AWS has issued a security bulletin warning of two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP web runtimes that allow unauthenticated remote attackers to execute arbitrary code, read sensitive data, or cause denial of service.
According to the bulletin, the vulnerabilities affect PHP versions 8.2.0–8.2.34, 8.3.0–8.3.35, 8.4.0–8.4.26, and 8.5.0–8.5.11. Versions 5.4 through 8.1 are end-of-life with no upstream fixes available. A remote caller can send crafted web requests to affected PHP workers to exploit these issues. The impact is bounded to the targeted worker and its application-level permissions, with no cross-customer propagation documented to date.
AWS services themselves are not impacted, but customers running affected PHP versions within certain AWS services require immediate action. Amazon WorkMail has configuration-level controls in place, with an upgrade to PHP 8.3.36 targeted for October 22, 2026. No customer action is required for WorkMail. AWS Elastic Beanstalk released updated platform versions (v4.13.12) on October 21, 2026, with customers who have Managed Platform Updates enabled receiving patches automatically during maintenance windows. Amazon Linux will receive updated PHP packages on October 22, and Amazon Lightsail expects updated blueprints on October 21, though existing instances cannot be patched in place and must be recreated.
The primary mitigation is immediate upgrade to patched versions: 8.5.12, 8.4.27, 8.3.36, or 8.2.35. For end-of-life versions, AWS recommends configuration controls for CVE-2026-109619, worker restarts, and migration to supported branches. AWS WAF users can deploy compensating controls, including the SizeRestrictions_BODY rule for CVE-2026-109618 and a custom rule matching POST requests containing PHP_SESSION_UPLOAD_PROGRESS and PHPSESSID variables for CVE-2026-109619. AWS plans to update the AWS WAF PHP Managed Rule Group shortly with additional protections.
Key facts
- Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution on affected PHP workers
- Affected versions: PHP 8.2.0–8.2.34, 8.3.0–8.3.35, 8.4.0–8.4.26, 8.5.0–8.5.11; versions 5.4–8.1 are end-of-life with no fix
- AWS services are not impacted; customers running vulnerable PHP versions within AWS services must upgrade immediately
- Fixed versions available: 8.5.12, 8.4.27, 8.3.36, 8.2.35
- AWS WAF compensating controls available while awaiting patches