So is AWS gonna push a php update, or are we just YOLO-ing it now?
0 Boosts
1 Like
@jwz weird. https://explore.alas.aws.amazon.com/CVE-2026-109618.html and https://explore.alas.aws.amazon.com/CVE-2026-109619.html says they are fixed on 2026-10-22. I guess it's already the 22nd in some places?
Since AWS is feeling lackadaisical about all this... Is it believed that putting this in my php-fpm pools is sufficient?
; CVE-2026-109618
php_admin_value[memory_limit] = -1
php_admin_value[post_max_size] = 32M
php_admin_value[upload_max_filesize] = 16M
; CVE-2026-109619
php_admin_value[session.upload_progress.enabled] = 0
php_admin_value[max_file_uploads] = 20
php_admin_value[fatal_error_backtraces] = 0
Compiling php from scratch for the 10th time today so far, completely normal experience in a completely normal world
*taps headset* I am now being informed that I have compiled php 16 times since yesterday.
@jwz The best part for me is when it requested a newer zlib than the one installed, and then compiling that and pointing the environment vars to it (thanks pkg-config) did nothing. In the end I had to copy/paste the massive link commands from the console and manually add "--lz" to them and then continue make.
As you say, stellar experience.
@jwz I am also feeling very normal today. this is one of those days that being an insane person who is running my own protocol stack all the way down from OpenSSL feels pretty good though
@jwz these mitigation steps are slightly more effective than prayer.
I'm on number eight!
BENEATH THE PLANET OF THE APES Clip - "Warhead Worship" (1970)
YouTube
You have a duped php_admin_value[post_max_size].
You have upload_max_filesize being smaller than post_max_size if you use the 32M, so that all should be good to go with what you have.
Amazon just pushed out 2023.12.20261021 but it does *not* fix CVE-2026-109618 and CVE-2026-109619 so that's cool, cool. No hurry, guys. https://explore.alas.aws.amazon.com