AWS waf: WAF doc history: PHP managed rule group versions 2.4 and 2.5 for RCE CVEs
Summary
Adds changelog entries for PHP application managed rule group static versions 2.4 and 2.5, which add the PHP2Shell_BODY_Extended rule and improve detection signatures for CVE-2026-109618 and CVE-2026-109619.
Security assessment
Changelog entries record the release of managed rule group versions that add/improve detection signatures for PHP remote code execution CVEs, informing users of available protections; it is documentation of a security fix rather than a code change.
Evidence
+[Updated AWS Managed Rules for AWS WAF](./aws-managed-rule-groups-changelog.html)| Released static version 2.5 of the PHP application managed rule group. This version improves the detection signatures for the PHP web runtime CVE-2026-109618 and CVE-2026-109619 remote code execution vulnerabilities.| October 22, 2026
Diff
diff --git a/waf/latest/developerguide/doc-history.md b/waf/latest/developerguide/doc-history.md index 1d6f880..7ac1308 100644 --- a//waf/latest/developerguide/doc-history.md +++ b//waf/latest/developerguide/doc-history.md @@ -18,0 +19,4 @@ Change| Description| Date +[Updated AWS Managed Rules for AWS WAF](./aws-managed-rule-groups-changelog.html)| Released static version 2.5 of the PHP application managed rule group. This version improves the detection signatures for the PHP web runtime CVE-2026-109618 and CVE-2026-109619 remote code execution vulnerabilities.| October 22, 2026 +[Updated AWS Managed Rules for AWS WAF](./aws-managed-rule-groups-changelog.html)| Released static version 2.4 of the PHP application managed rule group. This version adds the `PHP2Shell_BODY_Extended` rule, which detects requests that match the PHP web runtime CVE-2026-109618 remote code execution vulnerability. This rule group now detects CVE-2026-109618 directly, superseding the guidance in the version 2.3 entry.| October 22, 2026 +[Updated AWS Managed Rules for AWS WAF](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html)| Released static version 2.5 of the PHP application managed rule group. This version improves the detection signatures for the PHP web runtime CVE-2026-109618 and CVE-2026-109619 remote code execution vulnerabilities.| October 22, 2026 +[Updated AWS Managed Rules for AWS WAF](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html)| Released static version 2.4 of the PHP application managed rule group. This version adds the `PHP2Shell_BODY_Extended` rule, which detects requests that match the PHP web runtime CVE-2026-109618 remote code execution vulnerability.| October 22, 2026