Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
MentionsAmazon Web Services
October 23, 2026-2: The PHP project disclosed CVE-2026-115560, a separate remote code execution issue that the October 21 releases don’t fix. It affects only applications with an uncommon configuration that keeps session upload progress enabled. The PHP2Shell_BODY rule in the PHP application managed rule group, version 2.4 and later, already blocks POST requests that carry […]
Summary from AWS Security Blog.
Explained
The technology and terms in this story. Learn more
- DefenceWAF · Web application firewallA filter in front of a website that blocks malicious requests such as SQL injection attempts.
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.
- TechnologyPHPA programming language that powers a large share of websites, including WordPress.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.
