AWS and PHP2Shell

The statement

Read the statement on aws.amazon.com, dated Publication Date: 10/21/2026 14:30 PM PDT; Last Updated Date: 10/22/2026 14:00 PM PDT. Source type: official page.

Notes

Bulletin 2026-143-AWS, title: PHP web runtimes (CVE-2026-109618 and CVE-2026-109619). Amazon WorkMail upgraded to PHP 8.3.36: No customer action is required.; Elastic Beanstalk released updated PHP platform versions for 8.2 to 8.5 (automatic only with Managed Platform Updates); Updated PHP packages for commercial regions are available; non-commercial are targeted for 2026-10-22.; AWS cannot update running Lightsail instances in place.; AWS Lambda does not provide a managed PHP runtime.; EOL: No fix is available for CVE-2026-109618 on end-of-life branches. and Migration to a supported branch is required.; interim controls for EOL runtimes say to restart PHP workers. AWS WAF PHP Managed Rule Group as compensating control. quoted from https://aws.amazon.com/security/security-bulletins/2026-143-aws/

Change log

• 23 October 2026: first check

Submit a correction or your statement

Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.

Badge

The badge for AWS reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.

AWS's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about AWS and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.