AWS waf: Changelog entry for PHP rule group v2.3 CVE-2026-109619 patch
Summary
Adds document history entries announcing static version 2.3 of the PHP application managed rule group adding the PHP2Shell_BODY rule for CVE-2026-109619.
Security assessment
The changelog entry references a specific CVE and the rule released to detect exploitation attempts, documenting a security fix.
Evidence
[Updated AWS Managed Rules for AWS WAF](./aws-managed-rule-groups-changelog.html)| Released static version 2.3 of the PHP application managed rule group. This version adds the `PHP2Shell_BODY` rule, which detects requests that match the PHP web runtime CVE-2026-109619 remote code execution vulnerability.| October 21, 2026
Diff
diff --git a/waf/latest/developerguide/doc-history.md b/waf/latest/developerguide/doc-history.md index 0c066ca..1d6f880 100644 --- a//waf/latest/developerguide/doc-history.md +++ b//waf/latest/developerguide/doc-history.md @@ -18,0 +19,2 @@ Change| Description| Date +[Updated AWS Managed Rules for AWS WAF](./aws-managed-rule-groups-changelog.html)| Released static version 2.3 of the PHP application managed rule group. This version adds the `PHP2Shell_BODY` rule, which detects requests that match the PHP web runtime CVE-2026-109619 remote code execution vulnerability.| October 21, 2026 +[Updated AWS Managed Rules for AWS WAF](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html)| Released static version 2.3 of the PHP application managed rule group. This version adds the `PHP2Shell_BODY` rule, which detects requests that match the PHP web runtime CVE-2026-109619 remote code execution vulnerability.| October 21, 2026