James Galley Software engineer - custom software & AI automation for SMEs

PHP2Shell crib sheet: patching PHP on AWS

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) crib sheet: the fixed PHP versions, how to patch PHP on Elastic Beanstalk, EC2 and containers on AWS, and what to do if you can't patch yet.

PHP2Shell (CVE-2026-109618 and CVE-2026-109619): two critical PHP vulnerabilities allowing unauthenticated remote code execution, affecting every supported PHP version. Fix: update to the patched release for your branch.

Which PHP versions fix it?

Released by PHP on 21 October 2026.

PHP branchFixed versionElastic Beanstalk platform
8.58.5.124.13.13, 21 October 2026
8.48.4.274.13.13, 21 October 2026
8.38.3.364.13.13, 22 October 2026
8.28.2.354.13.13, 22 October 2026

PHP 8.1 and older: no release, source backports only. Upgrade.

How do I patch Elastic Beanstalk?

  • Update to platform 4.13.13 (managed platform update or eb upgrade). Release notes: PHP 8.4 and 8.5, PHP 8.2 and 8.3.
  • 4.13.12 is not the fix. It only turns session.upload_progress.enabled off; PHP is unchanged.
  • Verify with php -v on an instance. A green deploy proves nothing.

How do I patch EC2?

  • Amazon Linux 2023: sudo dnf upgrade --releasever=latest "php8.4*" (swap in your branch). Fixed packages for php8.2 to php8.5 were published on 22 October 2026 (ALAS). Without --releasever=latest, dnf stays on the release the AMI was built from and finds nothing.
  • Amazon Linux 2: the php8.2 extra is fixed, the core php package is not. Amazon Linux 2 reached end of support on 30 June 2026, so migrate.
  • Amazon Linux 2023 php8.1: no fix planned. Upgrade.
  • Other distributions: update from your distribution's packages. php.net notes the third-party Remi repository was not updated on release day.
  • Restart PHP-FPM or Apache afterwards. Running workers keep the old version.
  • Verify the version the web server is running (php-fpm -v, or PHP_VERSION from a request), not just php -v. The CLI and the web server can differ.
  • Auto Scaling groups: rebuild the AMI and update the launch template, or new instances come up unpatched.

How do I patch containers on ECS?

  • Rebuild on a base image with the fixed PHP. Pin it by exact version tag or digest, not a floating tag.
  • Vendor images lag php.net by hours: php.net, then the official php image, then the vendor image. yiisoftware/yii2-php took about five and a half hours.
  • Verify with php -v on the running task (ECS Exec), not the tag.

What if I can't patch yet?

  • Apply the interim settings from the PHP security announcement, e.g. session.upload_progress.enabled = 0 and a low post_max_size. Set them in php.ini or the FPM pool, not ini_set(), and restart every worker.
  • Add AWSManagedRulesPHPRuleSet to the AWS WAF web ACL.
  • Can't do either? The NCSC says consider taking it offline until patched.

Gotchas

  • A dnf upgrade --releasever=latest prebuild hook can patch PHP 8.2 and 8.3 on Elastic Beanstalk ahead of AWS. On PHP 8.4 it silently does nothing: the platform installs its own unversioned php-* packages.
  • Yii 2 DateValidator rejects non-ASCII dates ("März") on PHP 8.4.27 and 8.5.12 (yiisoft/yii2#21120). Fixed on master, not yet released.
  • PHP 8.2 is end of life on 31 December 2026. Plan the move to a newer platform.

Need a hand patching a PHP application on AWS? Get in touch.