{"id":"GHSA-w8hw-w9fx-j79w","kind":"vulnerability","aliases":["GHSA-w8hw-w9fx-j79w"],"related":[],"title":"PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)","description":"PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)\n\n### PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)\n\n| This is an ongoing issue. Information is subject to change. Please refer to this bulletin for the most updated patching information. |\n| --- |\n\nBulletin ID: 2026-143-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 14:30 PM PDT Last Updated Date: 10/23/2026 13:30 PM PDT\n\nSummary:\n\nTwo critical issues have been identified in PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) that can allow an unauthenticated actor to run code on affected systems. A remote caller can send crafted web requests to affected PHP workers and execute arbitrary code, read process-accessible data, or cause denial of service.\n\nAWS services are not impacted by these issues. Customers using the affected versions of PHP within the services listed below could be impacted and should review the guidance provided.\n\nAffected versions:\n\n- PHP 8.5: Affected versions 8.5.0–8.5.11 · First fixed version: 8.5.12\n- PHP 8.4: Affected versions 8.4.0–8.4.26 · First fixed version: 8.4.27\n- PHP 8.3: Affected versions 8.3.0–8.3.35 · First fixed version: 8.3.36\n- PHP 8.2: Affected versions 8.2.0–8.2.34 · First fixed version: 8.2.35\n- PHP 5.4–8.1: No upstream fix released. End-of-life and have no planned fix. Migration to a supported branch is required.\n\nImpact:\n\nThis issue is accessible remotely by an actor without authentication over the internet-to-customer-application boundary, which can result in code execution, unintended access to process-accessible data, or denial of service on the targeted PHP worker. The issue is bounded to the affected worker and its application-level permissions; no cross-customer propagation has been established to date.\n\nCurrent Mitigation Status:\n\n- Amazon EMR: Amazon EMR on EC2 clusters launched with Ganglia included in the application set are affected, specifically EMR releases 4.2.0–5.29.0 and 5.30.0–6.15.0. Amazon EMR on EKS and Amazon EMR Serverless are not affected, on any release. On Amazon EMR on EC2, clusters running release 7.0.0 or later, and clusters launched without Ganglia installed, are also not affected. For affected releases, customers launching new clusters should omit Ganglia when it is not required. Where possible, customers should upgrade to EMR 7.x, which no longer includes Ganglia, and use the Amazon CloudWatch Agent for telemetry and monitoring. \n- Amazon WorkMail: AWS has applied configuration-level controls and has completed the upgrade to PHP 8.3.36. No customer action is required. \n- AWS Elastic Beanstalk: AWS has released updated PHP platform versions for all supported PHP versions (8.2 through 8.5) containing the upstream PHP fix. Customers with Managed Platform Updates enabled will receive the update automatically during their next maintenance window. Customers who have not enabled Managed Platform Updates should update their environment's platform version by following the documentation: PHP 8.5/8.4 and PHP 8.3/8.2. \n- AWS Lambda: AWS Lambda does not provide a managed PHP runtime. Customers who have deployed PHP as a custom runtime or container image are responsible for updating the PHP version used in their functions. We recommend upgrading to a patched PHP release as soon as possible and redeploying your functions. For guidance on building and maintaining custom runtimes, see the AWS Lambda documentation. If you use the third-party Bref project to run PHP on Lambda, Bref has published a security release containing updated layers and Docker images with the patched PHP versions. Please follow the Bref security release for update instructions. \n- Amazon Linux: Updated PHP packages are available for all regions. Customers running PHP on Amazon Linux should apply the updated packages as soon as they are available. Please follow CVE-2026-109618 and CVE-2026-109619 in the Amazon Linux Security Center for details. \n- Amazon Lightsail: Updated Lightsail blueprints are now available in all regions. AWS cannot update running Lightsail instances in place. Customers running PHP workloads on Lightsail should create new instances from the updated blueprints and migrate their applications following the documentation.\n\nMitigation Guidance:\n\n- Upgrading immediately to a patched PHP release is the only complete fix: 8.5.12, 8.4.27, 8.3.36, or 8.2.35. The configuration changes below may reduce impact for customers who cannot update immediately, but none is a complete mitigation. \n- Refer to Security advisory: Critical remote code execution vulnerabilities, update now for additional mitigations. \n- End-of-life runtimes 5.4–8.1: Apply interim configuration controls for CVE-2026-109619 where effective, restart PHP workers, and begin migration to a supported, fixed PHP branch immediately. No fix is available for CVE-2026-109618 on end-of-life branches. \n- Compensating controls if using AWS WAF: Patching is the only complete fix, and customers should upgrade PHP as their first priority. As patching a fleet takes time, we recommend reviewing this blog post, which shows how to use AWS Web Application Firewall (AWS WAF) to help reduce exposure during that window. Please note, this blog will be updated with AWS WAF guidance changes as this situation evolves. We are continuously updating the AWS WAF PHP Managed Rule Group to add protection for both CVE-2026-109618 and CVE-2026-109619. Customers using the default version will be automatically protected without any action on their part. Customers who have pinned a specific version should update to the latest version to receive this protection. For the latest version and details on the rules added, please refer to the AWS WAF Managed Rules changelog and subscribe to the AWS Managed Rules SNS topic.\n\nReferences:\n\n- CVE-2026-109618\n- CVE-2026-109619\n- GHSA-w8hw-w9fx-j79w\n- GHSA-6wmf-4rv5-p3rp\n- https://www.php.net/archive/2026.php#2026-10-21-5\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"PHP web runtimes contain two flaws (CVE-2026-109618 and CVE-2026-109619) that a remote caller can trigger with crafted web requests sent to PHP workers. The sources say an attacker can execute arbitrary code, read process-accessible data, or cause denial of service on the affected worker.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amazon-linux","aws","elastic-beanstalk","emr","lab-disclosure","lambda","lightsail","php","runtime","self-hosted"],"not_affected_if":["emr-7x-or-no-ganglia","emr-on-eks","emr-serverless","managed-hosting"],"how_to_check":"- Run `php -v` on each host or image and compare the version to the fixed releases.\n- Check whether PHP 5.4–8.1 is in use, since no upstream fix exists for those branches.\n- On Amazon EMR on EC2, check whether clusters were launched with Ganglia in the application set (affected releases 4.2.0–5.29.0 and 5.30.0–6.15.0).","fix":"- Upgrade PHP to `8.5.12`, `8.4.27`, `8.3.36`, or `8.2.35` (the first fixed version on each branch); this is the only complete fix.\n- Migrate PHP 5.4–8.1 to a supported, fixed branch; no fix is available for CVE-2026-109618 on those branches.\n- Until patched, use AWS WAF PHP Managed Rule Group (keep the default version, or update a pinned version) as a partial mitigation.\n- On EMR, move to EMR 7.x or launch new clusters without Ganglia.","status":"open","published_at":null,"first_seen_at":"2026-10-24T19:12:58+00:00","triaged_at":"2026-10-25T04:51:33+00:00","updated_at":"2026-10-25T04:51:33+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T04:51:33Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade PHP to `8.5.12`, `8.4.27`, `8.3.36`, or `8.2.35` (the first fixed version on each branch); this is the only complete fix.\n- Migrate PHP 5.4–8.1 to a supported, fixed branch; no fix is available for CVE-2026-109618 on those branches.\n- Until patched, use AWS WAF PHP Managed Rule Group (keep the default version, or update a pinned version) as a partial mitigation.\n- On EMR, move to EMR 7.x or launch new clusters without Ganglia.","reach":"internet","title":"PHP: out-of-memory corruption lets an unauthenticated web request run code","impact":"high","summary":"PHP web runtimes contain two flaws (CVE-2026-109618 and CVE-2026-109619) that a remote caller can trigger with crafted web requests sent to PHP workers. The sources say an attacker can execute arbitrary code, read process-accessible data, or cause denial of service on the affected worker.","category":"runtime","nicknames":[],"who_cares":["php","self-hosted","aws","lambda","elastic-beanstalk","emr","lightsail","amazon-linux"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote unauthenticated code execution on PHP worker, plus process data readable","analyst_note":"Confirm the exact CVE-2026-109619 trigger and the interim configuration controls named in the php.net advisory (https://www.php.net/archive/2026.php#2026-10-21-5) and GHSA-w8hw-w9fx-j79w.","how_to_check":"- Run `php -v` on each host or image and compare the version to the fixed releases.\n- Check whether PHP 5.4–8.1 is in use, since no upstream fix exists for those branches.\n- On Amazon EMR on EC2, check whether clusters were launched with Ganglia in the application set (affected releases 4.2.0–5.29.0 and 5.30.0–6.15.0).","needs_analyst":true,"not_affected_if":["managed-hosting","emr-serverless","emr-on-eks","emr-7x-or-no-ganglia"],"who_is_affected":"Applications that run PHP 8.2 through 8.5 below the fixed versions, or any PHP 5.4–8.1, on servers or workers that receive requests from the internet are exposed. AWS-managed services such as WorkMail and Elastic Beanstalk are patched by AWS or through platform updates, and EMR Serverless and EMR on EKS are not affected. Teams on fully managed PHP platforms with platform updates applied can skip the manual step.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.001027,"input_tokens":5526,"output_tokens":948,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-109618':6A,47B,94C,104C,170C,695C '-109619':10A,51B,98C,108C,174C,699C '-143':133C '-2026':5A,9A,46B,50B,93C,97C,103C,107C,169C,173C,694C,698C '/8.2':560C '/8.4':556C '10/21/2026':144C '10/23/2026':152C '13':153C '14':145C '2026':132C '30':146C,154C '4.2.0':395C '5.29.0':396C '5.30.0':398C '5.4':285C '6.15.0':399C '7':457C '7.0.0':422C '8.1':286C '8.2':275C,511C '8.2.0':278C '8.2.34':279C '8.2.35':283C '8.3':265C,559C '8.3.0':268C '8.3.35':269C '8.3.36':273C,490C '8.4':255C '8.4.0':258C '8.4.26':259C '8.4.27':263C '8.5':245C,513C,555C '8.5.0':248C '8.5.11':249C '8.5.12':253C 'access':78B,206C,311C,333C,337C 'action':493C 'actor':180C,315C 'affect':87B,185C,196C,224C,242C,246C,256C,266C,276C,354C,391C,410C,434C,436C 'agent':469C 'allow':177C 'also':432C 'amazon':22B,375C,377C,400C,405C,415C,467C,474C,664C,678C,702C,708C 'amazon-linux':21B 'appli':478C,681C 'applic':324C,359C,388C 'application-level':358C 'arbitrari':73B,201C 'attack':70B 'attent':141C 'authent':317C 'automat':529C 'avail':670C,690C 'aw':24B,134C,136C,213C,476C,496C,499C,561C,563C,621C 'beanstalk':27B,498C 'blueprint':712C 'bound':351C 'boundari':325C 'branch':304C 'bref':631C,638C,658C 'build':614C 'bulletin':123C,130C 'caller':55B,189C 'caus':81B,209C 'center':705C 'chang':118C 'cloudwatch':468C 'cluster':381C,419C,426C,441C 'code':74B,183C,202C,330C 'complet':485C 'configur':480C 'configuration-level':479C 'contain':42B,514C,582C,644C 'content':137C 'control':482C 'could':233C 'craft':59B,192C 'critic':159C 'cross':364C 'cross-custom':363C 'current':372C 'custom':221C,323C,365C,438C,452C,492C,519C,535C,572C,579C,617C,674C 'cve':4A,8A,45B,49B,92C,96C,102C,106C,168C,172C,693C,697C 'data':79B,207C,338C 'date':143C,151C,371C 'denial':82B,210C,340C 'deploy':575C 'detail':707C 'disclosur':31B 'docker':648C 'document':553C,623C 'ec2':380C,418C 'ek':403C 'elast':26B,497C 'elastic-beanstalk':25B 'emr':28B,376C,378C,393C,401C,406C,416C,456C 'enabl':524C,539C 'end':292C 'end-of-lif':291C 'environ':546C 'establish':369C 'execut':72B,200C,331C 'first':250C,260C,270C,280C 'fix':251C,261C,271C,281C,289C,299C,518C 'flaw':44B 'follow':551C,656C,692C 'function':594C,610C 'ganglia':384C,429C,444C,463C 'ghsa':12A,17A 'ghsa-w8hw-w9fx-j79w':11A,16A 'guidanc':240C,612C 'host':38B 'id':131C 'identifi':163C 'imag':583C,649C 'impact':217C,235C,307C 'import':139C 'includ':385C,462C 'inform':114C,129C 'instal':430C 'instruct':663C 'internet':321C 'internet-to-customer-appl':320C 'issu':113C,160C,220C,309C,349C 'j79w':15A,20A 'lab':30B 'lab-disclosur':29B 'lambda':32B,562C,564C,622C,637C 'last':149C 'later':424C 'launch':382C,427C,439C 'layer':646C 'level':360C,481C 'life':294C 'lightsail':33B,709C,711C 'linux':23B,665C,679C,703C 'list':231C 'longer':461C 'maintain':616C 'mainten':533C 'manag':521C,540C,569C 'migrat':300C 'mitig':373C 'monitor':473C 'new':440C 'next':532C 'omit':443C 'ongo':112C 'packag':668C,684C 'parti':630C 'patch':128C,600C,652C 'pdt':148C,156C 'permiss':361C 'php':1A,34B,39B,64B,89C,99C,165C,197C,227C,244C,254C,264C,274C,284C,346C,489C,503C,509C,517C,554C,558C,570C,576C,589C,601C,635C,653C,667C,676C 'plan':298C 'platform':504C,522C,541C,548C 'pleas':119C,655C,691C 'pm':147C,155C 'possibl':451C,606C 'process':77B,205C,336C 'process-access':76B,204C,335C 'project':632C 'propag':366C 'provid':241C,567C 'public':142C 'publish':640C 'read':75B,203C 'receiv':526C 'recommend':596C 'redeploy':608C 'refer':120C 'region':673C 'releas':290C,394C,413C,421C,437C,501C,602C,643C,660C 'remot':54B,188C,312C 'request':61B,194C 'requir':140C,306C,449C,495C 'respons':585C 'result':328C 'review':238C 'run':182C,420C,634C,675C 'runtim':3A,35B,41B,91C,101C,167C,571C,580C,618C 'say':68B 'scope':135C 'secur':642C,659C,704C 'see':619C 'self':37B 'self-host':36B 'send':191C 'sent':62B 'serverless':407C 'servic':84B,212C,214C,230C,342C 'set':389C 'soon':604C,686C 'sourc':67B 'specif':392C 'status':374C 'subject':116C 'summari':157C 'support':303C,508C 'system':186C 'target':345C 'telemetri':471C 'third':629C 'third-parti':628C 'trigger':57B 'two':43B,158C 'type':138C 'unauthent':179C 'unintend':332C 'updat':127C,150C,502C,523C,528C,542C,544C,587C,645C,662C,666C,683C,710C 'upgrad':454C,487C,597C 'upstream':288C,516C 'use':222C,465C,591C,626C 'version':225C,243C,247C,252C,257C,262C,267C,272C,277C,282C,505C,510C,549C,590C,654C 'w8hw':13A,18A 'w9fx':14A,19A 'web':2A,40B,60B,90C,100C,166C,193C 'window':534C 'within':228C 'without':316C,428C 'worker':65B,88B,198C,347C,355C 'workmail':475C 'x':458C","nicknames":[],"mitigations":[],"who_affected":"Applications that run PHP 8.2 through 8.5 below the fixed versions, or any PHP 5.4–8.1, on servers or workers that receive requests from the internet are exposed. AWS-managed services such as WorkMail and Elastic Beanstalk are patched by AWS or through platform updates, and EMR Serverless and EMR on EKS are not affected. Teams on fully managed PHP platforms with platform updates applied can skip the manual step.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T14:01:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/#GHSA-w8hw-w9fx-j79w","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T19:12:58+00:00","fetched_at":"2026-10-24T19:12:58+00:00","note":"AWS: PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)"}],"documents":[{"id":672,"url":"https://news.ycombinator.com/item?id=50181130","title":"PHP RCE via OOM Corruption","kind":"post","source":"hackernews","text":"PHP RCE via OOM Corruption\nhttps://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w\n\n3 points, 2 comments on Hacker News","published_at":"2026-10-21T14:01:04+00:00","relation":"discussion","confidence":null,"note":null},{"id":1491,"url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w","title":"GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (php-src)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2934,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-143-aws/","title":"AWS: PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)","kind":"advisory","source":"lab","text":"PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)\n\n### PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)\n\n| This is an ongoing issue. Information is subject to change. Please refer to this bulletin for the most updated patching information. |\n| --- |\n\nBulletin ID: 2026-143-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 14:30 PM PDT Last Updated Date: 10/23/2026 13:30 PM PDT\n\nSummary:\n\nTwo critical issues have been identified in PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) that can allow an unauthenticated actor to run code on affected systems. A remote caller can send crafted web requests to affected PHP workers and execute arbitrary code, read process-accessible data, or cause denial of service.\n\nAWS services are not impacted by these issues. Customers using the affected versions of PHP within the services listed below could be impacted and should review the guidance provided.\n\nAffected versions:\n\n- PHP 8.5: Affected versions 8.5.0–8.5.11 · First fixed version: 8.5.12\n- PHP 8.4: Affected versions 8.4.0–8.4.26 · First fixed version: 8.4.27\n- PHP 8.3: Affected versions 8.3.0–8.3.35 · First fixed version: 8.3.36\n- PHP 8.2: Affected versions 8.2.0–8.2.34 · First fixed version: 8.2.35\n- PHP 5.4–8.1: No upstream fix released. End-of-life and have no planned fix. Migration to a supported branch is required.\n\nImpact:\n\nThis issue is accessible remotely by an actor without authentication over the internet-to-customer-application boundary, which can result in code execution, unintended access to process-accessible data, or denial of service on the targeted PHP worker. The issue is bounded to the affected worker and its application-level permissions; no cross-customer propagation has been established to date.\n\nCurrent Mitigation Status:\n\n- Amazon EMR: Amazon EMR on EC2 clusters launched with Ganglia included in the application set are affected, specifically EMR releases 4.2.0–5.29.0 and 5.30.0–6.15.0. Amazon EMR on EKS and Amazon EMR Serverless are not affected, on any release. On Amazon EMR on EC2, clusters running release 7.0.0 or later, and clusters launched without Ganglia installed, are also not affected. For affected releases, customers launching new clusters should omit Ganglia when it is not required. Where possible, customers should upgrade to EMR 7.x, which no longer includes Ganglia, and use the Amazon CloudWatch Agent for telemetry and monitoring. \n- Amazon WorkMail: AWS has applied configuration-level controls and has completed the upgrade to PHP 8.3.36. No customer action is required. \n- AWS Elastic Beanstalk: AWS has released updated PHP platform versions for all supported PHP versions (8.2 through 8.5) containing the upstream PHP fix. Customers with Managed Platform Updates enabled will receive the update automatically during their next maintenance window. Customers who have not enabled Managed Platform Updates should update their environment's platform version by following the documentation: PHP 8.5/8.4 and PHP 8.3/8.2. \n- AWS Lambda: AWS Lambda does not provide a managed PHP runtime. Customers who have deployed PHP as a custom runtime or container image are responsible for updating the PHP version used in their functions. We recommend upgrading to a patched PHP release as soon as possible and redeploying your functions. For guidance on building and maintaining custom runtimes, see the AWS Lambda documentation. If you use the third-party Bref project to run PHP on Lambda, Bref has published a security release containing updated layers and Docker images with the patched PHP versions. Please follow the Bref security release for update instructions. \n- Amazon Linux: Updated PHP packages are available for all regions. Customers running PHP on Amazon Linux should apply the updated packages as soon as they are available. Please follow CVE-2026-109618 and CVE-2026-109619 in the Amazon Linux Security Center for details. \n- Amazon Lightsail: Updated Lightsail blueprints are now available in all regions. AWS cannot update running Lightsail instances in place. Customers running PHP workloads on Lightsail should create new instances from the updated blueprints and migrate their applications following the documentation.\n\nMitigation Guidance:\n\n- Upgrading immediately to a patched PHP release is the only complete fix: 8.5.12, 8.4.27, 8.3.36, or 8.2.35. The configuration changes below may reduce impact for customers who cannot update immediately, but none is a complete mitigation. \n- Refer to Security advisory: Critical remote code execution vulnerabilities, update now for additional mitigations. \n- End-of-life runtimes 5.4–8.1: Apply interim configuration controls for CVE-2026-109619 where effective, restart PHP workers, and begin migration to a supported, fixed PHP branch immediately. No fix is available for CVE-2026-109618 on end-of-life branches. \n- Compensating controls if using AWS WAF: Patching is the only complete fix, and customers should upgrade PHP as their first priority. As patching a fleet takes time, we recommend reviewing this blog post, which shows how to use AWS Web Application Firewall (AWS WAF) to help reduce exposure during that window. Please note, this blog will be updated with AWS WAF guidance changes as this situation evolves. We are continuously updating the AWS WAF PHP Managed Rule Group to add protection for both CVE-2026-109618 and CVE-2026-109619. Customers using the default version will be automatically protected without any action on their part. Customers who have pinned a specific version should update to the latest version to receive this protection. For the latest version and details on the rules added, please refer to the AWS WAF Managed Rules changelog and subscribe to the AWS Managed Rules SNS topic.\n\nReferences:\n\n- CVE-2026-109618\n- CVE-2026-109619\n- GHSA-w8hw-w9fx-j79w\n- GHSA-6wmf-4rv5-p3rp\n- https://www.php.net/archive/2026.php#2026-10-21-5\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}