PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
hayd
113 points
26 comments
October 21, 2026
Related Discussions
Found 5 related stories in 111.9ms across 10,209 title embeddings via pgvector HNSW
- Critical Vulnerabilities in PHP defly · 21 pts · October 20, 2026 · 67% similar
- Potential third critical PHP CVE mpaepper · 64 pts · October 21, 2026 · 65% similar
- PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619) rfarley04 · 109 pts · October 21, 2026 · 59% similar
- Upcoming Critical PHP Security Release choult · 117 pts · October 20, 2026 · 58% similar
- Upcoming Critical PHP Security Release (CVSSv4 score of 9.2) kacy · 16 pts · October 20, 2026 · 58% similar
Discussion Highlights (7 comments)
hayd
We didn't get much information throughout the day, besides these comments by an AWS employee/Amazon Linux maintainer on this thread: https://github.com/amazonlinux/amazon-linux-2023/issues/1148... He referenced an nginx Important CVE taking 20 days to be patched - after it was noted that these PHP CVEs were also labelled by AWS as Important (not Critical). This employee took issue to another user's comment describing 20 days as "nearly a month". Amazon Linux users/AWS customers barely got any tangible information from the CVE publication at 14:00UTC until this bulletin was posted at 21:30UTC. Very disappointing.
mikeweiss
Amazon has a bad track record for delivering critical updates quickly. During the Copy Fail - CVE-2026-31431 event they were behind every major Linux distro in updating Bottlerocket OS
otterley
Patch releases are currently scheduled for tomorrow (October 22): https://aws.amazon.com/security/security-bulletins/2026-143-...
hayd
Update: After posting this Amazon security released a bulletin to say we should see the updates _some time tomorrow_. https://aws.amazon.com/security/security-bulletins/2026-143-... Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.
80fj0348i
Honest question: Does anyone actually use Amazon Linux in production? Everywhere I've every worked used a mainstream distro for cloud servers, like Debian, Ubuntu, Red Hat or SUSE.
pier25
sounds like they are trying to get rid of users of Amazon Linux honestly
HoyaSaxa
Poor showing from AWS especially since Wiz’s blog post explicitly mentions that AWS was given advance notice. But they did in fact release the updated Amazon Linux image about 15 minutes ago: https://github.com/amazonlinux/amazon-linux-2023/issues/1148...