[Package Update Request] – PHP CVE 2026-109618 and CVE-2026-109619 · Concern #1148 · amazonlinux/amazon-linux-2023 · GitHub

I contacted assist; we’ve enterprise+ and bought these unsatisfactory responses (the second would not even deal with AL2023):

Our service staff is conscious of the reported problem and is actively engaged on it.
There isn’t any particular ETA obtainable in the meanwhile; nevertheless, updates can be printed on our public CVE pages at https://explore.alas.aws.amazon.com/ as soon as obtainable.
We advocate monitoring the advisories as soon as launched and evaluating the influence primarily based in your particular surroundings.

and

Thank you on your persistence. My title is redacted and I’ve taken over your case from my colleague.

We are conscious of CVE-2026-109618 and CVE-2026-109619, which have an effect on PHP interpreter. These points have an effect on PHP branches 8.2 by means of 8.5 at default configuration and might enable an unauthenticated distant actor to crash PHP employee processes. We can affirm that the reachable eventualities are slender and assessed as tough to leverage in observe.

AWS will incorporate the repair launched by PHP to the next affected companies:

AWS Elastic Beanstalk: ElasticBeanstalk mitigation is launched on the most recent platform model. Customers with working environments can be mechanically up to date to the most recent platform model within the chosen upkeep window by means of Managed Platform Updates. No motion is required to replace to the most recent model. Customers who haven’t enabled Managed Platform Updates can replace their surroundings’s platform model by following our documentation [1].

AWS Lightsail: AWS Lightsail will consider and construct the repair for brand spanking new Lightsail blueprints so prospects can incorporate the repair.

If you’ve got questions or considerations, please comply with up on this assist case.

[1] https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.platform.upgrade.html