AWS releases WAF rules to buy time against two critical unauthenticated PHP RCE bugs
In short: On October 21, 2026, PHP maintainers pushed out urgent patches for two critical flaws, nicknamed PHP2Shell together, that let an attacker run code on a server without logging in. Both carry a CVSS v4.0 score of 9.2 and sit in how PHP processes multipart file-upload requests before application code even runs. Patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and AWS has since published AWS WAFv2 rule templates plus host-level settings that shrink the attack surface for teams that need time to roll out the upgrade. AWS is clear that the firewall rules only help at the edge — they cannot fully close one of the two bugs, so patching remains mandatory.
This summary was generated automatically by AI from AWS Security's publication. It is our own text, not a copy of the original — facts, figures and quotes belong to the source, linked above and below.
What changed?
- 1CVE-2026-109618: memory corruption when PHP runs out of memory mid-request while parsing multipart bodies.
- 2CVE-2026-109619: one request can leave behind leftover internal state that gets picked up by a different request handled by the same PHP process.
- 3Both bugs rated CVSS v4.0 9.2 (Critical) and exploitable without authentication.
- 4Fixes shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and older are no longer maintained upstream, so vendor-backported fixes or an upgrade path are needed there.
- 5AWS WAF example rule: block a request only when it is a POST, carries a PHPSESSID cookie or body value, and also contains the PHP_SESSION_UPLOAD_PROGRESS field.
- 6Optional stricter rule: block all multipart/form-data traffic outright on applications that have no legitimate file-upload feature.
- 7Additional WAF options: cap maximum request body size and rate-limit POST requests per IP to blunt exploitation attempts.
- 8Recommended server-side settings alongside WAF: memory_limit=-1, tighter post_max_size, fatal_error_backtraces=0, session.upload_progress.enabled=0, and pm.max_requests=1 to recycle worker processes after each request.
Why it matters
Any internet-facing server running PHP — including CMSs, custom web apps, or admin panels tied into call-center or CRM back ends — is a potential target until patched, since no login is required to trigger the bug. Firewall rules reduce risk during the patch window but don't replace upgrading PHP, and one of the two flaws partly escapes WAF visibility entirely because it depends on internal process memory reuse rather than anything the firewall can inspect.
What it means for AI agents and contact centers
If any part of the voice AI or contact-center stack runs PHP (dashboards, CRM connectors, web portals, or admin tools), check PHP versions immediately and prioritize upgrading to 8.5.12/8.4.27/8.3.36/8.2.35. Where upgrading takes time, deploying the AWS WAF rules described here — blocking the POST+PHPSESSID+PHP_SESSION_UPLOAD_PROGRESS combination, capping body size, and rate-limiting POSTs — can reduce exposure, but should be treated as a stopgap, not a fix, especially for apps that rely on file uploads.
Sources
- AWS SecurityOfficialPrimary sourceOriginal article →„Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619)“22 Oct 2026, 03:50
- Published by source
- 22 Oct 2026, 03:50
- Found by our system
- 22 Oct 2026, 03:56
- Summary generated
- 22 Oct 2026, 03:58
This article was written by AI from the original source. Facts, numbers and prices come from the source; missing values are marked “Not specified”. Legal notice, copyright and privacy