early signals AWS security bulletins infra

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

// summary

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution or denial of service on affected workers.

// from the source

Bulletin ID: 2026-143-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 14:30 PM PDT Summary: Two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) allow an unauthenticated remote actor to execute code, access process-accessible data, or cause denial of service on affected PHP workers. Customers running affected PHP versions (8.2–8.5 below the fixed releases, and end-of-life 5.4–8.1) should upgrade immediately to a patched release (8.5.1
Read at aws.amazon.com ↗ More from AWS security bulletins

# more from AWS security bulletins

  1. AWS security bulletins

    CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server

    aws.amazon.com
  2. AWS security bulletins

    CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server

    aws.amazon.com
  3. AWS security bulletins infra

    CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server

    aws.amazon.com
  4. AWS security bulletins

    CVE-2026-87911

    aws.amazon.com
  5. AWS security bulletins infra

    CVE-2026-85788 - Issue with awslabs mysql-mcp-server

    aws.amazon.com