PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

Amazon Web Services (AWS) has released a security bulletin addressing two vulnerabilities in PHP web runtimes, identified as CVE-2026-109618 and CVE-2026-109619. The vulnerabilities affect AWS Lambda, AWS Cloud9, and Amazon Elastic Container Service for Kubernetes (EKS). The issues were discovered by AWS internal teams and have been addressed with patches. Users are advised to update their PHP runtimes to the latest versions, which are 7.4.28, 8.0.25, and 8.1.11. The vulnerabilities could allow an attacker to execute arbitrary code or escalate privileges if exploited.