[Package Update Request] - PHP CVE 2026-109618 and CVE-2026-109619

Activityalexey-tsvetnov commented on Oct 21, 2026 Member@MrTschi, thanks for reporting! We are aware of those Critical CVEs and actively working on delivering an update asap.Reacted by MrTschi, seunghyeong-kim, Aaron Parker, Aprian, t2-yoshida, Aled Parry, Ant Weedon, Thijs Gillebaart, luis-grasple, st-man-hori and 39 moreReacted by cAstraea, Thijs Gillebaart, Sarina Corrigan, pathwaynavigator, dylan-kramer and Gonzalo Romerocornevandersteen commented on Oct 21, 2026 Reacted by Ant Weedon, dowan-sourcetel, Andy Palmer, p24-max, RavianXReaver, m1cka, luis-grasple, dominic-lear, Dennes Meeusen, Phong Hoang and 8 moreReacted by bashartman, dowan-sourcetel, seancarnahan1, RavianXReaver, Victor Rosenberg, m1cka, dominic-lear, KIM SOYEON, Dennes Meeusen, Phong Hoang and 3 moreReacted by Ben, dominic-lear, Dennes Meeusen and Gonzalo Romerop24-max commented on Oct 21, 2026 Reacted by Andy Davies, Ant Weedon, Devzzm, Matt, dowan-sourcetel, Andrew Shuttleworth, YukiMatsuhisa, rsaf, dylan-kramer, Oli Norwell and 3 moreReacted by dowan-sourcetel, Ben, m1cka, luis-grasple, dominic-lear, rudyzeinoun, RavianXReaver, Aizawa Yu, throwaway8787, Kentaro Saida and 17 morekuusas commented on Oct 21, 2026 Reacted by Axel Rindle, RavianXReaver, edgar-accredify, dowan-sourcetel, Dennes Meeusen, Andrew Shuttleworth, Michael Bannach, John F. and TomasReacted by RavianXReaver, p24-max, edgar-accredify, PhoenixClaw, Christoph Filnkößl, Oleksandr Davyskyba, dowan-sourcetel, Victor Rosenberg and louaikrRavianXReaver commented on Oct 21, 2026 Hopefully this gets patched ASAP 🙏Reacted by dowan-sourcetel, Dennes Meeusen, Clworld, Gonzalo Romero and Tomasdevzzm commented on Oct 21, 2026 This really isn't acceptable for a major security issue that supposedly was delivered to Amazon days agoReacted by charitharo, Dave Smith-Hayes, Matt, danielcmm, James Macintyre, Dennes Meeusen, John Daniel Maguire, Tom Stack, Patrick Barabe, Nicolas Pellegrin and 9 moreReacted by RavianXReaver, Ben, dowan-sourcetel, Andrew Shuttleworth and Jason TrumpiocAstraea commented on Oct 21, 2026 PLEASEtallandy commented on Oct 21, 2026 @alexey-tsvetnov can you at least give an approximate timeline as to when this will be available over dnf updates?Reacted by Ben, Devzzm, Timothy Maclean, Victor Rosenberg, Andrew Shuttleworth, Paul Singh, Oli Norwell, Gonzalo Romero, Petro Mäntylä, Tammie and 2 moredsh-mabel commented on Oct 21, 2026 @alexey-tsvetnov I am also requesting an estimated timeline for the patch to be released.Reacted by Andy Davies, Andrew Shuttleworth and Patrick BarabeRavianXReaver commented on Oct 21, 2026 Reacted by Andy Davies, danielcmm, Andrew Shuttleworth and Petro Mäntylädanielcmm commented on Oct 21, 2026 News??mbuk commented on Oct 21, 2026 I contacted support; we have business+ and got these unsatisfactory responses (the second one doesn't even address AL2023): Our service team is aware of the reported issue and is actively working on it. There is no specific ETA available at the moment; however, updates will be published on our public CVE pages at https://explore.alas.aws.amazon.com/ once available. We recommend monitoring the advisories once released and evaluating the impact based on your specific environment. and Thank you for your patience. My name is redacted and I have taken over your case from my colleague. We are aware of CVE-2026-109618 and CVE-2026-109619, which affect PHP interpreter. These issues affect PHP branches 8.2 through 8.5 at default configuration and can allow an unauthenticated remote actor to crash PHP worker processes. We can confirm that the reachable scenarios are narrow and assessed as difficult to leverage in practice. AWS will incorporate the fix released by PHP to the following affected services: AWS Elastic Beanstalk: ElasticBeanstalk mitigation is introduced on the latest platform version. Customers with running environments will be automatically updated to the latest platform version in the selected maintenance window through Managed Platform Updates. No action is required to update to the latest version. Customers who have not enabled Managed Platform Updates can update their environment's platform version by following our documentation [1]. AWS Lightsail: AWS Lightsail will evaluate and build the fix for new Lightsail blueprints so customers can incorporate the fix. If you have questions or concerns, please follow up on this support case. [1] https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.platform.upgrade.html Reacted by Andy Davies, Dave Smith-Hayes, dowan-sourcetel, RavianXReaver, charitharo, Panda_Program, Clworld, Andrew Shuttleworth, Gonzalo Romero and Petro MäntyläReacted by MrTschi, dowan-sourcetel, Ben, RavianXReaver and Gonzalo Romerodsh-mabel commented on Oct 21, 2026 @mbuk thank you for contacting support - a real shame it wasn't a human who responded and that the answer was so lacklustre. Keeping an eye on this thread and routinely updating dnf metadata in the meantime.Reacted by Mattmbuk commented on Oct 21, 2026 13. @mbuk thank you for contacting support - a real shame it wasn't a human who responded and that the answer was so lacklustre. Keeping an eye on this thread and routinely updating dnf metadata in the meantime. It was a human I spoke to - those are excerpts from the chat logs - very disappointingReacted by Dave Smith-Hayes, Dennes Meeusen, Victor Rosenberg and Andrew Shuttleworthwikando-ck commented on Oct 21, 2026 It absolutely sucks that 4.13.12 was released just prior to the PHP release and only includes the incomplete mitigations based on settings. This is absolutely misleading and devops that run an update of this will think they have fixed the issue. This will lead to exploits. It might have been released with good will, but this cannot be it folks.Reacted by Dennes Meeusen, Dave Smith-Hayes, gofunz, RavianXReaver, Bård Kalbakk, matthiasPOE, Matt, MrTschi, cAstraea, Isao Teranishi and 8 moreReacted by seth123-jax, Dennes Meeusen, Matt and Ben88 remaining itemsolinorwell commented on Oct 21, 2026 The problem we have here is that this has hit the mainstream news cycle, people are asking me "have they fixed it yet?", and all I can say "yes, but Amazon haven't yet let us update the server". People are confused - the fix is there - but somehow I can't install it. I guess I'm even confused at this point! If this genuinely isn't going to be available on AL2023 for several days, it makes it an entirely unsuitable distro for a production server. For years AWS have pushed AL as the 'recommended option', but now I'm wishing I was on anything but this. All I think we need is an update - either, yes it's coming today, or no we don't consider it that much of an issue... if it's the latter, then it's going to be hard to explain to others why we are using AL2023. Fingers crossed for an update in the next hour or two.Reacted by 01PC-Felix, Alasdair North, Mats Karstad, Joe P, Carlos Aragon, Nick Haynes, Ben, Charles Fulton, Aled Parry, Max Solomon and 8 more01PC-Felix commented on Oct 21, 2026 Yeah. I m really thinking to move away from AWS if they really think thats how things work and they dont care anymore... why would we stay?riebecj commented on Oct 21, 2026 32. The problem we have here is that this has hit the mainstream news cycle, people are asking me "have they fixed it yet?", and all I can say "yes, but Amazon haven't yet let us update the server". People are confused - the fix is there - but somehow I can't install it. I guess I'm even confused at this point! If this genuinely isn't going to be available on AL2023 for several days, it makes it an entirely unsuitable distro for a production server. For years AWS have pushed AL as the 'recommended option', but now I'm wishing I was on anything but this. All I think we need is an update - either, yes it's coming today, or no we don't consider it that much of an issue... if it's the latter, then it's going to be hard to explain to others why we are using AL2023. Fingers crossed for an update in the next hour or two. The PHP team released a fix for impacted minor versions as source code. They don't manage package repositories. Someone on the ALinux2023 team has to take the source code, build the RPMs for the patched version, validate the RPMs (if they're doing it correctly), and only THEN can they publish it to their repos for you to dnf update .... This is the same for all package repos, but some have source watchers and build automation so new releases are minutes behind source release. That being said, two kind individuals posted scripts as workarounds to patch production servers while you wait for the real in-repo RPMs to be released.maxsolomon14 commented on Oct 21, 2026 Reacted by ethankinnon97, Andrew Lee, Gonzalo Romero and Mitch Musarraalexey-tsvetnov commented on Oct 21, 2026 Member@tedg , did you really just come in here to say that 20 days != 30 days for something we are all expecting a fix for within hours and leave without an ETA? Are you trolling? Would you be happier if I was just silent? ;) I'm glad there are still people like @RavianXReaver, who seems to understand how the "machine" works.aleeeftw commented on Oct 21, 2026 Not here to complain but I am running out of beers.Reacted by Max Solomon, jlangf123, Anonymoussaurus and realmusterriebecj commented on Oct 21, 2026 I switched to whiskey hours ago...Reacted by Anonymoussaurus, jlangf123, realmuster and Elminson De Oleo Baezmackensen commented on Oct 21, 2026 Would you be happier if I was just silent? ;) I'm glad there are still people like [@RavianXReaver](https://github.com/RavianXReaver), who seems to understand how the "machine" works.