Is AWS affected by PHP2Shell?
AWS’s own services are not affected, according to AWS security bulletin 2026-143-AWS, but PHP that you run on AWS is. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is in the PHP runtime, so any EC2 instance, Lightsail instance, Elastic Beanstalk environment or container that serves web requests with an unfixed PHP is in scope. Who installs the fix depends on the service.
| AWS service | Who updates PHP | Status in the AWS bulletin |
|---|---|---|
| Elastic Beanstalk | AWS ships platforms; you apply them | Fixed PHP platform versions (v4.13.12) released 21 Oct 2026; a follow-on release with the upstream PHP fix targeted for 22 Oct |
| Lightsail | You, by moving to a new instance | Updated blueprints expected 21 Oct 2026; running instances can’t be updated in place |
| Amazon Linux on EC2 | You | Updated PHP packages targeted for 22 Oct 2026 |
| Other OS on EC2 (Ubuntu, Debian …) | You | Follow your distribution’s advisory |
| Amazon WorkMail | AWS | Configuration controls applied; no customer action |
How do I fix PHP2Shell on Elastic Beanstalk?
Move your environment to a fixed PHP platform version. AWS released PHP platform version 4.13.12 on 21 October 2026, and says a follow-on release containing the upstream PHP fix was targeted for 22 October. If Managed Platform Updates is enabled, the update arrives in your next maintenance window. If it isn’t, update the environment’s platform version yourself in the Elastic Beanstalk console. AWS links the steps from the bulletin.
How do I fix PHP2Shell on Lightsail?
Create a new Lightsail instance from an updated blueprint and move your site to it. AWS says it can’t update running Lightsail instances in place, and expected updated blueprints on 21 October 2026. Back up your site and database, launch the new instance, migrate, check the PHP version, then switch traffic and retire the old instance.
How do I fix PHP2Shell on EC2 and Amazon Linux?
Update the PHP packages on the instance and restart PHP. On EC2 you manage the operating system:
- Amazon Linux: AWS targeted updated PHP packages for 22 October 2026. Follow CVE-2026-109618 and CVE-2026-109619 in the Amazon Linux Security Center, install the updated packages when they’re published, then restart PHP-FPM or Apache. Step-by-step: update PHP on Amazon Linux.
- Ubuntu or Debian: see Update PHP on Ubuntu and Debian. The PHP number can stay the same after a backported fix, so check the package version.
- Containers on ECS or EKS: rebuild your image on a fixed PHP and redeploy. See Docker PHP image.
After updating, confirm the version your website actually runs with the PHP2Shell checker. The fixed upstream releases are:
| Branch | First fixed release |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
| 8.1 and older | No new release; official source patches for 7.4, 8.0 and 8.1 |
PHP 8.1 and older get no new releases; AWS says migrating to a supported branch is required. See PHP end of life.
What does AWS WAF do against PHP2Shell?
It can block known attack patterns while you update. AWS’s bulletin recommends:
- the SizeRestrictions_BODY rule in the AWS WAF Core rule set for CVE-2026-109618, which blocks request bodies over 8 KB;
- a custom rule for CVE-2026-109619, which matches POST requests with
PHP_SESSION_UPLOAD_PROGRESSandPHPSESSID.
The body-size rule also blocks large forms and uploads, so test it first. AWS says neither control is a complete mitigation. See PHP2Shell WAF rules for how other providers compare.
What if I can’t update PHP on AWS today?
Use PHP’s official stopgaps from the CVE-2026-109618 workaround together with AWS WAF, and restrict access to the site if you can. None of these replaces the update. Once PHP is fixed, check for signs of an earlier intrusion with the compromise checklist.
Does AWS patch PHP on my EC2 instance automatically?
No. On EC2 you manage the operating system and PHP yourself, so you install the fixed packages and restart PHP. AWS's bulletin covers its managed platforms, such as Elastic Beanstalk and Lightsail blueprints, separately.
I use AWS WAF. Is my PHP site safe from PHP2Shell?
Not fully. AWS calls its WAF rules compensating controls and says upgrading PHP is the only complete fix. Add the rules from the bulletin to buy time, then update PHP.
Check your PHP for PHP2Shell
Enter the version your website reports. We compare it with the first fixed release for its branch and tell you what to do next.
PHP2Shell checker →Sources
The core facts on this page (fixed versions, CVE details, vendor packages and agency warnings) come from official sources. Research, news and community posts are labelled as such.
- Security Bulletin 2026-143-AWS: PHP CVE-2026-109618 and CVE-2026-109619Vendor AWS
- Security advisory: Critical remote code execution vulnerabilities, update nowOfficial The PHP Group
- RCE via OOM corruptionOfficial The PHP Group
- RCE via stale global stateOfficial The PHP Group