PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
Two critical vulnerabilities in PHP web runtimes have been identified that allow unauthenticated remote code execution. AWS has issued a bulletin advising customers to review their PHP versions to prevent potential security breaches.
Why it matters
These vulnerabilities pose a significant risk to web infrastructure, potentially allowing attackers to compromise servers and access sensitive data.
Bulletin ID: 2026-143-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 14:30 PM PDT
Two critical issues have been identified in PHP web runtimes ( CVE-2026-109618 and CVE-2026-109619 ) that can allow an unauthenticated actor to run code on affected systems. A remote caller can send crafted web requests to affected PHP workers and execute arbitrary code, read process-accessible data, or cause denial of service.
AWS services are not impacted by these issues. Customers using the affected versions of PHP within the services listed below could be impacted and should review the guidance provided.
This issue is accessible remotely by an actor without authentication over the internet-to-customer-application boundary, which can result in code execution, unintended access to process-accessible data, or denial of service on the targeted PHP worker. The issue is bounded to the affected worker and its application-level permissions; no cross-customer propagation has been established to date.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in