AWS waf: Add PHP2Shell_BODY rule virtual patch for CVE-2026-109619
Summary
Documents a new AWS WAF managed rule PHP2Shell_BODY that virtually patches the PHP web runtime remote code execution vulnerability CVE-2026-109619, including an important note and oversize body handling warning.
Security assessment
The change documents a WAF rule that provides a virtual patch for a specific remote code execution CVE, directly enabling protection against exploitation of that vulnerability.
Evidence
This rule group contains a virtual patch for CVE-2026-109619. You can add this rule group to your protection pack (web ACL) to help protect your application against exploitation attempts until your application is patched.
Diff
diff --git a/waf/latest/developerguide/aws-managed-rule-groups-use-case.md b/waf/latest/developerguide/aws-managed-rule-groups-use-case.md index 4cb8058..8464d4b 100644 --- a//waf/latest/developerguide/aws-managed-rule-groups-use-case.md +++ b//waf/latest/developerguide/aws-managed-rule-groups-use-case.md @@ -154,0 +155,4 @@ If you need more information than you find here, contact the [AWS Support Center +###### Important + +This rule group contains a virtual patch for CVE-2026-109619. You can add this rule group to your protection pack (web ACL) to help protect your application against exploitation attempts until your application is patched. + @@ -172,0 +177,5 @@ This rule only inspects the request body up to the body size limit for the prote +`PHP2Shell_BODY` | Inspects the request body for requests that match the PHP web runtime remote code execution vulnerability [CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619). For more information, see [NIST: National Vulnerability Database: CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619). + +###### Warning + +This rule only inspects the request body up to the body size limit for the protection pack (web ACL) and resource type. For Application Load Balancer and AWS AppSync, the limit is fixed at 8 KB. For CloudFront, API Gateway, Amazon Cognito, App Runner, Verified Access, and Amazon Bedrock AgentCore Gateway, the default limit is 16 KB and you can increase the limit up to 64 KB in your protection pack (web ACL) configuration. This rule uses the `Continue` option for oversize content handling. For more information, see [Oversize web request components in AWS WAF](./waf-oversize-request-components.html). Rule action: Block Label: `awswaf:managed:aws:php-app:PHP2Shell_BODY`