AWS waf: WAF PHP rule group v2.3 adds PHP2Shell_BODY for CVE-2026-109619
Summary
Changelog entry for static version 2.3 of the PHP application managed rule group, adding the PHP2Shell_BODY rule to detect requests exploiting a PHP web runtime remote code execution vulnerability, and noting CRS SizeRestrictions_BODY protection for a related CVE.
Security assessment
Explicitly documents a new AWS WAF managed rule that detects exploitation of a named remote code execution CVE (CVE-2026-109619) and references a second CVE (CVE-2026-109618) mitigated by the CRS body-size rule, giving concrete evidence of vulnerability remediation guidance.
Evidence
+| Released static version 2.3 of this rule group. The new `PHP2Shell_BODY` rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109619.
Diff
diff --git a/waf/latest/developerguide/aws-managed-rule-groups-changelog.md b/waf/latest/developerguide/aws-managed-rule-groups-changelog.md index d686a68..c10898a 100644 --- a//waf/latest/developerguide/aws-managed-rule-groups-changelog.md +++ b//waf/latest/developerguide/aws-managed-rule-groups-changelog.md @@ -22,0 +23,5 @@ Rule group and rules | Description | Date +[PHP application managed rule group](./aws-managed-rule-groups-use-case.html#aws-managed-rule-groups-use-case-php-app) This release updates the following rules: + + * `PHP2Shell_BODY` + +| Released static version 2.3 of this rule group. The new `PHP2Shell_BODY` rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109619. For more information, see [NIST: National Vulnerability Database: CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619). For [CVE-2026-109618](https://nvd.nist.gov/vuln/detail/CVE-2026-109618), the `SizeRestrictions_BODY` rule in the AWS WAF [Core rule set (CRS) managed rule group](./aws-managed-rule-groups-baseline.html#aws-managed-rule-groups-baseline-crs) adds protection by blocking request bodies that are over 8 KB (8,192 bytes). | 2026-10-21