AWS WAF Strengthens Defenses Against Critical PHP2Shell RCE Vulnerabilities

On October 21, 2026, the PHP project released emergency fixes for two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. These vulnerabilities, rated 9.2 (Critical) under CVSS v4.0, allow unauthenticated attackers to execute arbitrary code on vulnerable servers. AWS has responded by updating its Web Application Firewall (WAF) PHP application managed rule group to version 2.3, which now includes the `PHP2Shell_BODY` rule specifically designed to detect and block exploitation attempts for CVE-2026-109619. This rule has been made the default version globally, providing immediate protection for many AWS WAF users. This development is significant for any organization running PHP applications on AWS. While patching PHP to the fixed versions (8.5.12, 8.4.27, 8.3.36, and 8.2.35) remains the only complete solution, the AWS WAF update offers a critical window of protection. The time it takes to inventory PHP deployments, schedule maintenance windows, and thoroughly test applications against new PHP builds can be substantial. During this period, the updated WAF rules act as a crucial virtual patch, reducing the immediate attack surface and buying valuable time for security teams. This is particularly important given that Amazon Threat Intelligence detected exploitation attempts of PHP2Shell even before public disclosure. The broader trend in cloud security emphasizes a multi-layered defense strategy. While secure coding practices and timely patching are foundational, edge protection services like WAF are increasingly vital for mitigating zero-day exploits and providing immediate response capabilities. This update aligns with the industry's move towards more proactive and integrated security measures, where cloud providers offer managed services to help customers defend against emerging threats. The rapid deployment of a WAF rule for a critical vulnerability demonstrates the agility required in today's threat landscape. In practice, practitioners should first verify that their AWS WAF web ACLs are utilizing the default version (2.3 or later) of the `AWSManagedRulesPHPRuleSet` to ensure the `PHP2Shell_BODY` rule is active. Even with WAF protection, the priority must remain on upgrading PHP to the patched versions as soon as possible, as WAF rules are not a complete remediation. Additionally, security teams should consider implementing custom WAF rules to further restrict multipart requests if not explicitly required by their applications, cap request body sizes, and rate-limit suspicious activity, as these can provide defense-in-depth against both PHP2Shell vulnerabilities. Monitoring web server logs for unusual activity and unexpected process execution on PHP application servers is also crucial during this period.