From GitHub · · 1m 30s
Amazon Linux 2023 PHP Security Update for Critical CVEs
Amazon Linux 2023 releases PHP patches for two critical security vulnerabilities.
In brief
Amazon Linux 2023 releases PHP patches for two critical security vulnerabilities. Amazon Linux 2023 updates PHP to fix CVE-2026-109618 and CVE-2026-109619 security flaws. Originally reported by GitHub.
Critical PHP Security Update
Amazon Linux 2023 PHP versions need urgent update for two critical CVEs.
CVE Details
CVE 2026-109618 and CVE-2026-109619 rated CVSS v4.0 9.2.
Update Request
PHP released critical security update on Oct 21, 2026.
AWS Response
AWS team confirmed active work on delivering PHP updates.
Community Reaction
Over 50 users reacted to update timeline request.
Update Availability
PHP patch available via AWS security advisories.
Elastic Beanstalk Fix
Elastic Beanstalk platform updated to version 4.13.13.
Lightsail Update
AWS Lightsail will build fix for new blueprints.
User Workaround
Users run sudo yum upgrade php -y to update PHP versions.
Inspector Detection
Amazon Inspector not showing findings for these CVEs.
Timeline Progress
Update available by Oct 22, 2026 for Amazon Linux 2023.
Security Concerns
Incomplete mitigations in PHP 8.2.24 versions.
Patch Resolution
Amazon Linux 2023 PHP updated to fix critical security flaws.
Community Support
Users thanked AWS for security patch release.
Next Steps
Customers must update PHP versions via dnf metadata.
Final Update
Issue closed as resolved on Oct 22, 2026.
Here's the gist
Amazon Linux 2023 updates PHP to fix CVE-2026-109618 and CVE-2026-109619 security flaws.
