AWS rates PHP RCE as Important so Amazon Linux 2023 patch may take 20 days
Users and developers are expressing frustration over the delayed release of a critical PHP security patch for Amazon Linux 2023. While the PHP community has released a fix for a remote code execution vulnerability, Amazon's internal security review process has created a multi-day lag in deployment.
Why it matters
Security delays in major cloud infrastructure platforms expose enterprise users to significant cyber threats and highlight the tension between rapid patching and corporate stability protocols.
Code Issues 307 ( 307 ) Pull requests Discussions Actions Projects Security and quality Insights More items [Package Update Request] - PHP CVE 2026-109618 and CVE-2026-109619 #1148 New issue Copy link New issue Copy link Open Open [Package Update Request] - PHP CVE 2026-109618 and CVE-2026-109619 #1148 Copy link Description MrTschi opened on Oct 21, 2026 Issue body actions PHP is releasing a CRITICAL security update today (21.10.2026): https://www.php.net/archive/2026.php#2026-10-20-1 This update will fix two critical CVE:
Please update the AmazonLinux2023 PHP Versions quickly once the update is available.
Reactions are currently unavailable Activity Next alexey-tsvetnov commented on Oct 21, 2026 alexey-tsvetnov on Oct 21, 2026 Member More actions @MrTschi , thanks for reporting! We are aware of those Critical CVEs and actively working on delivering an update asap.
More actions update is released: https://www.php.net/archive/2026.php#2026-10-21-5 , please update asap
More actions @alexey-tsvetnov when will it be available for AmazonLinux2023?
Headlinne story · 7 newsrooms
Global Websites Go Dark After AI Uncovers Critical Programming Language Flaws
What every outlet reported, where they differ, and how each framed it →
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in