Amazon Web Services

Amazon Linux

Response status

Patched packages available

Response information checked

2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Fixed packages cover AL2023 PHP 8.2–8.5, AL2 Php8.2 Extra and AL2027 Preview php8.5. AL2023 PHP 8.1 and AL2 Core php have no planned fix.

What users should do

Apply the update for your OS and PHP stream; migrate streams with no planned fix.

Official service URL

• https://aws.amazon.com/

Source URLs

1. Amazon Linux: CVE-2026-109618https://explore.alas.aws.amazon.com/CVE-2026-109618.htmlResponse evidence
2. Amazon Linux: CVE-2026-109619https://explore.alas.aws.amazon.com/CVE-2026-109619.htmlResponse evidence
3. ALAS2023-2026-3301https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3301.htmlResponse evidence
4. https://aws.amazon.com/security/security-bulletins/2026-143-aws/https://aws.amazon.com/security/security-bulletins/2026-143-aws/Service and operation documentation

Amazon EMR (Ganglia)

Response status

Action required

Response information checked

2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

EC2 releases 4.2.0–6.15.0 with Ganglia are affected.

Scope: EKS, Serverless and 7.x+ excluded.

What users should do

Omit Ganglia or migrate to 7.x.

Source URLs

1. https://aws.amazon.com/security/security-bulletins/2026-143-aws/https://aws.amazon.com/security/security-bulletins/2026-143-aws/Response evidence

Amazon WorkMail

Response status

Patched

Response information checked

2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

PHP upgraded to 8.3.36.

Scope: WorkMail only.

What users should do

No customer action.

Source URLs

1. https://aws.amazon.com/security/security-bulletins/2026-143-aws/https://aws.amazon.com/security/security-bulletins/2026-143-aws/Response evidence

AWS Elastic Beanstalk (PHP)

Response status

Updates available

Response information checked

2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Updated PHP 8.2–8.5 platforms available.

Scope: Automatic installation uses the next maintenance window.

What users should do

Enable managed updates or update manually.

Source URLs

1. https://aws.amazon.com/security/security-bulletins/2026-143-aws/https://aws.amazon.com/security/security-bulletins/2026-143-aws/Response evidence

AWS Lambda (custom PHP)

Response status

Customer update

Response information checked

2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

No managed PHP runtime.

Scope: Customer-installed PHP.

What users should do

Patch and redeploy custom runtimes/containers.

Source URLs

1. https://aws.amazon.com/security/security-bulletins/2026-143-aws/https://aws.amazon.com/security/security-bulletins/2026-143-aws/Response evidence

Amazon Lightsail (PHP)

Response status

Updated blueprints

Response information checked

2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Available in all regions.

Scope: Existing instances are not automatically patched.

What users should do

Create new instances and migrate applications.

Source URLs

1. https://aws.amazon.com/security/security-bulletins/2026-143-aws/https://aws.amazon.com/security/security-bulletins/2026-143-aws/Response evidence

AWS WAF (PHP rules)

Response status

Mitigation

Response information checked

2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Default rules update automatically.

Scope: WAF does not replace patching.

What users should do

Update pinned versions and patch PHP.

Source URLs

1. https://aws.amazon.com/security/security-bulletins/2026-143-aws/https://aws.amazon.com/security/security-bulletins/2026-143-aws/Response evidence