PHP2Shell on AWS: What Last Week’s Escalations Taught Us About End-of-Life PHP
A field report on CVE-2026-109618 and CVE-2026-109619: what our support desk saw between 21 and 24 October, what PHP and AWS have confirmed since, where AWS WAF and Shield Advanced stop, and the fix that actually holds. Current as of 26 October 2026.
By Vikram Singh Jain
October 27, 2026
