AWS waf: Add CVE-2026-115560 coverage to AWS WAF managed rule group
Summary
Updates the managed rule group description to state it protects against CVE-2026-115560 in addition to CVE-2026-109618 and CVE-2026-109619, and clarifies it is a virtual patch until PHP patches are installed.
Security assessment
The changed line explicitly names a new CVE (CVE-2026-115560) that the AWS WAF managed rule group now virtually patches, giving concrete evidence the documentation addresses a specific exploitable vulnerability in PHP applications and how to mitigate it before patching.
Evidence
+This rule group provides protection against exploit attempts for CVE-2026-109618, CVE-2026-109619, and CVE-2026-115560. You can add this rule group to your protection pack (web ACL) until the relevant PHP patches have been installed.
Diff
diff --git a/waf/latest/developerguide/aws-managed-rule-groups-use-case.md b/waf/latest/developerguide/aws-managed-rule-groups-use-case.md index 5e2c3ea..9462a9d 100644 --- a//waf/latest/developerguide/aws-managed-rule-groups-use-case.md +++ b//waf/latest/developerguide/aws-managed-rule-groups-use-case.md @@ -157 +157 @@ If you need more information than you find here, contact the [AWS Support Center -This rule group contains a virtual patch for CVE-2026-109618 and CVE-2026-109619. You can add this rule group to your protection pack (web ACL) to help protect your application against exploitation attempts until your application is patched. +This rule group provides protection against exploit attempts for CVE-2026-109618, CVE-2026-109619, and CVE-2026-115560. You can add this rule group to your protection pack (web ACL) until the relevant PHP patches have been installed.