PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)

Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP web runtimes allow unauthenticated remote attackers to execute arbitrary code, access sensitive data, or cause denial of service on affected systems. The vulnerabilities impact PHP versions 8.2 through 8.5, with AWS services providing patches and mitigation strategies including immediate upgrades to fixed versions (8.5.12, 8.4.27, 8.3.36, or 8.2.35) and configuration controls across affected services like Elastic Beanstalk, WorkMail, and Lightsail.