Products and stacks · Hosting platforms and server managers

PHP2Shell in Amazon Linux and AWS: is it affected and how to fix it

Quick verdict

Affected; a fix exists for some versions or components only.

Vendor status: Partly fixed
PHP: AL2023 php8.2–8.5 · AL2 php
Last checked: 2026-10-22

AWS bulletin 2026-143-AWS (last updated 21 October, 20:30 PDT): AWS services are not impacted, but affected PHP you run on them can be. Amazon Linux: updated PHP packages are available for commercial regions, non-commercial regions targeted for 22 October; core PHP on Amazon Linux 2 and php8.1 on Amazon Linux 2023 are marked No Fix Planned. Elastic Beanstalk: PHP platform v4.13.12 (21 October) addresses both CVEs, and a release with the upstream PHP fix is targeted for 22 October; without Managed Platform Updates, update the platform version yourself. Lightsail cannot be patched in place: create new instances from the updated blueprints and migrate. AWS WAF users: PHP managed rule group version 2.3 is now the default.

How to check the PHP version Amazon Linux and AWS uses

Run the command for your setup. A version at or above 8.2.35, 8.3.36, 8.4.27 or 8.5.12 in its branch is fixed; older branches are fixed only by a vendor build that says so.

dnf updateinfo list --security | grep php
rpm -qa 'php*'

The command-line php can differ from the PHP that serves the site. To be sure, check the web SAPI (a temporary phpinfo() page behind authentication, or the panel's PHP settings) and remove it afterwards. Our version checker compares a version number for you.

🔎 Got a version number? Paste it into the PHP2Shell checker →

How to fix PHP2Shell in Amazon Linux and AWS

Debian/Ubuntu: sudo apt-get update && sudo apt-get install --only-upgrade 'php8.3*' (repeat for each installed PHP version).
RHEL/Alma/Rocky/Amazon Linux: sudo dnf upgrade 'php*'.
Restart PHP: sudo systemctl restart php8.3-fpm (or php-fpm), and fully restart Apache if it uses mod_php; a graceful reload is not enough.
Distributions often backport the fix without changing the PHP version, so compare the package version or changelog with the vendor's advisory.

Prefer to let an AI agent do the checks? Check if you are affected · Fix with an AI agent

If you cannot patch yet

Set session.upload_progress.enabled = 0 where applications cannot override it (php.ini, php_admin_value in the FPM pool or Apache config), and restart PHP.
On PHP 8.5, set fatal_error_backtraces = 0.
PHP's interim advice also covers memory_limit and a low post_max_size; follow the remediation page exactly, because these settings only reduce some paths.
Restrict access (VPN, IP allowlist) or take the service offline if it runs PHP 8.1 or older with no vendor backport. WAF rules help but are not a fix.

FAQ

Is Amazon Linux and AWS affected by PHP2Shell?

Affected; a fix exists for some versions or components only. AWS bulletin 2026-143-AWS (last updated 21 October, 20:30 PDT): AWS services are not impacted, but affected PHP you run on them can be. Amazon Linux: updated PHP packages are available for commercial regions, non-commercial regions targeted for 22 October; core PHP on Amazon Linux 2 and php8.1 on Amazon Linux 2023 are marked No Fix Planned. Elastic Beanstalk: PHP platform v4.13.12 (21 October) addresses both CVEs, and a release with the upstream PHP fix is targeted for 22 October; without Managed Platform Updates, update the platform version yourself. Lightsail cannot be patched in place: create new instances from the updated blueprints and migrate. AWS WAF users: PHP managed rule group version 2.3 is now the default.

Does updating Amazon Linux and AWS itself fix CVE-2026-109618 and CVE-2026-109619?

Only if the update contains fixed PHP. PHP2Shell is a flaw in the PHP interpreter, so what matters is the PHP that Amazon Linux and AWS runs on. Check the version after updating.

Which PHP versions fix PHP2Shell?

PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, released 21 October 2026. PHP 8.1 and older get no release from the PHP project; only vendor builds with a backport (or a self-built source patch for 7.4, 8.0 and 8.1) fix them.

What if Amazon Linux and AWS has no fix yet?

Keep its PHP-based web interface off the internet (VPN or IP allowlist), apply PHP's interim settings such as disabling session upload progress, and install the vendor update as soon as it ships. Interim settings reduce risk but are not a fix.

← All products that bundle PHP

Sources

Outbound links leave this site. We do not host exploit code.

Unofficial summary of public sources. This site is not affiliated with the vendor or the PHP project and hosts no exploit code.