PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

If you run PHP applications on AWS services like Elastic Beanstalk or Amazon Linux, you must update to patched PHP versions by October 22, 2026, or migrate from end-of-life versions.

Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been discovered in PHP web runtimes that allow unauthenticated remote attackers to execute arbitrary code, access process data, or cause denial of service. The issues affect specific versions of PHP 8.5, 8.4, 8.3, and 8.2, with fixed versions identified for each. PHP versions 5.4 through 8.1 are end-of-life and have no planned fixes, requiring migration to a supported branch. AWS services are not impacted, but customers using affected PHP versions within certain AWS services like Amazon WorkMail, AWS Elastic Beanstalk, Amazon Linux, and Amazon Lightsail may be at risk. AWS has implemented mitigations for some services and is rolling out updates, with some requiring customer action.

This incident highlights the ongoing challenge of maintaining security for widely used open-source software like PHP, particularly for older, unsupported versions. The rapid release of patches by AWS across multiple services demonstrates their proactive approach to critical vulnerabilities, but also underscores the reliance on timely updates from upstream projects and the inherent risks of using end-of-life software. The detailed mitigation guidance, including AWS WAF rules, suggests a complex ecosystem where immediate patching may not always be feasible, necessitating layered security strategies.

The vulnerabilities' impact is confined to individual PHP workers, preventing cross-customer data breaches, which is a significant positive. However, the need for customers to actively manage platform updates on services like Elastic Beanstalk or manually migrate instances on Lightsail indicates a shared responsibility model for security. Organizations must prioritize these updates to prevent code execution and data compromise, especially given that no fix is available for CVE-2026-109618 on end-of-life PHP branches.