PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
Bulletin ID: 2026-143-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 14:30 PM PDT Summary: Two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) allow an unauthenticated remote actor to execute code, access process-accessible data, or cause denial of service on affected PHP workers. Customers running affected PHP versions (8.2–8.5 below the fixed releases, and end-of-life 5.4–8.1) should upgrade immediately to a patched release (8.5.12, 8.4.27, 8.3.36, or 8.2.35); configuration changes alone are not complete mitigations. AWS has identified a limited set of services that run affected PHP versions and is actively deploying mitigatio
Read at AWS Security Bulletins
- Vendor
- Amazon Web Services, PHP
- Product
- PHP
- EPSS
- 1.00 (p100)
- Fix
- not yet available
- Exposure class
- Web platform
Why it ranks 46 (High)
- EPSS 1.00 (high probability of exploitation)
- Product class: web platform
- Widely deployed vendor product (Amazon Web Services)
- Covered by 34 independent sources
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- AWS Security Bulletins (aws.amazon.com)
- CVE-2026-109618 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-109619 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.