# PHP2Shell on AWS: response checklist

Use with the [PHP2Shell on AWS post](https://www.factualminds.com/blog/php2shell-aws-waf-8kb-gap-2026/). Written **2026-10-27** against the AWS Security Blog post of **2026-10-21** (CJ Moses), AWS Security Bulletin **2026-143-AWS**, Akamai's write-up of **2026-10-22**, and the AWS WAF body inspection docs.

CVEs: **CVE-2026-109618** (memory corruption on out-of-memory) and **CVE-2026-109619** (use-after-free in upload progress). Fixed in PHP **8.5.12, 8.4.27, 8.3.36, 8.2.35**.

## 1. Find every PHP

- [ ] Run `./find-php-on-aws.sh` in every account, not only production
- [ ] Add hosts the script cannot see: no SSM agent, container images Inspector does not scan, vendor appliances, AMIs baked months ago
- [ ] On each host: `php -v` and `php -i | grep session.upload_progress.enabled`
- [ ] Name an owner for each host before you start patching

## 2. Patch

- [ ] Upgrade to a fixed version. AWS calls this the only complete fix for both CVEs
- [ ] PHP 8.1 and older: plan a version upgrade. There is no regular upstream patch
- [ ] Elastic Beanstalk, Lightsail, and base images: check the platform or image release notes for the fixed PHP build before you assume a redeploy picks it up
- [ ] Rebuild and redeploy container images. A running task keeps its old PHP

## 3. Interim WAF (only if a host cannot be patched today)

- [ ] Know your body inspection limit: **8 KB fixed** on Application Load Balancer and AppSync; **16 KB default, up to 64 KB** on CloudFront, API Gateway, Cognito, App Runner, Verified Access
- [ ] Deploy `waf-count-rules.json` in **Count** first
- [ ] Watch `php2shell-oversize-body-count` for a day. Every count is a request that a Block-mode size rule would have stopped. On an upload app that includes real users
- [ ] Switch the upload-progress rule to Block when its count shows no legitimate traffic
- [ ] Do not switch the size rule to Block on upload paths unless you accept broken uploads
- [ ] Confirm nothing reaches the PHP host without passing the web ACL (direct instance IPs, a second load balancer, a VPN path)

## 4. Look back from October 17

- [ ] Start the review window at **2026-10-17**, the first MadPot attempt, not 2026-10-21
- [ ] ALB access logs do not contain request bodies. Search for `PHP_SESSION_UPLOAD_PROGRESS` in WAF logs (if a rule matched), app logs, or full-packet captures
- [ ] On PHP hosts: unexpected child processes of `php-fpm` or `httpd`, new files in web roots and upload directories, new cron entries
- [ ] Check the six IPs in the AWS post. They are shared anonymization infrastructure. Investigate hits; do not treat a blocklist as the fix

## 5. Close

- [ ] Every host from step 1 shows a fixed version or a dated exception with an owner
- [ ] Remove or keep the WAF rules on purpose, and write down which