Repository issue #1148 was opened on 21 October 2026 after PHP published a security update for CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities carry a CVSS v4.0 score of 9.2 and a Critical severity rating.

terminal
dnf update -y php8.2

AWS support said the flaws affect PHP 8.2 through 8.5 under the default configuration. An unauthenticated remote actor could crash PHP worker processes, although AWS described the reachable cases as narrow and difficult to exploit in practice.

Amazon Linux Security Center lists both CVEs as Important. That differs from the Critical classification used in PHP's release context and other public assessments. An Amazon Linux maintainer pointed to differences between scoring systems and distributions, but provided no separate technical rating.

AWS initially gave customers no delivery date. Security bulletin 2026-143 later set 22 October 2026 as the target for updated Amazon Linux PHP packages. No Amazon Linux 2023 package was available in the issue discussion at that point.

AWS said the latest Elastic Beanstalk platform already includes a mitigation. Managed Platform Updates can move running environments to that platform during the selected maintenance window, and customers without the feature must update the platform themselves. Lightsail planned to build the fix into new blueprints.

One community workaround built PHP 8.2.35 and placed a local repository with its configuration in S3. The files were then deployed to servers via Systems Manager, using the command `dnf update -y php8.2`. This was a custom package path, not the official Amazon Linux update.