AWS waf: AWS WAF PHP rule group adds CVE-2026-109618 patch and PHP2Shell_BODY_Extended rule
Summary
Updates the PHP application managed rule group documentation to cover CVE-2026-109618 in addition to CVE-2026-109619, adds a new PHP2Shell_BODY_Extended rule with its oversize-body warning, and corrects the PHP2Shell_BODY rule label casing.
Security assessment
The change documents a WAF virtual patch for a PHP web runtime remote code execution vulnerability (CVE-2026-109618) and adds a new detection rule (PHP2Shell_BODY_Extended) that inspects request bodies for exploit attempts, directly mitigating exploitation of a known RCE CVE.
Evidence
+This rule group contains a virtual patch for CVE-2026-109618 and CVE-2026-109619. You can add this rule group to your protection pack (web ACL) to help protect your application against exploitation attempts until your application is patched.
Diff
diff --git a/waf/latest/developerguide/aws-managed-rule-groups-use-case.md b/waf/latest/developerguide/aws-managed-rule-groups-use-case.md index 8464d4b..5e2c3ea 100644 --- a//waf/latest/developerguide/aws-managed-rule-groups-use-case.md +++ b//waf/latest/developerguide/aws-managed-rule-groups-use-case.md @@ -157 +157 @@ If you need more information than you find here, contact the [AWS Support Center -This rule group contains a virtual patch for CVE-2026-109619. You can add this rule group to your protection pack (web ACL) to help protect your application against exploitation attempts until your application is patched. +This rule group contains a virtual patch for CVE-2026-109618 and CVE-2026-109619. You can add this rule group to your protection pack (web ACL) to help protect your application against exploitation attempts until your application is patched. @@ -177 +177 @@ This rule only inspects the request body up to the body size limit for the prote -`PHP2Shell_BODY` | Inspects the request body for requests that match the PHP web runtime remote code execution vulnerability [CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619). For more information, see [NIST: National Vulnerability Database: CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619). +`PHP2Shell_BODY` | Inspects the request body for exploit attempts against the PHP web runtime remote code execution vulnerabilities [CVE-2026-109618](https://nvd.nist.gov/vuln/detail/CVE-2026-109618) and [CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619). For more information, see [NIST: National Vulnerability Database: CVE-2026-109618](https://nvd.nist.gov/vuln/detail/CVE-2026-109618) and [NIST: National Vulnerability Database: CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619). @@ -181 +181,6 @@ This rule only inspects the request body up to the body size limit for the prote -This rule only inspects the request body up to the body size limit for the protection pack (web ACL) and resource type. For Application Load Balancer and AWS AppSync, the limit is fixed at 8 KB. For CloudFront, API Gateway, Amazon Cognito, App Runner, Verified Access, and Amazon Bedrock AgentCore Gateway, the default limit is 16 KB and you can increase the limit up to 64 KB in your protection pack (web ACL) configuration. This rule uses the `Continue` option for oversize content handling. For more information, see [Oversize web request components in AWS WAF](./waf-oversize-request-components.html). Rule action: Block Label: `awswaf:managed:aws:php-app:PHP2Shell_BODY` +This rule only inspects the request body up to the body size limit for the protection pack (web ACL) and resource type. For Application Load Balancer and AWS AppSync, the limit is fixed at 8 KB. For CloudFront, API Gateway, Amazon Cognito, App Runner, Verified Access, and Amazon Bedrock AgentCore Gateway, the default limit is 16 KB and you can increase the limit up to 64 KB in your protection pack (web ACL) configuration. This rule uses the `Continue` option for oversize content handling. For more information, see [Oversize web request components in AWS WAF](./waf-oversize-request-components.html). Rule action: Block Label: `awswaf:managed:aws:php-app:PHP2Shell_Body` +`PHP2Shell_BODY_Extended` | Inspects the request body for exploit attempts against the PHP web runtime remote code execution vulnerabilities [CVE-2026-109618](https://nvd.nist.gov/vuln/detail/CVE-2026-109618) and [CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619). For more information, see [NIST: National Vulnerability Database: CVE-2026-109618](https://nvd.nist.gov/vuln/detail/CVE-2026-109618) and [NIST: National Vulnerability Database: CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619). + +###### Warning + +This rule only inspects the request body up to the body size limit for the protection pack (web ACL) and resource type. For Application Load Balancer and AWS AppSync, the limit is fixed at 8 KB. For CloudFront, API Gateway, Amazon Cognito, App Runner, Verified Access, and Amazon Bedrock AgentCore Gateway, the default limit is 16 KB and you can increase the limit up to 64 KB in your protection pack (web ACL) configuration. This rule uses the `Continue` option for oversize content handling. For more information, see [Oversize web request components in AWS WAF](./waf-oversize-request-components.html). Rule action: Block Label: `awswaf:managed:aws:php-app:PHP2Shell_Body_Extended`