[Package Update Request] - PHP CVE 2026-109618 and CVE-2026-109619

PHP is releasing a CRITICAL security update today (21.10.2026):
https://www.php.net/archive/2026.php#2026-10-20-1
This update will fix two critical CVE:

CVE 2026-109618
CVE-2026-109619
Both rated CVSS v4.0 9.2.

Please update the AmazonLinux2023 PHP Versions quickly once the update is available.

@MrTschi

@MrTschi, thanks for reporting!
We are aware of those Critical CVEs and actively working on delivering an update asap.

update is released: https://www.php.net/archive/2026.php#2026-10-21-5 , please update asap

@alexey-tsvetnov

@alexey-tsvetnov when will it be available for AmazonLinux2023?

Looks like the whole PHP community is currently camping in docker-library/php#1694 refreshing the page.

Hopefully this gets patched ASAP 🙏

This really isn't acceptable for a major security issue that supposedly was delivered to Amazon days ago

PLEASE

@alexey-tsvetnov

@alexey-tsvetnov can you at least give an approximate timeline as to when this will be available over dnf updates?

@alexey-tsvetnov

@alexey-tsvetnov I am also requesting an estimated timeline for the patch to be released.

@stewartsmith

@stewartsmith I hope the team is working on this (:

News??

I contacted support; we have business+ and got these unsatisfactory responses (the second one doesn't even address AL2023):

Our service team is aware of the reported issue and is actively working on it.
There is no specific ETA available at the moment; however, updates will be published on our public CVE pages at https://explore.alas.aws.amazon.com/ once available.
We recommend monitoring the advisories once released and evaluating the impact based on your specific environment.

and

Thank you for your patience. My name is redacted and I have taken over your case from my colleague.

We are aware of CVE-2026-109618 and CVE-2026-109619, which affect PHP interpreter. These issues affect PHP branches 8.2 through 8.5 at default configuration and can allow an unauthenticated remote actor to crash PHP worker processes. We can confirm that the reachable scenarios are narrow and assessed as difficult to leverage in practice.

AWS will incorporate the fix released by PHP to the following affected services:

AWS Elastic Beanstalk: ElasticBeanstalk mitigation is introduced on the latest platform version. Customers with running environments will be automatically updated to the latest platform version in the selected maintenance window through Managed Platform Updates. No action is required to update to the latest version. Customers who have not enabled Managed Platform Updates can update their environment's platform version by following our documentation [1].

AWS Lightsail: AWS Lightsail will evaluate and build the fix for new Lightsail blueprints so customers can incorporate the fix.

If you have questions or concerns, please follow up on this support case.

[1] https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.platform.upgrade.html

@mbuk

@mbuk thank you for contacting support - a real shame it wasn't a human who responded and that the answer was so lacklustre. Keeping an eye on this thread and routinely updating dnf metadata in the meantime.

13. @mbuk thank you for contacting support - a real shame it wasn't a human who responded and that the answer was so lacklustre. Keeping an eye on this thread and routinely updating dnf metadata in the meantime.

It was a human I spoke to - those are excerpts from the chat logs - very disappointing

It absolutely sucks that 4.13.12 was released just prior to the PHP release and only includes the incomplete mitigations based on settings. This is absolutely misleading and devops that run an update of this will think they have fixed the issue.
This will lead to exploits.
It might have been released with good will, but this cannot be it folks.

@alexey-tsvetnov

In contrast to the PHP's case, that CVE wasn't Critical, but only Important, that doesn't have the same urgency. This makes the whole difference. I wouldn't mix topics here and spread misinformation.

@alexey-tsvetnov I want to clarify, since https://explore.alas.aws.amazon.com/CVE-2026-109618.html and https://explore.alas.aws.amazon.com/CVE-2026-109619.html are both listed as Important in ALSC (even though they're Critical everywhere else). Are the Amazon vulnerability pages mistaken, and does Amazon acknowledge that these are Critical CVEs?

https://aws.amazon.com/security/security-bulletins/2026-143-aws/

Some info finally

31. https://aws.amazon.com/security/security-bulletins/2026-143-aws/
Some info finally

Does that mean tomorrow?

From: https://aws.amazon.com/security/security-bulletins/2026-143-aws/

Amazon Linux: Updated PHP packages are targeted for 2026-10-22. Customers running PHP on Amazon Linux should apply the updated packages as soon as they are available. Please follow CVE-2026-109618 and CVE-2026-109619 in the Amazon Linux Security Center for details.

So they're not going to publish new versions until tomorrow. That seems pretty weird considering the same bulletin acknowledges the severity of the issue.

24+ hours is utterly ridiculous and insulting to customers.

@alexey-tsvetnov

@alexey-tsvetnov
if this was you: https://aws.amazon.com/security/security-bulletins/2026-143-aws/

THANK YOU!!!!!!!

Amazon Linux: Updated PHP packages are targeted for 2026-10-22.

(Source: https://aws.amazon.com/de/security/security-bulletins/2026-143-aws/)

@p24-max

Our team was able to deploy #1148 (comment) to a copy of one of our production instances, build the PHP SRPM using the script, bundle up the /opt/php-local-repo directory and the /etc/yum.repos.d/php-local.repo; store in S3 and roll out updates to servers via Systems Manager.

Our invocation required dnf update -y php8.2 as we built 8.2.35. This should help people patch themselves while the official updates come. Many thanks to @p24-max for the excellent script and the forethought to ensure the package priority would cede to AWS's offical update later. 👏

@scorgn

@scorgn ,

It is not that straightforward. There are different ranking systems, and there are also differences among Linux distributions.
I don't have a specific knowledge in this and don't know all the details as I'm not evaluating CVEs.

I was referring to the cve.org data
PHP's cve's

vs

Nginx's CVE

However, based on the text over here https://aws.amazon.com/security/security-bulletins/2026-143-aws/
PHP's CVEs are serious ones.

@zenchicken

@zenchicken well it was my script but no issue

@p24-max

130. @zenchicken well it was my script but no issue

@p24-max my many apologies! Corrected my comment; credit where credit is due. Thanks again!

It's a relief to finally get some official communication. Although, please do pass on to the relevant people at Amazon that it would have saved many people a lot of stress if this could have been put up 7 hours ago!

@olinorwell

@olinorwell,

this could have been put up 7 hours ago

at least 15 hours ago there was a comment to ensure this issue is not missed by Amazon Linux. And you are right though, it is not an official communication and might not be it as this is a Github platform.

From the wiz.io blog on the vulnerability (here):

"We’d also like to express our sincere gratitude towards Automattic, Akamai, AWS, Cloudflare, Fastly, Google, Imperva, Microsoft, Vercel, and many others, for helping prepare guidance and out-of-the-box mitigations for customers who cannot apply the patch immediately."

I'd like to echo their thanks to AWS.

/s

@alexey-tsvetnov

@alexey-tsvetnov You have caused more confusion than clarity.

Navigation Menu

Repository navigation

[Package Update Request] - PHP CVE 2026-109618 and CVE-2026-109619 #1148

105 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Package Update Request] - PHP CVE 2026-109618 and CVE-2026-109619 #1148

Description

Activity

alexey-tsvetnov commented on Oct 21, 2026

cornevandersteen commented on Oct 21, 2026

p24-max commented on Oct 21, 2026

kuusas commented on Oct 21, 2026

RavianXReaver commented on Oct 21, 2026

devzzm commented on Oct 21, 2026

cAstraea commented on Oct 21, 2026

tallandy commented on Oct 21, 2026

dsh-mabel commented on Oct 21, 2026

RavianXReaver commented on Oct 21, 2026

danielcmm commented on Oct 21, 2026

mbuk commented on Oct 21, 2026

dsh-mabel commented on Oct 21, 2026

mbuk commented on Oct 21, 2026

wikando-ck commented on Oct 21, 2026

105 remaining items

scorgn commented on Oct 21, 2026

gregory-claeyssens commented on Oct 21, 2026

maxsolomon14 commented on Oct 21, 2026

edaemon commented on Oct 21, 2026

jtrumpio commented on Oct 21, 2026

01PC-Felix commented on Oct 21, 2026

p24-max commented on Oct 21, 2026

zenchicken commented on Oct 21, 2026

alexey-tsvetnov commented on Oct 21, 2026

p24-max commented on Oct 21, 2026

zenchicken commented on Oct 21, 2026

olinorwell commented on Oct 21, 2026

alexey-tsvetnov commented on Oct 21, 2026

BiddlyWiddly commented on Oct 21, 2026

925dk commented on Oct 21, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions