Two critical issues have been identified in PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) that can allow an unauthenticated actor to run code on affected systems.
A remote caller can send crafted web requests to affected PHP workers and execute arbitrary code, read process-accessible data, or cause denial of service.
AWS says its services are not impacted by these issues.
AFFECTED VERSIONS AND FIRST FIXES
The bulletin lists affected PHP versions and the first fixed versions: PHP 8.5: 8.5.0–8.5.11; first fixed 8.5.12; PHP 8.4: 8.4.0–8.4.26; first fixed 8.4.27; PHP 8.3: 8.3.0–8.3.35; first fixed 8.3.36; PHP 8.2: 8.2.0–8.2.34; first fixed 8.2.35.
For older runtimes 5.4–8.1, there is no upstream fix released. End-of-life and migration to a supported branch is required.
- PHP 8.5: Affected 8.5.0–8.5.11; First fixed 8.5.12
- PHP 8.4: Affected 8.4.0–8.4.26; First fixed 8.4.27
- PHP 8.3: Affected 8.3.0–8.3.35; First fixed 8.3.36
- PHP 8.2: Affected 8.2.0–8.2.34; First fixed 8.2.35
- PHP 5.4–8.1: No upstream fix released. End-of-life and have no planned fix. Migration to a supported branch is required.
MITIGATIONS AND WHAT TO DO NOW
Upgrade immediately to a patched PHP release for a complete fix: 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
End-of-life runtimes should be moved to a supported PHP branch as soon as possible. Interim configuration controls may reduce exposure but are not a full fix.
If you cannot upgrade right away, consider compensating controls such as AWS WAF rules per the bulletin.
WHAT THIS MEANS FOR USERS AND WHAT REMAINS UNCERTAIN
AWS services are not impacted according to the bulletin, but customer environments running affected PHP versions are at risk if not upgraded.
End-of-life runtimes pose ongoing risk until migrated to supported versions, and there is no upstream fix for those versions.
Readers should plan a migration timeline to a supported branch and review their deployment environments for exposure.
RELATED COVERAGE
- CVE-2026-110812 in Amazon Neptune: what operators should know and how to respond
- Two CVEs in FreeRTOS-Kernel Arm Cortex-R82 MPU port: remediation guidance and reader takeaways
- Agents are your newest insiders: Security must move at their speed
- Post-quantum authentication: Why organizations should start testing certificate ecosystems now
- Security articles
SOURCES
- Latest Bulletins: PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) Published · Primary source
