AWS Details WAF and Server-Side Mitigations for PHP2Shell

Summary

AWS outlines WAF rules and PHP server-side mitigations to reduce exposure to PHP2Shell CVE-2026-109618 and CVE-2026-109619 while patching, and notes that disabling session upload progress also mitigates CVE-2026-115560.

Key points

PHP2Shell comprises two unauthenticated PHP runtime RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619; the article identifies PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 as fixed releases.
AWS WAF's PHP application managed rule group includes PHP2Shell_BODY for CVE-2026-109619 in version 2.3 and later, and PHP2Shell_BODY_Extended for CVE-2026-109618 in version 2.4 and later.
WAF rules inspect request bodies only up to configured limits and cannot address every attack path, including multipart header amplification or server-side PHP settings.
Suggested custom controls include blocking multipart requests where uploads are not needed, capping request body size, and rate-limiting POST requests.
AWS recommends testing rules in Count mode and reviewing matches before switching them to Block, while narrowly scoping exceptions for legitimate traffic.
The article stresses that upgrading PHP is the only complete fix; server-side mitigations include disabling session upload progress and, on PHP 8.5, setting fatal_error_backtraces=0.
Disabling session upload progress also helps mitigate the separate CVE-2026-115560 until PHP releases a fix.

Article Details

Defense Focus: Reduce exposure to PHP2Shell vulnerabilities during patching with AWS WAF and server-side mitigations. The article states that upgrading PHP is the only complete fix.
Detection Methods: Review AWS WAF logs for matches by PHP2Shell_BODY and PHP2Shell_BODY_Extended.
Monitor sampled requests and Amazon CloudWatch metrics for rule matches and legitimate-traffic impact.
Review Apache, FPM, and proxy logs for repeated warnings, deprecations, fatal errors, and timeouts on attacker-reachable routes.
Test rules with benign multipart/form-data requests, oversized bodies, and POST requests containing a PHPSESSID cookie and PHP_SESSION_UPLOAD_PROGRESS.
Data Sources: AWS WAF logs and sampled requests
Amazon CloudWatch metrics
Apache, FPM, and proxy logs
Rule Types: AWS WAF managed PHP application rules that inspect request bodies for PHP2Shell patterns
Request-body size restrictions, including SizeRestrictions_BODY and custom size constraints
Byte-match rules for HTTP method, cookies, request-body fields, and the Content-Type header
Label-based rules and exceptions
Rate-based rules scoped to POST requests and aggregated by IP address
Defensive Actions: Prioritize upgrading PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35; consult the distribution or long-term support vendor for fixes to unsupported PHP versions.
Use the AWS WAF PHP application managed rule group at its default version or version 2.4 or later, and confirm the relevant rules are not overridden to Count.
Enable the Core rule set and enforce an appropriate request-body size limit; account for each protected resource's body inspection limit.
Start custom rules in Count mode, review matches and legitimate traffic, then switch suitable rules to Block.
Block multipart/form-data requests where uploads are not needed; scope size rules and exceptions narrowly where legitimate uploads exist.
Rate-limit repeated POST attempts based on normal traffic, and consider setting pm.max_requests=1 where performance allows.
Set session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0; restart workers after configuration changes.
Apply the article's PHP-level memory and upload-size controls, enable error logging, and inventory PHP workloads, versions, and public endpoints that accept request bodies.