🚨PHP Critical Security Flaws Allow Code Execution
Unpatched PHP systems vulnerable to remote code execution
TL;DR
Two critical PHP vulnerabilities allow unauthenticated code execution. Affected versions: PHP 8.5.0-8.5.11, 8.4.0-8.4.26, 8.3.0-8.3.35, 8.2.0-8.2.34. Upgrading to patched versions is crucial.
Two critical vulnerabilities in PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated actors to execute arbitrary code on affected systems. This impacts PHP versions 8.5.0-8.5.11, 8.4.0-8.4.26, 8.3.0-8.3.35, and 8.2.0-8.2.34. If you're running PHP workloads, especially on AWS Elastic Beanstalk or Amazon Linux, you need to upgrade to the patched versions immediately. AWS has released updates for Elastic Beanstalk and Amazon Linux, with more updates expected for Amazon WorkMail and Lightsail.
Key Points
Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP web runtimes allow unauthenticated code execution.
Affected PHP versions: 8.5.0-8.5.11, 8.4.0-8.4.26, 8.3.0-8.3.35, and 8.2.0-8.2.34.
Upgrade to patched versions: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
AWS Elastic Beanstalk and Amazon Linux updates released 2026-10-21.
Amazon WorkMail and Lightsail updates targeted for 2026-10-22.
Why It Matters
If you're running PHP workloads on AWS Elastic Beanstalk or Amazon Linux, you need to upgrade to the patched PHP versions immediately. AWS has released updates for Elastic Beanstalk and Amazon Linux, with more updates expected for Amazon WorkMail and Lightsail. For those on end-of-life PHP versions, apply interim configuration controls and begin migration to a supported version.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.