So is AWS gonna push a php update, or are we just YOLO-ing it now?
0 Boosts
1 Like
@jwz weird. https://explore.alas.aws.amazon.com/CVE-2026-109618.html and https://explore.alas.aws.amazon.com/CVE-2026-109619.html says they are fixed on 2026-10-22. I guess it's already the 22nd in some places?
Since AWS is feeling lackadaisical about all this... Is it believed that putting this in my php-fpm pools is sufficient?
; CVE-2026-109618
php_admin_value[memory_limit] = -1
php_admin_value[post_max_size] = 32M
php_admin_value[upload_max_filesize] = 16M
; CVE-2026-109619
php_admin_value[session.upload_progress.enabled] = 0
php_admin_value[max_file_uploads] = 20
php_admin_value[fatal_error_backtraces] = 0
Compiling php from scratch for the 10th time today so far, completely normal experience in a completely normal world
@jwz these mitigation steps are slightly more effective than prayer.
I'm on number eight!
BENEATH THE PLANET OF THE APES Clip - "Warhead Worship" (1970)
YouTube
You have a duped php_admin_value[post_max_size].
You have upload_max_filesize being smaller than post_max_size if you use the 32M, so that all should be good to go with what you have.
Amazon just pushed out 2023.12.20261021 but it does *not* fix CVE-2026-109618 and CVE-2026-109619 so that's cool, cool. No hurry, guys. https://explore.alas.aws.amazon.com