Update PHP on Amazon Linux for php2shell

Only check systems you own or are responsible for.

Short answer

PHP upstream fixed the two php2shell flaws (CVE-2026-109618 and CVE-2026-109619) in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Amazon Linux back-ports fixes into its own package builds, so compare your installed package with the fixed package version in the table below, not with the upstream number. As of 2026-10-22:

• Amazon Linux 2023 (AL2023): fixed packages exist for php8.2 to php8.5. php8.1 has none: Amazon lists it as “No Fix Planned”.
• Amazon Linux 2 (AL2): only the amazon-linux-extras php8.2 stream has a fix. The PHP in the core AL2 repository is listed as “No Fix Planned”.
• Amazon Linux 2027 Preview: a fixed php8.5 package exists. The preview is for non-production testing.

On AL2023, a plain dnf upgrade may find nothing: the instance is locked to an older repository version. Step 3 shows the extra argument you need. Afterwards, restart PHP-FPM or Apache. To compare a version you have, use the checker or the fixed-versions table.

Why it matters

PHP’s own advisory says the flaws can allow unauthenticated remote code execution, and that all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed (php.net advisory). AWS’s bulletin says AWS services are not impacted, but PHP you installed yourself on an instance is yours to update: “Customers running PHP on Amazon Linux should apply the updated packages as soon as they are available” (AWS bulletin 2026-143-AWS, last updated 21 Oct 2026 20:30 PDT).

Amazon labels its fix advisories Important (see the ALAS pages in the table). That is Amazon’s own severity scale and does not change the php.net guidance to update.

Fix status

“Fixed package (or newer)” is the version from the ALAS advisory (Amazon Linux Security Advisory). A row with a status word and no package means Amazon shows no fixed package for it. It does not mean your system is fine either way.

What Amazon’s status words mean (ALAS FAQ): No Fix Planned is “Amazon Linux does not plan to release a fix at this time”. Pending Fix means the latest package on that platform contains the issue and a fix is being prepared. Fixed means a fix “is available in the RPM repositories”.

The bulletin adds a regional note: updated PHP packages were available for commercial regions, and non-commercial regions were targeted for 2026-10-22. If dnf or yum offers nothing in your region, the Amazon Linux package may not have reached it yet; check the ALAS page for your row.

Step 1: Identify what you run

cat /etc/system-release      # Amazon Linux release (documented in the AL2 guide)

AL2023 packages are named by branch: php8.1, php8.2, php8.3, php8.4, php8.5 (AWS lists PHP 8.1 to 8.5 on its PHP on AL2023 page). List what is installed:

# Amazon Linux 2023
sudo dnf list installed 'php*'

# Amazon Linux 2
yum list installed | grep php
yum list installed | grep amzn2extra-php8.2     # lines here mean the PHP 8.2 extras stream

dnf list installed <package names> and yum list installed are the forms AWS shows in its AL2023 and AL2 guides. The quotes and * are ours. AWS documents grep amzn2extra-<topic> as the way to tell extras packages from core ones (AL2 extras).

To get the full version-release string, use the standard RPM query. Our checker reads its output:

rpm -q php8.3-cli      # AL2023: use your branch, for example php8.5-cli. AL2: rpm -q php-cli

PHP usually runs as PHP-FPM behind nginx or Apache. With Apache and mod_php, PHP runs inside httpd, and php.net rates that setup highest risk. Know which one you have, because it decides what to restart in step 4.

Step 2: Compare with the fixed package

Find your row in the table above and compare the whole version-release. The installed package should be equal to or higher than the fixed package for your row; do not judge it by the upstream number inside it. Amazon back-ports fixes: its FAQ says the bulletin for an issue “will list the specific package version(s) in which the issue is fixed” (AL2 FAQ). Paste the rpm -q line into the checker to compare it for you; it runs in your browser and sends nothing.

Step 3: Update

Take a snapshot first (an EBS snapshot or AMI on EC2), above all if you are changing PHP branch.

Amazon Linux 2023

AWS: “AL2023 AMIs are locked to a specific version of the Amazon Linux repository”, and security updates “are made available to new repository versions only” (AL2023 repositories and OS updates). An instance launched from an older AMI must move to a newer repository version before it can see the fixed PHP packages. AWS’s release notes put php8.2 to php8.5 fixed packages in repository version 2023.12.20261021 (release notes, the newest 2023.12 release listed when we checked). Those notes list no php8.1 package.

sudo dnf check-release-update
sudo dnf upgrade --releasever=2023.12.20261021

• dnf check-release-update lists newer repository versions and prints the exact dnf upgrade --releasever=... line. If it returns nothing, DNF is already on the latest version. If a newer release than 2023.12.20261021 shows up, use that one, because it includes the earlier fixes.
• AWS also shows --releasever=latest. On an old instance, check-release-update may not report the latest release (2023.9.20251117 or earlier; AWS announcement), so passing the version number above is the safer form.
• Run the upgrade as root (sudo). To check your current repository version: rpm -q system-release --qf "%{VERSION}\n".
• AWS recommends applying all updates in a new release: “Picking just security updates, or only specific updates should be the exception rather than rule”. If you must narrow it, AWS documents dnf upgrade-minimal --releasever=... --advisory <ALAS id from the table>, which updates the advisory’s packages only up to the versions the advisory names. The same --advisory option with plain dnf upgrade updates them to the latest version available, which may be newer (AWS: in-place updates).

The ALAS2023 pages for the four fixed branches show the new packages but no dnf command, so the commands above come from the AL2023 user guide.

php8.1 has no fixed package. AL2023 still ships it (AWS lists PHP 8.1 to 8.5 on its PHP page), but Amazon lists no fix for it. It is end-of-life upstream, so plan a move to a supported branch; the same AWS page links the upstream migration guides. See also PHP 7.4, 8.0 and 8.1.

Amazon Linux 2

AL2 reached end of support on 2026-06-30 and no longer receives standard security updates (AL2 FAQ). Extras topics are exempt from Amazon’s long-term support policy (AL2 extras). Even so, Amazon published a fix for the PHP 8.2 extras stream. Its advisory is marked as applying to “Amazon Linux 2 - Php8.2 Extra” and gives the official commands (ALAS2PHP8.2-2026-015):

sudo yum update php

The same page also gives yum update --advisory with its own advisory ID (the one in the table). The advisory also references CVE-2026-103111. Advisories for the AL2 Core repository have no package prefix; extras advisories have one (ALAS FAQ), so read the advisory for the repository you installed from.

• The core AL2 php package has no fix (“No Fix Planned”).
• Amazon’s CVE pages give no statement for the other extras streams. AWS’s own list marks php7.1 to php7.4, php8.0 and php8.1 as deprecated and php8.2 as the only PHP stream without a deprecation date (extras list). The older streams are end-of-life upstream too.
• To move, AWS documents sudo amazon-linux-extras install php8.2 in its AL2 LAMP tutorial, and the AL2023 PHP page says: “AL2 includes PHP 8.0, 8.1, and 8.2 in amazon-linux-extras enabling an easy upgrade path to AL2023” (PHP on AL2023). Only the 8.2 stream has a fix. Either move changes your PHP version, so test your application first.

Amazon Linux 2027 Preview

AL2027 is a public preview for non-production testing and uses the DNF5 package manager (AWS). The advisory (ALAS2027-2026-243) states the fix command for php8.5:

sudo dnf update php8.5

Step 4: Restart

Replacing the package does not replace running PHP processes. AWS: restarting the services “might be sufficient”, and a reboot “ensures that all previous package and library updates are complete” (AL2 updates). The AWS LAMP tutorials restart with:

sudo systemctl restart php-fpm
sudo systemctl restart httpd

If you use versioned packages such as php8.3-fpm, the service name may differ. AWS does not document it for those packages, so check with systemctl list-units 'php*'. nginx does not need a restart for a PHP update when it talks to PHP-FPM. If PHP runs in a container, rebuild the image and recreate the container instead (Docker guide).

Step 5: Verify

rpm -q php8.3-cli       # AL2023, your branch. AL2: rpm -q php-cli

• Compare the full version-release with the fixed package in the table. That comparison decides it, not php -v.
• Paste the line into the checker for a second comparison against the same data.
• Restart before you rely on the result: a package on disk is not a process in memory.

Elastic Beanstalk and Lightsail

Both are on the hosting status page with AWS’s statements and the date we last checked them. In short:

• Elastic Beanstalk replaces the platform version rather than a package. AWS says environments with Managed Platform Updates get the new platform version in their next maintenance window. Otherwise open the environment in the Elastic Beanstalk console and choose Change under Platform to select a newer platform version (AWS: update the platform version). AWS lists platform version 4.13.13 with PHP 8.5.12 and 8.4.27 (release of 21 Oct) and PHP 8.3.36 and 8.2.35 (release of 22 Oct). AWS says new platform versions might not yet be available in all Regions and can take a few hours, so check the platform history for your Region and the PHP branch you use (AWS’s platform history) and the hosting status page.
• Lightsail: AWS says instances from operating-system blueprints such as Amazon Linux do not include PHP unless you installed it. If you did, use the Amazon Linux commands on this page. Lightsail’s packaged WordPress, LAMP and Nginx blueprints use apt: follow Ubuntu and Debian and AWS’s Lightsail page.

If your stream has no fixed package

This applies to AL2023 php8.1, the core AL2 php package and the older AL2 extras streams.

• Moving to a supported PHP branch is the way out. On AL2023, php8.2 to php8.5 have fixed packages (see the table) while php8.1 has none. On AL2, the extras php8.2 stream is the only PHP stream with a fix.
• Read the interim measures on the php.net advisory. They reduce exposure only and are no substitute for the update.
• Do not build PHP from source just to get a version number. You would own every later update.

Independent site, not affiliated with Amazon Web Services, the PHP Group or php.net.

Related

• Fixed versions: every distribution and branch
• Hosting status: what AWS and other hosts have said
• RHEL, AlmaLinux, Rocky and Amazon: the same Amazon rows next to other RPM distributions
• Check your PHP version
• Docker image update

Need it done for your exact setup?

If you would rather not work out the repository version, stream and restart order yourself, there is a $49 personal patch plan: written steps for your exact setup by email within 24h. See the fix service.