AWS has rated a PHP remote code execution vulnerability as Important, but customers on Amazon Linux 2023 may wait around 20 days for a patch. A user with a Business+ support plan contacted AWS support and received responses that the user found unsatisfactory. The first response said the service team was aware of the issue and working on it, but no ETA was available, and it pointed customers to the public CVE pages at https://explore.alas.aws.amazon.com/ for updates. The second response, from a support agent who took over the case, did not address Amazon Linux 2023 at all.
The agent confirmed that CVE-2026-109618 and CVE-2026-109619 affect the PHP interpreter in branches 8.2 through 8.5 at default configuration. The issues can allow an unauthenticated remote actor to crash PHP worker processes. AWS said the reachable scenarios are narrow and assessed as difficult to leverage in practice.
AWS said it will incorporate the PHP fix into Elastic Beanstalk and Lightsail. Elastic Beanstalk mitigation is being introduced on the latest platform version, and running environments will be updated automatically during their maintenance window through Managed Platform Updates. Lightsail will build the fix for new blueprints. The support response did not give a timeline for Amazon Linux 2023 users.
The discussion on Hacker News drew reactions from several users, reflecting interest in how quickly cloud providers respond to PHP vulnerabilities affecting their customers.
Source: Hacker News · Summarized by HeadlinesBriefing