PHP2Shell on AWS: WAF Rules, Beanstalk, Lightsail and Amazon Linux

AWS published security bulletin 2026-143-AWS for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on October 21, 2026. It says AWS services are not affected, but PHP that you run on AWS is. There is no managed AWS WAF rule for PHP2Shell yet, so you have to add protection yourself.

PHP2Shell AWS WAF rules: what AWS recommends

As of October 21, 2026, the AWS Managed Rules changelog had no new entry for PHP2Shell. The newest PHP rule group version was still 2.2 from March 2026, and neither the Known Bad Inputs nor the Core rule set had gained a PHP2Shell rule. Copy the custom rule from the official AWS bulletin rather than from third-party sites.

How to add the PHP2Shell protection in AWS WAF

1. Open your web ACL: AWS WAF console, then protection packs (web ACLs), then the web ACL attached to your CloudFront distribution, load balancer or API.
2. Core rule set: if AWSManagedRulesCommonRuleSet is not added, add it from Add rules, Add managed rule groups. If it is, check that SizeRestrictions_BODY is not overridden to Count.
3. Custom rule: Add rules, Add my own rules, then paste the JSON from the bulletin into the rule JSON editor, at priority 0.
4. Test in Count mode first if you can, as AWS advises, to see whether real uploads or forms would be blocked. Then switch to Block.
5. Watch for the managed rule update. Subscribe to the AWS Managed Rules SNS topic in us-east-1. If you pinned AWSManagedRulesPHPRuleSet to a static version, move to the new version when it ships.

Capacity: the Core rule set uses 700 WCU, Known Bad Inputs 200 and the PHP rule set 100. A web ACL over 1,500 WCU costs extra.

What AWS WAF does not cover

• Direct traffic. WAF only inspects requests through CloudFront, Application Load Balancers, API Gateway, App Runner, Amplify and the other resources it can attach to. An EC2 or Lightsail instance reached on its public IP, or behind a Network Load Balancer, gets no WAF inspection.
• Large bodies on ALB. An Application Load Balancer only lets WAF inspect the first 8 KB of a request body. CloudFront and API Gateway default to 16 KB, configurable up to 64 KB.
• The vulnerability itself. AWS calls updating PHP the only complete fix.

PHP2Shell on Elastic Beanstalk

AWS says Elastic Beanstalk PHP platform version 4.13.12, released October 21, addresses both CVEs, and that environments with managed platform updates get it in their next maintenance window. Others must update the platform version manually. When we checked the platform history, the PHP 8.5 and 8.4 platforms on 4.13.13 shipped the fixed PHP 8.5.12 and 8.4.27, while the PHP 8.3 and 8.2 platforms still listed 8.3.35 and 8.2.34. AWS said a release with the upstream fix was planned for October 22, so check the version your environment reports.

PHP2Shell on Lightsail

AWS cannot update running Lightsail instances. Its Lightsail guide covers the WordPress, WordPress Multisite, LAMP and Nginx blueprints and any instance where you installed PHP:

1. Take a snapshot of the instance.
2. On Lightsail's own blueprints, run sudo apt update && sudo apt upgrade, then restart Apache or PHP-FPM and confirm with php -v.
3. On Bitnami blueprints, PHP lives in /opt/bitnami/php and is not updated by apt. AWS recommends moving to a Lightsail blueprint.

Amazon Linux PHP2Shell packages

On Amazon Linux 2 run sudo yum update php; on Amazon Linux 2023 run sudo dnf upgrade. Then restart PHP-FPM or Apache. For other distributions see Ubuntu, Debian and RHEL.

Attacks seen by AWS

Amazon's threat intelligence team reported the first PHP2Shell attempt against its MadPot honeypots on October 17, 2026, four days before public disclosure, with more attempts on October 21. See is PHP2Shell exploited in the wild for other reports, and Cloudflare and PHP2Shell for how Cloudflare's default rules compare.

PHP2Shell AWS FAQ