23 October 2026 · Turing Websites
AWS PHP2Shell: Lightsail, EC2 & Beanstalk
Get PHP2Shell update help for AWS Lightsail, EC2 and Beanstalk. Check Bitnami, PHP packages and running workloads, then verify forms, bookings and checkout.
Request urgent PHP update helpIn short
PHP2Shell can affect customer applications running PHP on AWS. The update route depends on the workload: Lightsail blueprint, EC2 package, Beanstalk platform, container or Lambda custom runtime. A new image or package must reach the running application. Turing Websites can help apply supported updates, repair compatibility and verify customer actions.
Keep your AWS-hosted website taking enquiries, bookings and orders while PHP is updated. Turing Websites can help update a supported runtime, migrate a Lightsail site, fix compatibility faults and check the customer actions after deployment.
Get AWS PHP update help with the website URL, AWS service and runtime details you know. Our PHP security update service covers the hands-on website work.
Guidance checked: 23 October 2026. The AWS security bulletin was updated on 22 October. It distinguishes customer PHP workloads from AWS services themselves. This guide follows the workload you operate.
Find where PHP runs in your AWS account
A website can use more than one PHP runtime: a public site, an admin application, an API, a worker or an older staging environment. Identify the application, hosting service, operating system or image, PHP package and the person who can update it.
| Workload | Update route | Evidence to keep |
|---|---|---|
| Lightsail WordPress or LAMP | Match the AWS-packaged or Bitnami blueprint to its supported update or migration route | Blueprint, serving runtime and completed site checks |
| EC2 or an Auto Scaling group | Update the maintained distribution package or image, then replace or restart the affected runtime | Package advisory and the instances receiving traffic |
| Elastic Beanstalk PHP | Deploy the patched platform for the intended PHP branch | Environment platform version and serving PHP |
| PHP container workload | Rebuild from a fixed package/base image and deploy replacement tasks or pods | Image digest and running workload version |
| Lambda with customer-supplied PHP | Update the custom runtime or container and redeploy | Deployed function version and included PHP runtime |
AWS's bulletin says Lambda does not provide a managed PHP runtime. A function's use of AWS does not transfer ownership of a PHP layer or custom image to the provider. Check each application's runtime rather than treating every AWS service as affected.
Lightsail: distinguish AWS and Bitnami PHP
AWS's dedicated Lightsail guidance gives separate routes for its own blueprints and those packaged by Bitnami. New blueprints do not update an existing instance automatically.
For AWS-packaged PHP blueprints, follow the documented package update, restart and verification process. For Bitnami, PHP lives under /opt/bitnami/php. An operating-system apt upgrade does not update that copy.
AWS recommends moving Bitnami applications to a Lightsail-packaged blueprint. It also documents an in-place alternative. The right route depends on your application and its dependencies. Preserve a snapshot, database, uploads and configuration, then test the target before moving traffic. A new instance should also be checked for the fixed runtime after creation.
For a WordPress site, confirm forms, permalinks, media and administrator access. For WooCommerce, also check the payment-provider integration, tax, delivery and order notifications. See the WordPress PHP update guide for that acceptance list.
EC2: match the fix to your operating system and image
A distribution package can contain security backports while showing an older-looking version. Identify the distribution and package, then confirm coverage of both CVEs in its advisory.
For Amazon Linux 2023, AWS published separate package advisories for PHP 8.2, PHP 8.3, PHP 8.4 and PHP 8.5. Use the applicable release and repository instructions. An Ubuntu, Debian or other EC2 image needs its own vendor's package guidance.
Check launch templates and machine images as well as current instances. Otherwise, replacement or scaled-out instances can start from an older build. Record the PHP runtime serving the website after workers restart or instances are replaced.
Beanstalk: deploy a fully patched platform
AWS released AL2023 PHP platform 4.13.13 containing the upstream fixes:
| PHP branches | Fixed runtime | AWS release |
|---|---|---|
| 8.4 and 8.5 | 8.4.27 and 8.5.12 | 21 October 2026 |
| 8.2 and 8.3 | 8.2.35 and 8.3.36 | 22 October 2026 |
The earlier 4.13.12 release applied partial configuration mitigations. It is not evidence that the fixed PHP binary is deployed. Select the current supported platform for your branch and verify the environment's update. Managed platform updates use the configured maintenance window.
Verify the application and its connected work
Keep a recoverable source, database, upload and configuration copy. Test on an isolated environment with live payments, customer email and production webhooks disconnected. Before a migration, identify how new bookings or orders will be preserved during the traffic change.
After deployment, check the serving runtime and one complete example of each customer action: saved enquiry plus notification, booking plus confirmation, or supported test-mode payment plus order and receipt. For integrations, check the destination record and retry behaviour as well as the website response.
Download the editable AWS PHP runtime update checklist (TXT)
to record the workload, patch evidence and acceptance results. It is free to use with your existing AWS administrator.
Get help with the update, migration and website repairs
Send your AWS PHP update enquiry. Include the AWS service, known runtime, customer actions, current symptoms and business deadline. Keep AWS access keys, passwords and customer data in a secure support channel.
Use the general PHP2Shell guide for the current PHP and NCSC advice. Temporary WAF or configuration controls remain incomplete. Suspected compromise needs the host's security team or an appropriate incident-response specialist alongside any application repair. If a PHP endpoint also feeds a workflow or dashboard, use the automation recovery checks or Power BI data-feed checks.
PHP security · AWS · Lightsail · website repair