PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

Bulletin ID: 2026-143-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 14:30 PM PDT Last Updated Date: 10/23/2026 13:30 PM PDT

Summary:

Two critical issues have been identified in PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) that can allow an unauthenticated actor to run code on affected systems. A remote caller can send crafted web requests to affected PHP workers and execute arbitrary code, read process-accessible data, or cause denial of service.

AWS services are not impacted by these issues. Customers using the affected versions of PHP within the services listed below could be impacted and should review the guidance provided.

Affected versions:

• PHP 8.5: Affected versions 8.5.0–8.5.11 · First fixed version: 8.5.12
• PHP 8.4: Affected versions 8.4.0–8.4.26 · First fixed version: 8.4.27
• PHP 8.3: Affected versions 8.3.0–8.3.35 · First fixed version: 8.3.36
• PHP 8.2: Affected versions 8.2.0–8.2.34 · First fixed version: 8.2.35
• PHP 5.4–8.1: No upstream fix released. End-of-life and have no planned fix. Migration to a supported branch is required.

Impact:

This issue is accessible remotely by an actor without authentication over the internet-to-customer-application boundary, which can result in code execution, unintended access to process-accessible data, or denial of service on the targeted PHP worker. The issue is bounded to the affected worker and its application-level permissions; no cross-customer propagation has been established to date.

Current Mitigation Status:

• Amazon EMR: Amazon EMR on EC2 clusters launched with Ganglia included in the application set are affected, specifically EMR releases 4.2.0–5.29.0 and 5.30.0–6.15.0. Amazon EMR on EKS and Amazon EMR Serverless are not affected, on any release. On Amazon EMR on EC2, clusters running release 7.0.0 or later, and clusters launched without Ganglia installed, are also not affected. For affected releases, customers launching new clusters should omit Ganglia when it is not required. Where possible, customers should upgrade to EMR 7.x, which no longer includes Ganglia, and use the Amazon CloudWatch Agent for telemetry and monitoring.
• Amazon WorkMail: AWS has applied configuration-level controls and has completed the upgrade to PHP 8.3.36. No customer action is required.
• AWS Elastic Beanstalk: AWS has released updated PHP platform versions for all supported PHP versions (8.2 through 8.5) containing the upstream PHP fix. Customers with Managed Platform Updates enabled will receive the update automatically during their next maintenance window. Customers who have not enabled Managed Platform Updates should update their environment's platform version by following the documentation: PHP 8.5/8.4 and PHP 8.3/8.2.
• AWS Lambda: AWS Lambda does not provide a managed PHP runtime. Customers who have deployed PHP as a custom runtime or container image are responsible for updating the PHP version used in their functions. We recommend upgrading to a patched PHP release as soon as possible and redeploying your functions. For guidance on building and maintaining custom runtimes, see the AWS Lambda documentation. If you use the third-party Bref project to run PHP on Lambda, Bref has published a security release containing updated layers and Docker images with the patched PHP versions. Please follow the Bref security release for update instructions.
• Amazon Linux: Updated PHP packages are available for all regions. Customers running PHP on Amazon Linux should apply the updated packages as soon as they are available. Please follow CVE-2026-109618 and CVE-2026-109619 in the Amazon Linux Security Center for details.
• Amazon Lightsail: Updated Lightsail blueprints are now available in all regions. AWS cannot update running Lightsail instances in place. Customers running PHP workloads on Lightsail should create new instances from the updated blueprints and migrate their applications following the documentation.

Mitigation Guidance:

• Upgrading immediately to a patched PHP release is the only complete fix: 8.5.12, 8.4.27, 8.3.36, or 8.2.35. The configuration changes below may reduce impact for customers who cannot update immediately, but none is a complete mitigation.
• Refer to Security advisory: Critical remote code execution vulnerabilities, update now for additional mitigations.
• End-of-life runtimes 5.4–8.1: Apply interim configuration controls for CVE-2026-109619 where effective, restart PHP workers, and begin migration to a supported, fixed PHP branch immediately. No fix is available for CVE-2026-109618 on end-of-life branches.
• Compensating controls if using AWS WAF: Patching is the only complete fix, and customers should upgrade PHP as their first priority. As patching a fleet takes time, we recommend reviewing this blog post, which shows how to use AWS Web Application Firewall (AWS WAF) to help reduce exposure during that window. Please note, this blog will be updated with AWS WAF guidance changes as this situation evolves. We are continuously updating the AWS WAF PHP Managed Rule Group to add protection for both CVE-2026-109618 and CVE-2026-109619. Customers using the default version will be automatically protected without any action on their part. Customers who have pinned a specific version should update to the latest version to receive this protection. For the latest version and details on the rules added, please refer to the AWS WAF Managed Rules changelog and subscribe to the AWS Managed Rules SNS topic.

References:

• CVE-2026-109618
• CVE-2026-109619
• GHSA-w8hw-w9fx-j79w
• GHSA-6wmf-4rv5-p3rp
• https://www.php.net/archive/2026.php#2026-10-21-5

Please email [email protected] with any security questions or concerns.