How to Patch the PHP2Shell Vulnerabilities on AWS Lightsail

by

Document Version: 1.0
Target Vulnerabilities: CVE-2026-109618 & CVE-2026-109619 (PHP2Shell – CVSS 9.2)
Target Stack: AWS Lightsail Native WordPress Blueprints (Debian / Apache apache2handler architecture)
Patched Version Required:PHP 8.2.35 or higher

Summary

On October 21, 2026, emergency security updates were released to fix two critical Remote Code Execution (RCE) flaws in the PHP core interpreter. On native AWS-packaged WordPress instances, a common trap occurs where the system’s command line version (cli) updates via background maintenance, but the live web server processing public traffic continues running the vulnerable, un-patched PHP binary cached in its active Apache memory state.

This guide outlines how to audit your active runtime environment and force-patch the web server module.

Step 1: Audit the Active Web Runtime

Do not rely exclusively on php -v via the command line. You must check the version handling public HTTP requests. (I know mine was a good 2 versions lower :D)

  1. Log into your target WordPress Admin Dashboard.
  2. Navigate to Tools > Site Health from the left-hand menu.
  3. Select the Info tab at the top and expand the Server section.
  4. Locate the PHP version string:
    • Vulnerable: 8.2.33 (or lower)
    • Patched: 8.2.35
  5. Note the PHP SAPI line. This guide specifically applies if it reads apache2handler.

Step 2: Take a Safety Snapshot

Before executing package system upgrades on production nodes, capture a system image.

  1. Open your AWS Lightsail Console.
  2. Click on the target WordPress instance.
  3. Open the Snapshots tab.
  4. Under Manual snapshots, click Create snapshot and give it a descriptive name (e.g., Pre-PHP-Patch-Snapshot).

Step 3: Upgrade System and Web Server PHP Binaries

Connect to your instance via the Lightsail browser-based SSH terminal (or your local terminal client) and execute the following sequential commands.

  1. Synchronise package lists with the upstream security repositories to catch yesterday’s patch releases:
  2. Target and upgrade the core Apache-PHP module handler along with CLI dependencies: 
bashsudo apt-get install --only-upgrade libapache2-mod-php8.2 php8.2-common php8.2-cli -y

(Note: If apt reports the packages are held back or already up to date, run a broader security upgrade: `sudo apt-get upgrade -y`)

    Step 4: Flush Cached Memory & Restart Web Services

    Upgrading files on disk does not protect a live server. Apache must be forced to terminate old worker threads and load the patched binaries into memory.

    1. Gracefully restart the web service:
    bashsudo systemctl restart apache2

    Step 5: Verify the Patch Status

    1. Return to your WordPress Admin Dashboard > Tools > Site Health > Info > Server.
    2. Refresh the page and confirm your environment matches the target configuration:
      • PHP version: 8.2.35 (Supports 64bit values)
      • PHP SAPI: apache2handler
    3. Browse your website frontend to verify that all pages, databases, and application routing are functioning normally.

    Troubleshooting

    • SAPI mismatch: If your Site Health lists the SAPI as fpm-fcgi instead of apache2handler, you are running a different stack architecture (such as Bitnami).
    • You must restart your PHP-FPM service using 
    sudo systemctl restart php8.2-fpm

    or use Bitnami’s native controller script.

    sudo /opt/bitnami/ctlscript.sh restart

    Official Documentation: https://aws.amazon.com/security/security-bulletins/2026-143-aws/

    Leave a comment