So is AWS gonna push a php update, or are we just YOLO-ing it now?
0 Boosts
1 Like
@jwz weird. https://explore.alas.aws.amazon.com/CVE-2026-109618.html and https://explore.alas.aws.amazon.com/CVE-2026-109619.html says they are fixed on 2026-10-22. I guess it's already the 22nd in some places?
Since AWS is feeling lackadaisical about all this... Is it believed that putting this in my php-fpm pools is sufficient?
; CVE-2026-109618
php_admin_value[memory_limit] = -1
php_admin_value[post_max_size] = 32M
php_admin_value[upload_max_filesize] = 16M
; CVE-2026-109619
php_admin_value[session.upload_progress.enabled] = 0
php_admin_value[max_file_uploads] = 20
php_admin_value[fatal_error_backtraces] = 0
Compiling php from scratch for the 10th time today so far, completely normal experience in a completely normal world
@jwz I am also feeling very normal today. this is one of those days that being an insane person who is running my own protocol stack all the way down from OpenSSL feels pretty good though
@jwz these mitigation steps are slightly more effective than prayer.
I'm on number eight!
BENEATH THE PLANET OF THE APES Clip - "Warhead Worship" (1970)
YouTube
You have a duped php_admin_value[post_max_size].
You have upload_max_filesize being smaller than post_max_size if you use the 32M, so that all should be good to go with what you have.
Amazon just pushed out 2023.12.20261021 but it does *not* fix CVE-2026-109618 and CVE-2026-109619 so that's cool, cool. No hurry, guys. https://explore.alas.aws.amazon.com