AWS PHP RUNTIME UPDATE CHECKLIST
Guidance checked: 23 October 2026
Turing Websites: https://turingwebsites.com
Guide: https://turingwebsites.com/blog/aws-php-security-update-help
Hands-on help: https://turingwebsites.com/services/php-security-updates

Use this editable record with the AWS account owner or administrator. Keep
AWS keys, passwords, raw logs and customer records in a secure support channel.
This checklist records actions and evidence; it does not certify that a site
has never been compromised.

1. IDENTIFY THE APPLICATION AND WORKLOAD
Website/application URL:
AWS service and region:
Environment name and business deadline:
Person responsible for updating PHP:

[ ] Lightsail: AWS-packaged or Bitnami blueprint identified.
[ ] EC2/Auto Scaling: operating system, package, image and launch template.
[ ] Beanstalk: PHP branch and deployed platform version.
[ ] Container: base image/package, image digest and running workload.
[ ] Lambda: customer-supplied PHP runtime/layer/container and deployed version.
Other PHP-backed admin, API or staging applications to check:

2. MATCH THE UPDATE TO THE RUNTIME
CVE-2026-109618 package/vendor evidence:
CVE-2026-109619 package/vendor evidence:
Actual PHP runtime serving the application:

Fixed upstream releases: 8.2.35, 8.3.36, 8.4.27 and 8.5.12, or a later
maintained release on the same branch. Vendor backports can display an
older-looking version. Command-line PHP can differ from the serving runtime.

Lightsail: Bitnami PHP under /opt/bitnami/php is not updated by apt upgrade.
Use the blueprint-specific AWS guide. A new blueprint does not update existing
instances. Check the fixed runtime on a new instance as well.

Beanstalk: AL2023 PHP platform 4.13.13 contains the fixed releases. The earlier
4.13.12 release only applied partial configuration mitigations. Check the
current supported platform and the deployed environment. Managed platform
updates use the configured maintenance window.

EC2: follow the operating system/vendor package advisory. Check images and
launch templates so replacement instances also receive the fix.

Containers/Lambda: update included PHP and redeploy. Confirm the image digest
or runtime version used by the running workload or deployed function.

3. PRESERVE DATA AND CHECK THE CHANGE
[ ] Source, database, uploads and configuration recovery points preserved.
[ ] Snapshot and the applicable provider update/migration route recorded.
[ ] Target PHP branch, extensions and application compatibility checked.
[ ] Staging isolated from live email, payments and production webhooks.
[ ] New orders/bookings during migration have a preservation plan.
[ ] Replacement workload checked before changing traffic.

4. RECORD THE RUNNING RESULT
Runtime/package and restart/replacement evidence:
Instance/platform/image/function version receiving traffic:
Time, timezone and operator:

Customer-action checks (environment, URL, expected and observed result):
Contact form saved record and notification:
Booking record, availability and confirmation:
Supported test-mode payment, order and receipt:
Connected workflow/report feed freshness and destination records:
Unresolved issue, owner and next action:

Temporary WAF or configuration measures are incomplete. Follow current PHP
and AWS guidance. Suspected compromise needs the host's security team or an
appropriate incident-response specialist; preserve evidence through a secure
support channel.

PRIMARY SOURCES
PHP: https://www.php.net/archive/2026.php#2026-10-21-5
AWS: https://aws.amazon.com/security/security-bulletins/2026-143-aws/
Lightsail: https://docs.aws.amazon.com/lightsail/latest/userguide/amazon-lightsail-update-php-security-vulnerabilities.html
Beanstalk PHP 8.4/8.5: https://docs.aws.amazon.com/elasticbeanstalk/latest/relnotes/release-2026-10-21-al2023-php84-php85.html
Beanstalk PHP 8.2/8.3: https://docs.aws.amazon.com/elasticbeanstalk/latest/relnotes/release-2026-10-22-al2023-php82-php83.html