AWS waf: WAF PHP rule group adds CVE-2026-109618/109619 detection
Summary
Changelog entries for static versions 2.4 and 2.5 of the AWS WAF PHP application managed rule group, adding/improving the PHP2Shell_BODY_Extended rule to detect PHP web runtime remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619.
Security assessment
The diff explicitly documents new/updated WAF managed rule signatures that detect specific PHP remote code execution CVEs, directly addressing exploitation of a known vulnerability and superseding prior mitigation guidance.
Evidence
| Released static version 2.5 of this rule group. Improved the detection signatures for the PHP web runtime remote code execution vulnerabilities [CVE-2026-109618](https://nvd.nist.gov/vuln/detail/CVE-2026-109618) and [CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619). | 2026-10-22
Diff
diff --git a/waf/latest/developerguide/aws-managed-rule-groups-changelog.md b/waf/latest/developerguide/aws-managed-rule-groups-changelog.md index c10898a..ab7dfe1 100644 --- a//waf/latest/developerguide/aws-managed-rule-groups-changelog.md +++ b//waf/latest/developerguide/aws-managed-rule-groups-changelog.md @@ -22,0 +23,10 @@ Rule group and rules | Description | Date +[PHP application managed rule group](./aws-managed-rule-groups-use-case.html#aws-managed-rule-groups-use-case-php-app) This release updates the following rules: + + * `PHP2Shell_BODY_Extended` + +| Released static version 2.5 of this rule group. Improved the detection signatures for the PHP web runtime remote code execution vulnerabilities [CVE-2026-109618](https://nvd.nist.gov/vuln/detail/CVE-2026-109618) and [CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619). | 2026-10-22 +[PHP application managed rule group](./aws-managed-rule-groups-use-case.html#aws-managed-rule-groups-use-case-php-app) This release updates the following rules: + + * `PHP2Shell_BODY_Extended` + +| Released static version 2.4 of this rule group. The new `PHP2Shell_BODY_Extended` rule adds detection for requests that match the PHP web runtime remote code execution vulnerability [CVE-2026-109618](https://nvd.nist.gov/vuln/detail/CVE-2026-109618). For more information, see [NIST: National Vulnerability Database: CVE-2026-109618](https://nvd.nist.gov/vuln/detail/CVE-2026-109618). This rule group now detects CVE-2026-109618 directly. This supersedes the guidance in the version 2.3 entry, which directed you to the `SizeRestrictions_BODY` rule in the AWS WAF [Core rule set (CRS) managed rule group](./aws-managed-rule-groups-baseline.html#aws-managed-rule-groups-baseline-crs). | 2026-10-22