Update PHP on Amazon Linux 2023 for the PHP2Shell fix

Is Amazon Linux 2023 affected by PHP2Shell?

Yes, until you install the updated packages. AL2023 ships PHP as versioned packages, php8.1 to php8.5, per its PHP documentation, and the builds before 21 October 2026 predate the PHP2Shell fix (CVE-2026-109618 and CVE-2026-109619). AWS’s security bulletin says customers running PHP on Amazon Linux should apply the updated packages. The upstream fixed releases are:

How do I check which PHP package my instance runs?

Ask dnf first: sudo dnf list installed 'php*' shows each PHP package with its full version, and the release ending tells you whether it’s the fixed build. php -v only reports the command-line binary. The website runs through PHP-FPM, so also check it from the web side: AWS’s LAMP tutorial uses a temporary phpinfo() page and tells you to delete it afterwards, and php_sapi_name() reports fpm-fcgi. See the check PHP version guide.

Has Amazon Linux shipped a PHP2Shell fix?

Yes, for php8.2 to php8.5. The Amazon Linux Security Center rates the updates Important and lists them for 22 October 2026; the repository metadata dates them 21 October:

The release notes for 2023.12.20261021 list these same php8.2 to php8.5 versions. Status per package is on the ALAS pages for CVE-2026-109618 and CVE-2026-109619. When we checked, the CVE-2026-109619 page still showed php8.5 as “Pending Fix” even though ALAS2023-2026-3304 lists both CVEs in the repository data; we treat php8.5 8.5.12-1.amzn2023.0.1 as fixed but expect the page to catch up.

How do I update PHP on Amazon Linux 2023?

AL2023 locks each instance to the repository version it was built from, as AWS’s deterministic upgrades guide explains, so move to the fixed release explicitly:

sudo dnf check-release-update
sudo dnf upgrade --releasever=2023.12.20261021

The first command lists available releases; the second shows the package changes and asks you to confirm. A later release also includes the fix. For new instances, launch from the latest AL2023 AMI, which AWS says always carries the newest packages. For container images, rebuild from the updated Amazon Linux 2023 base image.

How do I restart PHP-FPM and verify the fix?

Restart PHP so workers load the new code: sudo systemctl restart php-fpm, and sudo systemctl restart httpd if Apache serves the site, as in AWS’s LAMP tutorial. Then run sudo dnf list installed 'php*' again and look for the amzn2023.0.1 builds in the table, check the web side, and enter the version in the PHP version checker.

What if I can’t update yet?

Use PHP’s stopgaps, such as turning off session.upload_progress.enabled and lowering post_max_size, then restart php-fpm. AWS’s bulletin also lists AWS WAF rules as compensating controls; see PHP2Shell on AWS. Neither is a fix; limits are on the CVE-2026-109618 workaround page.

What about php8.1 or Amazon Linux 2?

ALAS marks AL2023’s php8.1 “No Fix Planned”, so move those sites to php8.2 or later. On Amazon Linux 2, core php is also “No Fix Planned”, and the PHP 8.2 Extras entry showed “Fixed” (ALAS2PHP8.2-2026-015) on one CVE page but “Pending Fix” on the other when we checked. See PHP end of life, the PHP2Shell patch guide and the PHP2Shell checker.