AWS Says Its Services Are Not Affected by the PHP Flaws, but Lightsail Instances Cannot Be Patched in Place
Security / news
AWS Says Its Services Are Not Affected by the PHP Flaws, but Lightsail Instances Cannot Be Patched in Place
Bulletin 2026-143-AWS lists four services with different fixes, an 8,192-byte WAF body limit for one CVE and a custom rule for the other.
Customers running PHP on Amazon Lightsail have to build new instances from updated blueprints and migrate their applications, because AWS "cannot update running Lightsail instances in place." That is the least convenient line in Bulletin 2026-143-AWS, published 21 October 2026 at 14:30 PDT for CVE-2026-109618 and CVE-2026-109619.
Both flaws let an unauthenticated remote caller send crafted web requests to a PHP worker. AWS says successful exploitation can lead to code execution, reading process-accessible data or denial of service, and that "AWS services are not impacted by these issues." The exposure is in what customers run on top of them. The bulletin is rated Important and was last updated at 20:30 PDT the same day.
Four services, four different fixes
| Service | Status on 21 October | What the customer does |
|---|---|---|
| Amazon WorkMail | Config controls applied; PHP 8.3.36 targeted 2026-10-22 | Nothing |
| AWS Elastic Beanstalk | PHP platform v4.13.12 released 2026-10-21 | Enable managed updates or upgrade by hand |
| Amazon Linux | Packages out in commercial regions | Apply updates; other regions targeted 2026-10-22 |
| Amazon Lightsail | Updated blueprints expected 2026-10-21 | Rebuild instances and migrate |
Elastic Beanstalk customers with Managed Platform Updates enabled are updated in their next maintenance window. A follow-on platform release carrying the upstream PHP fix is targeted for 2026-10-22, so v4.13.12 is an interim step.
Which PHP versions are affected
The upstream fix, described in the PHP Foundation's release post, arrived on four branches. AWS lists the same boundaries.
| Branch | Affected | First fixed |
|---|---|---|
| 8.5 | 8.5.0 to 8.5.11 | 8.5.12 |
| 8.4 | 8.4.0 to 8.4.26 | 8.4.27 |
| 8.3 | 8.3.0 to 8.3.35 | 8.3.36 |
| 8.2 | 8.2.0 to 8.2.34 | 8.2.35 |
| 5.4 to 8.1 | All | None (end of life) |
For the end-of-life branches AWS says "Migration to a supported branch is required." There is no fix for CVE-2026-109618 on them, and interim configuration controls apply only to CVE-2026-109619. Our earlier report on the 8.5.12 fixes covers the 8.1 gap.
What the WAF rules do
AWS calls upgrading the only complete fix, and says configuration changes may reduce risk without being complete mitigations. For CVE-2026-109618 it points to the SizeRestrictions_BODY rule in the AWS WAF Core rule set, which blocks request bodies over 8 KB (8,192 bytes). The Foundation describes that CVE as memory-limit corruption that an unauthenticated request could trigger on Apache with mod_php before application code runs, so a body limit narrows the room for oversized input without removing the bug.
For CVE-2026-109619 AWS published a custom rule named PHP2Shell, priority 0, action Block. It matches only a POST that carries PHPSESSID as a cookie key or in the body, together with PHP_SESSION_UPLOAD_PROGRESS in the body. AWS also released version 2.3 of the AWS WAF PHP Managed Rule Group and made it the default version globally.
The score understates one case. The Foundation puts the rating at 9.2 and says a leaked 10.0 was wrong, but a customer who reads "not impacted" and stops will leave a self-managed PHP 8.1 instance exposed with no vendor fix at all. The same week produced GitLab's second CVSS 10.0 overflow, which also has no workaround.
The next dated step is 22 October, when AWS targets the WorkMail upgrade, the Beanstalk follow-on release and the remaining Amazon Linux regions.
Sources
More in Security
- 01musl's regcomp Has Integer Overflows in Every Release Since 0.5.0, and the Fix Is 1.2.7, Not Yet OutCVE-2026-107891 needs an application that compiles untrusted regular expressions; Alpine shipped patched packages before musl did.
- 02eMudhra's Eight Intermediate CA Keys Were Single Bytes, Recoverable in 256 GuessesChrome, Firefox, Apple and Microsoft have blocked the intermediates, but curl, Python and Node still accepted a forged certificate in one researcher's tests.
- 03BIND, Unbound and PowerDNS Fixed 16 CVEs on 21 October, and Two of Them Cap DNS Name Decompression WorkUnbound 1.26.2 and PowerDNS add limits on how much compressed-name work one packet can cost; the DNS advisories also include a cache-poisoning and a DNSSEC-bypass flaw.
- 04PHP Pre-Announces Two CVSS 9.2 Flaws for 14:00 UTC and Names No VersionsA third-party post already lists CVE IDs and 'fixed' builds that are the September 24 releases, which contradicts php.net.