Marketplace Find, test, buy, and deploy third-party software Support Access proactive guidance, issue resolution, and helpful tools Professional services Accelerate business transformation with expert guidance and packaged solutions PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) Bulletin ID: 2026-143-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 14:30 PM PDT Summary: Two critical issues have been identified in PHP web runtimes ( CVE-2026-109618 and CVE-2026-109619 ) that can allow an unauthenticated actor to run code on affected systems.
A remote caller can send crafted web requests to affected PHP workers and execute arbitrary code, read process-accessible data, or cause denial of service. AWS services are not impacted by these issues. Customers using the affected versions of PHP within the services listed below could be impacted and should review the guidance provided.
Affected versions: PHP 8.5: Affected versions 8.5.0–8.5.11 · First fixed version: 8.5.12 PHP 8.4: Affected versions 8.4.0–8.4.26 · First fixed version: 8.4.27 PHP 8.3: Affected versions 8.3.0–8.3.35 · First fixed version: 8.3.36 PHP 8.2: Affected versions 8.2.0–8.2.34 · First fixed version: 8.2.35 PHP 5.4–8.1: No upstream fix released. End-of-life and have no planned fix. Migration to a supported branch is required.
Impact: This issue is accessible remotely by an actor without authentication over the internet-to-customer-application boundary, which can result in code execution, unintended access to process-accessible data, or denial of service on the targeted PHP worker. The issue is bounded to the affected worker and its application-level permissions; no cross-customer propagation has been established to date. Current Mitigation Status: Amazon WorkMail: AWS has applied configuration-level controls that limit the conditions under which these issues can be reached.
The upgrade to PHP 8.3.36 is targeted for 2026-10-22. No customer action is required. AWS Elastic Beanstalk: AWS released updated PHP platform versions (v4.13.12) on 2026-10-21 that address both CVEs. A follow-on platform release containing the upstream PHP fix is targeted for 2026-10-22.
Customers with Managed Platform Updates enabled will receive the update automatically during their next maintenance window. Customers who have not enabled Managed Platform Updates should update their environment's platform version by following the documentation . Amazon Linux: Updated PHP packages are targeted for 2026-10-22. Customers running PHP on Amazon Linux should apply the updated packages as soon as they are available.
Please follow CVE-2026-109618 and CVE-2026-109619 in the Amazon Linux Security Center for details. Amazon Lightsail: Updated Lightsail blueprints are expected on 2026-10-21. AWS cannot update running Lightsail instances in place. Customers running PHP workloads on Lightsail should create new instances from the updated blueprints and migrate their applications following the documentation .
Mitigation Guidance: Upgrading immediately to a patched PHP release is the only complete fix: 8.5.12, 8.4.27, 8.3.36, or 8.2.35. The configuration changes below may reduce impact for customers who cannot update immediately, but none is a complete mitigation. Refer to Security advisory: Critical remote code execution vulnerabilities, update now for additional mitigations. End-of-life runtimes 5.4–8.1: Apply interim configuration controls for CVE-2026-109619 where effective, restart PHP workers, and begin migration to a supported, fixed PHP branch immediately.
No fix is available for CVE-2026-109618 on end-of-life branches. Compensating controls if using AWS WAF: - For CVE-2026-109618 Use the SizeRestrictions_BODY rule in the AWS WAF Core rule set (CRS) managed rule group that blocks request bodies that are over 8 KB (8,192 bytes). - For CVE-2026-109619 Add the following custom rule to your WebACL to protect your application against the leverage attempts until your application is patched. The rule matches on POST requests that contain the PHP_SESSION_UPLOAD_PROGRESS in the body, and PHPSESSID in either the body or cookie.
We will be updating the AWS WAF PHP Managed Rule Group shortly.
Custom rule for CVE-2026-109619 powershell Copy { "Name": "PHP2Shell", "Priority": 0, "Statement": { "AndStatement": { "Statements": [ { "ByteMatchStatement": { "SearchString": "POST", "FieldToMatch": { "Method": {} }, "TextTransformations": [ { "Priority": 0, "Type": "NONE" } ], "PositionalConstraint": "EXACTLY" } }, { "OrStatement": { "Statements": [ { "ByteMatchStatement": { "SearchString": "PHPSESSID", "FieldToMatch": { "Cookies": { "MatchPattern": { "All": {} }, "MatchScope": "KEY", "OversizeHandling": "CONTINUE" } }, "TextTransformations": [ { "Priority": 0, "Type": "NONE" } ], "PositionalConstraint": "EXACTLY" } }, { "ByteMatchStatement": { "SearchString": "PHPSESSID", "FieldToMatch": { "Body": { "OversizeHandling": "CONTINUE" } }, "TextTransformations": [ { "Priority": 0, "Type": "NONE" } ], "PositionalConstraint": "CONTAINS" } } ] } }, { "ByteMatchStatement": { "SearchString": "PHP_SESSION_UPLOAD_PROGRESS", "FieldToMatch": { "Body": { "OversizeHandling": "CONTINUE" } }, "TextTransformations": [ { "Priority": 0, "Type": "NONE" } ], "PositionalConstraint": "CONTAINS" } } ] } }, "Action": { "Block": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "PHP2Shell" } } References: CVE-2026-109618 CVE-2026-109619 GHSA-w8hw-w9fx-j79w GHSA-6wmf-4rv5-p3rp https://www.php.net/archive/2026.php#2026-10-21-5 Please email [email protected] with any security questions or concerns.
Create an AWS account Learn What Is AWS? What Is Cloud Computing? What Is Agentic AI?
Cloud Computing Concepts Hub AWS Cloud Security What's New Blogs Press Releases Careers Resources Getting Started Training AWS Trust Center AWS Solutions Library Architecture Center Product and Technical FAQs Analyst Reports AWS Partners Developers Builder Center SDKs & Tools .NET on AWS Python on AWS Java on AWS PHP on AWS JavaScript on AWS Help Contact Us File a Support Ticket AWS re:Post Knowledge Center AWS Support Overview AWS Accessibility Legal Event Code of Conduct Event Terms & Conditions English Back to top Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability or other legally protected status.
Veterans, military spouses, and people with disabilities are encouraged to apply. x facebook linkedin instagram twitch youtube podcasts email Privacy Site terms Your Privacy Choices California Consumer Privacy Act (CCPA) Opt-Out Icon Cookie Preferences © 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved.