AWS Bulletin 2026-143 Addresses Critical PHP Runtime RCE
Tech GuruQuick Answer
AWS bulletin 2026-143 says customer-managed PHP workloads may be affected by CVE-2026-109618 and CVE-2026-109619. Move supported branches to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, migrate end-of-life branches, verify each active workload, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory AWS PHP workloads, services, versions, SAPIs, images, update modes, WAF controls, exposure, and owners; deploy a supported fixed runtime; migrate unsupported branches; restart or replace workers; verify active versions and service-specific status; test requests; and retain evidence.
Last verified: 2026-10-22 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Customer-managed PHP web runtimes on AWS services |
|---|---|
| Advisory | 2026-143-AWS / GHSA-w8hw-w9fx-j79w / GHSA-6wmf-4rv5-p3rp |
| CVEs | CVE-2026-109618, CVE-2026-109619 |
| Authoritative release date | 2026-10-21 21:30:00 UTC |
| Authority revision date | 2026-10-22 03:30:00 UTC |
| Affected versions | PHP 8.5.0–8.5.11, 8.4.0–8.4.26, 8.3.0–8.3.35, and 8.2.0–8.2.34; PHP 5.4–8.1 is end of life with no upstream fix. Service applicability and customer action vary by deployment. |
| Fixed version | PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35; migrate PHP 5.4–8.1 to a supported fixed branch |
| CVSS base score | 9.2 (CVSS v4.0) |
| CVSS severity | Critical |
| Exploitation status | AWS and the PHP project do not state that these vulnerabilities are being maliciously exploited; AWS states that no cross-customer propagation has been established.; no exploitation claim is inferred. |
What Changed
AWS published service-specific guidance for two unauthenticated PHP request-lifecycle flaws that can permit code execution, process-accessible data disclosure, or denial of service in customer workloads. AWS states that AWS services themselves are not impacted; customer action depends on the service, runtime, platform-update mode, and deployed version.
What To Validate Now
- Inventory. Identify PHP workloads on Elastic Beanstalk, Amazon Linux, Lightsail, containers, instances, and other AWS services; record runtime, SAPI, version, platform or image, update mode, exposure, AWS WAF controls, and owner.
- Establish applicability. Match each workload to its running PHP version and AWS service guidance. Verify managed-platform update status and active revisions rather than assuming an advertised service update has reached a workload.
- Remediate. Redeploy or update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 through the supported service or package channel. Migrate end-of-life branches; treat AWS WAF and configuration controls as temporary risk reduction, not complete fixes.
- Validate. Confirm the runtime in every active worker or revision, restart or replace processes, test representative requests and failure handling, verify platform-update and WAF status where used, and retain package, image, deployment, and runtime evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
AWS services are not themselves impacted, but customer workloads can be. WorkMail, Elastic Beanstalk, Amazon Linux, and Lightsail have different action paths; verify the live runtime. WAF or configuration controls do not replace the PHP update.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
