Amazon Linux 2023 PHP patch may take 20 days as AWS rates flaws Important

What happened

A package update request filed on Amazon Linux 2023's GitHub repository is pressing AWS to ship patched PHP packages for CVE-2026-109618 and CVE-2026-109619, two vulnerabilities in the PHP interpreter. The request, which surfaced on Hacker News on October 21, 2026, quotes two AWS support replies that the filer describes as unsatisfactory — the second of which does not address Amazon Linux 2023 at all.

According to the issue, the filer holds a Business-level or above support plan. The first reply says the service team is aware and actively working on the issue, offers no specific ETA, and directs customers to monitor Amazon's public Linux security advisories and evaluate the impact for their own environments once updates are published.

What AWS says about the flaws

The second reply, quoted in the GitHub issue, confirms the CVEs affect PHP branches 8.2 through 8.5 in the default configuration and can allow an unauthenticated remote actor to crash PHP worker processes. AWS adds that the reachable scenarios are narrow and assessed as difficult to leverage in practice.

For its own hosted services, AWS outlined two fixes:

• Elastic Beanstalk: a mitigation ships in the latest platform version. Environments with Managed Platform Updates enabled will be upgraded automatically in their maintenance window; customers without the feature must update the platform version themselves.
• Lightsail: AWS will evaluate and build the fix into new blueprints so customers can adopt it.

Neither reply commits to a date for updated PHP packages in Amazon Linux 2023's own repositories.

A rating that stretches the timeline

The Hacker News item framing the issue argues the delay comes down to classification: because AWS rates the vulnerability as Important rather than Critical, the Amazon Linux 2023 patch may take up to 20 days. That timing and rating appear in the item's title rather than in AWS's quoted replies, which confirm neither a severity rating nor a patch window.

There is also a gap in how the bug is described. The Hacker News title characterises it as a remote code execution flaw, while AWS's support response describes the practical impact as unauthenticated actors crashing PHP worker processes — a denial-of-service outcome. Both accounts agree the flaw is remotely reachable without authentication in default configurations of PHP 8.2 through 8.5.

Why it matters

Amazon Linux 2023 users who install PHP from the distribution's own repositories depend on AWS to package and ship upstream fixes. If the 20-day window holds, those users would run a known, remotely reachable vulnerability in a supported package for weeks, with no ETA on record — the standard guidance to patch from your distribution's repositories offers no protection here.

The service-specific mitigations leave gaps as well. Elastic Beanstalk's automatic update covers only environments with Managed Platform Updates enabled, and the Lightsail work targets new blueprints, which does little for instances already running.

More broadly, the incident illustrates the risk of severity-driven patch timelines: a vendor's internal rating, not the upstream urgency, determines how quickly supported packages get fixed. Administrators running affected PHP versions on Amazon Linux 2023 may need to evaluate interim mitigations or apply upstream PHP releases themselves rather than wait for the advisory feed.