{"id":"GHSA-6wmf-4rv5-p3rp","kind":"vulnerability","aliases":["GHSA-6wmf-4rv5-p3rp"],"related":[],"title":"PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)","description":"PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)\n\n### PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)\n\n| This is an ongoing issue. Information is subject to change. Please refer to this bulletin for the most updated patching information. |\n| --- |\n\nBulletin ID: 2026-143-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 14:30 PM PDT Last Updated Date: 10/23/2026 13:30 PM PDT\n\nSummary:\n\nTwo critical issues have been identified in PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) that can allow an unauthenticated actor to run code on affected systems. A remote caller can send crafted web requests to affected PHP workers and execute arbitrary code, read process-accessible data, or cause denial of service.\n\nAWS services are not impacted by these issues. Customers using the affected versions of PHP within the services listed below could be impacted and should review the guidance provided.\n\nAffected versions:\n\n- PHP 8.5: Affected versions 8.5.0–8.5.11 · First fixed version: 8.5.12\n- PHP 8.4: Affected versions 8.4.0–8.4.26 · First fixed version: 8.4.27\n- PHP 8.3: Affected versions 8.3.0–8.3.35 · First fixed version: 8.3.36\n- PHP 8.2: Affected versions 8.2.0–8.2.34 · First fixed version: 8.2.35\n- PHP 5.4–8.1: No upstream fix released. End-of-life and have no planned fix. Migration to a supported branch is required.\n\nImpact:\n\nThis issue is accessible remotely by an actor without authentication over the internet-to-customer-application boundary, which can result in code execution, unintended access to process-accessible data, or denial of service on the targeted PHP worker. The issue is bounded to the affected worker and its application-level permissions; no cross-customer propagation has been established to date.\n\nCurrent Mitigation Status:\n\n- Amazon EMR: Amazon EMR on EC2 clusters launched with Ganglia included in the application set are affected, specifically EMR releases 4.2.0–5.29.0 and 5.30.0–6.15.0. Amazon EMR on EKS and Amazon EMR Serverless are not affected, on any release. On Amazon EMR on EC2, clusters running release 7.0.0 or later, and clusters launched without Ganglia installed, are also not affected. For affected releases, customers launching new clusters should omit Ganglia when it is not required. Where possible, customers should upgrade to EMR 7.x, which no longer includes Ganglia, and use the Amazon CloudWatch Agent for telemetry and monitoring. \n- Amazon WorkMail: AWS has applied configuration-level controls and has completed the upgrade to PHP 8.3.36. No customer action is required. \n- AWS Elastic Beanstalk: AWS has released updated PHP platform versions for all supported PHP versions (8.2 through 8.5) containing the upstream PHP fix. Customers with Managed Platform Updates enabled will receive the update automatically during their next maintenance window. Customers who have not enabled Managed Platform Updates should update their environment's platform version by following the documentation: PHP 8.5/8.4 and PHP 8.3/8.2. \n- AWS Lambda: AWS Lambda does not provide a managed PHP runtime. Customers who have deployed PHP as a custom runtime or container image are responsible for updating the PHP version used in their functions. We recommend upgrading to a patched PHP release as soon as possible and redeploying your functions. For guidance on building and maintaining custom runtimes, see the AWS Lambda documentation. If you use the third-party Bref project to run PHP on Lambda, Bref has published a security release containing updated layers and Docker images with the patched PHP versions. Please follow the Bref security release for update instructions. \n- Amazon Linux: Updated PHP packages are available for all regions. Customers running PHP on Amazon Linux should apply the updated packages as soon as they are available. Please follow CVE-2026-109618 and CVE-2026-109619 in the Amazon Linux Security Center for details. \n- Amazon Lightsail: Updated Lightsail blueprints are now available in all regions. AWS cannot update running Lightsail instances in place. Customers running PHP workloads on Lightsail should create new instances from the updated blueprints and migrate their applications following the documentation.\n\nMitigation Guidance:\n\n- Upgrading immediately to a patched PHP release is the only complete fix: 8.5.12, 8.4.27, 8.3.36, or 8.2.35. The configuration changes below may reduce impact for customers who cannot update immediately, but none is a complete mitigation. \n- Refer to Security advisory: Critical remote code execution vulnerabilities, update now for additional mitigations. \n- End-of-life runtimes 5.4–8.1: Apply interim configuration controls for CVE-2026-109619 where effective, restart PHP workers, and begin migration to a supported, fixed PHP branch immediately. No fix is available for CVE-2026-109618 on end-of-life branches. \n- Compensating controls if using AWS WAF: Patching is the only complete fix, and customers should upgrade PHP as their first priority. As patching a fleet takes time, we recommend reviewing this blog post, which shows how to use AWS Web Application Firewall (AWS WAF) to help reduce exposure during that window. Please note, this blog will be updated with AWS WAF guidance changes as this situation evolves. We are continuously updating the AWS WAF PHP Managed Rule Group to add protection for both CVE-2026-109618 and CVE-2026-109619. Customers using the default version will be automatically protected without any action on their part. Customers who have pinned a specific version should update to the latest version to receive this protection. For the latest version and details on the rules added, please refer to the AWS WAF Managed Rules changelog and subscribe to the AWS Managed Rules SNS topic.\n\nReferences:\n\n- CVE-2026-109618\n- CVE-2026-109619\n- GHSA-w8hw-w9fx-j79w\n- GHSA-6wmf-4rv5-p3rp\n- https://www.php.net/archive/2026.php#2026-10-21-5\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"Two flaws in PHP web runtimes let a remote caller send crafted web requests to a PHP worker and run arbitrary code, read process-accessible data, or cause denial of service. AWS calls both critical and says no authentication is needed.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amazon-linux","aws","elastic-beanstalk","emr","lab-disclosure","lambda","lightsail","php","php-fpm","runtime"],"not_affected_if":["emr-7-or-later","emr-on-eks-or-serverless","managed-hosting-patched","no-php-in-use"],"how_to_check":"- Run `php -v` on each host or image and compare with the fixed versions: `8.5.12`, `8.4.27`, `8.3.36`, `8.2.35`.\n- Note any PHP 5.4 to 8.1 runtime, which has no upstream fix.\n- On Amazon EMR on EC2, check whether clusters launched with Ganglia in releases `4.2.0` to `6.15.0`.","fix":"- Upgrade PHP to `8.5.12`, `8.4.27`, `8.3.36` or `8.2.35`, then restart PHP workers.\n- Move PHP 5.4 to 8.1 to a supported, fixed branch; no upstream fix exists for those.\n- Omit Ganglia on new EMR clusters or move to EMR 7.x.\n- If patching is delayed, use AWS WAF with the current PHP Managed Rule Group; this reduces exposure but is not a complete fix.","status":"open","published_at":null,"first_seen_at":"2026-10-24T19:12:58+00:00","triaged_at":"2026-10-25T04:51:32+00:00","updated_at":"2026-10-25T04:51:32+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T04:51:32Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade PHP to `8.5.12`, `8.4.27`, `8.3.36` or `8.2.35`, then restart PHP workers.\n- Move PHP 5.4 to 8.1 to a supported, fixed branch; no upstream fix exists for those.\n- Omit Ganglia on new EMR clusters or move to EMR 7.x.\n- If patching is delayed, use AWS WAF with the current PHP Managed Rule Group; this reduces exposure but is not a complete fix.","reach":"internet","title":"PHP: stale global state lets unauthenticated web requests run code","impact":"high","summary":"Two flaws in PHP web runtimes let a remote caller send crafted web requests to a PHP worker and run arbitrary code, read process-accessible data, or cause denial of service. AWS calls both critical and says no authentication is needed.","category":"runtime","nicknames":[],"who_cares":["php","php-fpm","aws","lambda","elastic-beanstalk","emr","amazon-linux","lightsail"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote attacker runs code in the PHP worker and reads process data","analyst_note":"Check the CVE entries and php.net advisory 2026-10-21-5 for exact affected configurations and whether the flaws need specific PHP settings; read the GHSA-6wmf-4rv5-p3rp advisory for the stale global state details.","how_to_check":"- Run `php -v` on each host or image and compare with the fixed versions: `8.5.12`, `8.4.27`, `8.3.36`, `8.2.35`.\n- Note any PHP 5.4 to 8.1 runtime, which has no upstream fix.\n- On Amazon EMR on EC2, check whether clusters launched with Ganglia in releases `4.2.0` to `6.15.0`.","needs_analyst":true,"not_affected_if":["no-php-in-use","managed-hosting-patched","emr-7-or-later","emr-on-eks-or-serverless"],"who_is_affected":"Any application that runs PHP web workers reachable from the internet is exposed, including PHP-FPM, custom Lambda runtimes and container images. AWS managed services such as WorkMail and Elastic Beanstalk are patched by AWS or updated through platform versions, while EMR on EKS, EMR Serverless and Lightsail instances need action from the customer. Teams that run no PHP, or only PHP at version 7.0 or later on EMR, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.001003,"input_tokens":5524,"output_tokens":901,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-109618':6A,86C,96C,162C,687C '-109619':10A,90C,100C,166C,691C '-143':125C '-2026':5A,9A,85C,89C,95C,99C,161C,165C,686C,690C '/8.2':552C '/8.4':548C '10/21/2026':136C '10/23/2026':144C '13':145C '14':137C '2026':124C '30':138C,146C '4.2.0':387C '4rv5':14A,19A '5.29.0':388C '5.30.0':390C '5.4':277C '6.15.0':391C '6wmf':13A,18A '7':449C '7.0.0':414C '8.1':278C '8.2':267C,503C '8.2.0':270C '8.2.34':271C '8.2.35':275C '8.3':257C,551C '8.3.0':260C '8.3.35':261C '8.3.36':265C,482C '8.4':247C '8.4.0':250C '8.4.26':251C '8.4.27':255C '8.5':237C,505C,547C '8.5.0':240C '8.5.11':241C '8.5.12':245C 'access':64B,198C,303C,325C,329C 'action':485C 'actor':172C,307C 'affect':177C,188C,216C,234C,238C,248C,258C,268C,346C,383C,402C,426C,428C 'agent':461C 'allow':169C 'also':424C 'amazon':22B,367C,369C,392C,397C,407C,459C,466C,656C,670C,694C,700C 'amazon-linux':21B 'appli':470C,673C 'applic':316C,351C,380C 'application-level':350C 'arbitrari':59B,193C 'attent':133C 'authent':78B,309C 'automat':521C 'avail':662C,682C 'aw':24B,71B,126C,128C,205C,468C,488C,491C,553C,555C,613C 'beanstalk':27B,490C 'blueprint':704C 'bound':343C 'boundari':317C 'branch':296C 'bref':623C,630C,650C 'build':606C 'bulletin':115C,122C 'call':72B 'caller':48B,181C 'caus':67B,201C 'center':697C 'chang':110C 'cloudwatch':460C 'cluster':373C,411C,418C,433C 'code':60B,175C,194C,322C 'complet':477C 'configur':472C 'configuration-level':471C 'contain':506C,574C,636C 'content':129C 'control':474C 'could':225C 'craft':50B,184C 'critic':74B,151C 'cross':356C 'cross-custom':355C 'current':364C 'custom':213C,315C,357C,430C,444C,484C,511C,527C,564C,571C,609C,666C 'cve':4A,8A,84C,88C,94C,98C,160C,164C,685C,689C 'data':65B,199C,330C 'date':135C,143C,363C 'denial':68B,202C,332C 'deploy':567C 'detail':699C 'disclosur':31B 'docker':640C 'document':545C,615C 'ec2':372C,410C 'ek':395C 'elast':26B,489C 'elastic-beanstalk':25B 'emr':28B,368C,370C,385C,393C,398C,408C,448C 'enabl':516C,531C 'end':284C 'end-of-lif':283C 'environ':538C 'establish':361C 'execut':192C,323C 'first':242C,252C,262C,272C 'fix':243C,253C,263C,273C,281C,291C,510C 'flaw':40B 'follow':543C,648C,684C 'fpm':37B 'function':586C,602C 'ganglia':376C,421C,436C,455C 'ghsa':12A,17A 'ghsa-6wmf-4rv5-p3rp':11A,16A 'guidanc':232C,604C 'id':123C 'identifi':155C 'imag':575C,641C 'impact':209C,227C,299C 'import':131C 'includ':377C,454C 'inform':106C,121C 'instal':422C 'instruct':655C 'internet':313C 'internet-to-customer-appl':312C 'issu':105C,152C,212C,301C,341C 'lab':30B 'lab-disclosur':29B 'lambda':32B,554C,556C,614C,629C 'last':141C 'later':416C 'launch':374C,419C,431C 'layer':638C 'let':45B 'level':352C,473C 'life':286C 'lightsail':33B,701C,703C 'linux':23B,657C,671C,695C 'list':223C 'longer':453C 'maintain':608C 'mainten':525C 'manag':513C,532C,561C 'migrat':292C 'mitig':365C 'monitor':465C 'need':80B 'new':432C 'next':524C 'omit':435C 'ongo':104C 'p3rp':15A,20A 'packag':660C,676C 'parti':622C 'patch':120C,592C,644C 'pdt':140C,148C 'permiss':353C 'php':1A,34B,36B,42B,55B,81C,91C,157C,189C,219C,236C,246C,256C,266C,276C,338C,481C,495C,501C,509C,546C,550C,562C,568C,581C,593C,627C,645C,659C,668C 'php-fpm':35B 'plan':290C 'platform':496C,514C,533C,540C 'pleas':111C,647C,683C 'pm':139C,147C 'possibl':443C,598C 'process':63B,197C,328C 'process-access':62B,196C,327C 'project':624C 'propag':358C 'provid':233C,559C 'public':134C 'publish':632C 'read':61B,195C 'receiv':518C 'recommend':588C 'redeploy':600C 'refer':112C 'region':665C 'releas':282C,386C,405C,413C,429C,493C,594C,635C,652C 'remot':47B,180C,304C 'request':52B,186C 'requir':132C,298C,441C,487C 'respons':577C 'result':320C 'review':230C 'run':58B,174C,412C,626C,667C 'runtim':3A,38B,44B,83C,93C,159C,563C,572C,610C 'say':76B 'scope':127C 'secur':634C,651C,696C 'see':611C 'send':49B,183C 'serverless':399C 'servic':70B,204C,206C,222C,334C 'set':381C 'soon':596C,678C 'specif':384C 'status':366C 'subject':108C 'summari':149C 'support':295C,500C 'system':178C 'target':337C 'telemetri':463C 'third':621C 'third-parti':620C 'two':39B,150C 'type':130C 'unauthent':171C 'unintend':324C 'updat':119C,142C,494C,515C,520C,534C,536C,579C,637C,654C,658C,675C,702C 'upgrad':446C,479C,589C 'upstream':280C,508C 'use':214C,457C,583C,618C 'version':217C,235C,239C,244C,249C,254C,259C,264C,269C,274C,497C,502C,541C,582C,646C 'web':2A,43B,51B,82C,92C,158C,185C 'window':526C 'within':220C 'without':308C,420C 'worker':56B,190C,339C,347C 'workmail':467C 'x':450C","nicknames":[],"mitigations":[],"who_affected":"Any application that runs PHP web workers reachable from the internet is exposed, including PHP-FPM, custom Lambda runtimes and container images. AWS managed services such as WorkMail and Elastic Beanstalk are patched by AWS or updated through platform versions, while EMR on EKS, EMR Serverless and Lightsail instances need action from the customer. Teams that run no PHP, or only PHP at version 7.0 or later on EMR, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T14:00:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/#GHSA-6wmf-4rv5-p3rp","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T19:12:58+00:00","fetched_at":"2026-10-24T19:12:58+00:00","note":"AWS: PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)"}],"documents":[{"id":673,"url":"https://news.ycombinator.com/item?id=50181125","title":"PHP RCE via stale global state","kind":"post","source":"hackernews","text":"PHP RCE via stale global state\nhttps://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp\n\n2 points, 0 comments on Hacker News","published_at":"2026-10-21T14:00:49+00:00","relation":"discussion","confidence":null,"note":null},{"id":1488,"url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp","title":"GHSA-6wmf-4rv5-p3rp: RCE via stale global state (php-src)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2934,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/","title":"AWS: PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)","kind":"advisory","source":"lab","text":"PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)\n\n### PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)\n\n| This is an ongoing issue. Information is subject to change. Please refer to this bulletin for the most updated patching information. |\n| --- |\n\nBulletin ID: 2026-143-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 14:30 PM PDT Last Updated Date: 10/23/2026 13:30 PM PDT\n\nSummary:\n\nTwo critical issues have been identified in PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) that can allow an unauthenticated actor to run code on affected systems. A remote caller can send crafted web requests to affected PHP workers and execute arbitrary code, read process-accessible data, or cause denial of service.\n\nAWS services are not impacted by these issues. Customers using the affected versions of PHP within the services listed below could be impacted and should review the guidance provided.\n\nAffected versions:\n\n- PHP 8.5: Affected versions 8.5.0–8.5.11 · First fixed version: 8.5.12\n- PHP 8.4: Affected versions 8.4.0–8.4.26 · First fixed version: 8.4.27\n- PHP 8.3: Affected versions 8.3.0–8.3.35 · First fixed version: 8.3.36\n- PHP 8.2: Affected versions 8.2.0–8.2.34 · First fixed version: 8.2.35\n- PHP 5.4–8.1: No upstream fix released. End-of-life and have no planned fix. Migration to a supported branch is required.\n\nImpact:\n\nThis issue is accessible remotely by an actor without authentication over the internet-to-customer-application boundary, which can result in code execution, unintended access to process-accessible data, or denial of service on the targeted PHP worker. The issue is bounded to the affected worker and its application-level permissions; no cross-customer propagation has been established to date.\n\nCurrent Mitigation Status:\n\n- Amazon EMR: Amazon EMR on EC2 clusters launched with Ganglia included in the application set are affected, specifically EMR releases 4.2.0–5.29.0 and 5.30.0–6.15.0. Amazon EMR on EKS and Amazon EMR Serverless are not affected, on any release. On Amazon EMR on EC2, clusters running release 7.0.0 or later, and clusters launched without Ganglia installed, are also not affected. For affected releases, customers launching new clusters should omit Ganglia when it is not required. Where possible, customers should upgrade to EMR 7.x, which no longer includes Ganglia, and use the Amazon CloudWatch Agent for telemetry and monitoring. \n- Amazon WorkMail: AWS has applied configuration-level controls and has completed the upgrade to PHP 8.3.36. No customer action is required. \n- AWS Elastic Beanstalk: AWS has released updated PHP platform versions for all supported PHP versions (8.2 through 8.5) containing the upstream PHP fix. Customers with Managed Platform Updates enabled will receive the update automatically during their next maintenance window. Customers who have not enabled Managed Platform Updates should update their environment's platform version by following the documentation: PHP 8.5/8.4 and PHP 8.3/8.2. \n- AWS Lambda: AWS Lambda does not provide a managed PHP runtime. Customers who have deployed PHP as a custom runtime or container image are responsible for updating the PHP version used in their functions. We recommend upgrading to a patched PHP release as soon as possible and redeploying your functions. For guidance on building and maintaining custom runtimes, see the AWS Lambda documentation. If you use the third-party Bref project to run PHP on Lambda, Bref has published a security release containing updated layers and Docker images with the patched PHP versions. Please follow the Bref security release for update instructions. \n- Amazon Linux: Updated PHP packages are available for all regions. Customers running PHP on Amazon Linux should apply the updated packages as soon as they are available. Please follow CVE-2026-109618 and CVE-2026-109619 in the Amazon Linux Security Center for details. \n- Amazon Lightsail: Updated Lightsail blueprints are now available in all regions. AWS cannot update running Lightsail instances in place. Customers running PHP workloads on Lightsail should create new instances from the updated blueprints and migrate their applications following the documentation.\n\nMitigation Guidance:\n\n- Upgrading immediately to a patched PHP release is the only complete fix: 8.5.12, 8.4.27, 8.3.36, or 8.2.35. The configuration changes below may reduce impact for customers who cannot update immediately, but none is a complete mitigation. \n- Refer to Security advisory: Critical remote code execution vulnerabilities, update now for additional mitigations. \n- End-of-life runtimes 5.4–8.1: Apply interim configuration controls for CVE-2026-109619 where effective, restart PHP workers, and begin migration to a supported, fixed PHP branch immediately. No fix is available for CVE-2026-109618 on end-of-life branches. \n- Compensating controls if using AWS WAF: Patching is the only complete fix, and customers should upgrade PHP as their first priority. As patching a fleet takes time, we recommend reviewing this blog post, which shows how to use AWS Web Application Firewall (AWS WAF) to help reduce exposure during that window. Please note, this blog will be updated with AWS WAF guidance changes as this situation evolves. We are continuously updating the AWS WAF PHP Managed Rule Group to add protection for both CVE-2026-109618 and CVE-2026-109619. Customers using the default version will be automatically protected without any action on their part. Customers who have pinned a specific version should update to the latest version to receive this protection. For the latest version and details on the rules added, please refer to the AWS WAF Managed Rules changelog and subscribe to the AWS Managed Rules SNS topic.\n\nReferences:\n\n- CVE-2026-109618\n- CVE-2026-109619\n- GHSA-w8hw-w9fx-j79w\n- GHSA-6wmf-4rv5-p3rp\n- https://www.php.net/archive/2026.php#2026-10-21-5\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}