PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

Posted by hayd 14 hours ago

Counter115Comment26OpenOriginal

Comments

Comment by hayd 13 hours ago

Update: After posting this Amazon security released a bulletin to say we should see the updates _some time tomorrow_. https://aws.amazon.com/security/security-bulletins/2026-143-...

Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.

Comment by otterley 13 hours ago

> Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.

Posts elsewhere have suggested that the embargo was broken early. Even the PHP release team itself didn't have sufficient time to update their public Docker images before it was published.

Comment by hayd 13 hours ago

My understanding is the embargo was scheduled to end 14:00 UTC today, broken 07:41 UTC by Chainguard... It's now 22:00 UTC and AWS are talking about (some time) tomorrow.

Comment by bunderbunder 13 hours ago

The official story is that it was originally scheduled for 14:00 UTC tomorrow. Then yesterday they decided to move the date forward by 24 hours in response to information about the vulnerability leaking.

Comment by radlad 13 hours ago

Yes, PHP release was scheduled for Wednesday, 21 October 2026 at 14:00 UTC: https://news-web.php.net/php.announce/509

Comment by edaemon 13 hours ago

Even assuming they didn't have prior knowledge, I don't understand why AWS is going to take 24+ hours to incorporate an upstream fix.

Comment by otterley 13 hours ago

Probably because it takes time for them to run all the regression tests. They don't want to break something while fixing something else. Damned either way.

In the meantime, you can mitigate the vulnerability significantly by following the instructions here: https://www.abstract.security/blog/php2shell-critical-php-rc...

Comment by Elv13 12 hours ago

[dead]

Comment by 13 hours ago

Comment by mikeweiss 14 hours ago

Amazon has a bad track record for delivering critical updates quickly. During the Copy Fail - CVE-2026-31431 event they were behind every major Linux distro in updating Bottlerocket OS

Comment by captn3m0 14 hours ago

Bottlerocket's changelog through the storm of Linux CVEs these last year has been bad as well: https://github.com/bottlerocket-os/bottlerocket/blob/develop...

Roughly one release every 15-20 days.

Comment by jamesfinlayson 11 hours ago

Yes I was hit by waiting for Elastic Beanstalk to update nginx for the succession of fixes. Wasn't fun being pestered by my security team.

Comment by otterley 14 hours ago

Patch releases are currently scheduled for tomorrow (October 22): https://aws.amazon.com/security/security-bulletins/2026-143-...

Comment by aeyes 12 hours ago

Good reminder to never use Amazon Linux. What is taking them so long to package a minor release?

Comment by Elv13 12 hours ago

See my reply above https://news.ycombinator.com/item?id=50188886 (Note, I do not work for AWS and my insight into that are very outdated)

Comment by otterley 11 hours ago

I said the same, with less detail: https://news.ycombinator.com/item?id=50188577

Comment by hayd 14 hours ago

We didn't get much information throughout the day, besides these comments by an AWS employee/Amazon Linux maintainer on this thread: https://github.com/amazonlinux/amazon-linux-2023/issues/1148...

He referenced an nginx Important CVE taking 20 days to be patched - after it was noted that these PHP CVEs were also labelled by AWS as Important (not Critical). This employee took issue to another user's comment describing 20 days as "nearly a month".

Amazon Linux users/AWS customers barely got any tangible information from the CVE publication at 14:00UTC until this bulletin was posted at 21:30UTC. Very disappointing.

Comment by Twirrim 14 hours ago

Where, exactly, does Amazon classify the PHP RCE as Important?

I'm not sure anything says what your editorialised title, and comment link says.

They were calling out that an NGINX CVE that was Important took 20 days. They're saying nothing about what classification Amazon has set on PHP,.

> So, from the CVE publication to an available fixed package it took 20 days, not a month.

They specifically call out that it's not the same as the Nginx case:

> In contrast to the PHP's case, that CVE wasn't Critical, but only Important, that doesn't have the same urgency.

Comment by hayd 14 hours ago

https://explore.alas.aws.amazon.com/CVE-2026-109618.html https://explore.alas.aws.amazon.com/CVE-2026-109619.html

Both are labelled Important, not Critical.

Comment by pixl97 13 hours ago

Heh, what is critical in their eyes? Catching the servers physically on fire?

Comment by trgfdffd 13 hours ago

It seems to me that this comment is just regarding an earlier vulnerability and doesn't comment on PHP2Shell?

Comment by HoyaSaxa 11 hours ago

Poor showing from AWS especially since Wiz’s blog post explicitly mentions that AWS was given advance notice.

But they did in fact release the updated Amazon Linux image about 15 minutes ago: https://github.com/amazonlinux/amazon-linux-2023/issues/1148...

Comment by 80fj0348i 13 hours ago

Honest question: Does anyone actually use Amazon Linux in production? Everywhere I've every worked used a mainstream distro for cloud servers, like Debian, Ubuntu, Red Hat or SUSE.

Comment by otterley 13 hours ago

I do. It works fine, particularly if you're using EKS- or ECS-optimized images.

Comment by benjaopazoc 13 hours ago

We did, until this morning

Comment by jamesfinlayson 11 hours ago

Yes. I had a project that was built with Elastic Beanstalk and was trying to move off it, but never got there. Amazon Linux and its package management was not great and I missed Debian/CentOS/Ubuntu.

Comment by iririririr 13 hours ago

aren't everyone using lambda functions? and aws infra itself? they migth only consider the urgency of internal teams, so anything !java will be pushed.

Comment by 13 hours ago

Comment by pier25 13 hours ago

sounds like they are trying to get rid of users of Amazon Linux honestly