PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
Summary
AWS security bulletin PHP web runtimes CVE-2026-109618 and CVE-2026-109619 detail two remote code execution vulnerabilities affecting multiple PHP versions. The advisory notes AWS services are not impacted, lists affected PHP versions with first fixes, and provides mitigation guidance including upgrading, interim controls, and AWS WAF rules, along with a sample rule for CVE-109619.