PHP2Shell Vulnerability: How I’d Patch an AWS Lightsail LAMP Stack Today

A single unauthenticated web request. No login, no plugin bug, no mistake in your own code. That’s all an attacker needs to run code on a server with the PHP2Shell vulnerability, and almost every PHP version from the last decade has it.

The part that caught my attention isn’t only the severity. It’s who found it. Researchers used AI models to dig out bugs that had been sitting in PHP’s core for years, then used the same tools to build working exploits in about a week. Attackers have AI too, and exploit attempts showed up before the patch was even public.

So, if you run PHP on an AWS Lightsail LAMP instance, this one’s for you. I’ll walk you through what PHP2Shell is, why AI changed the game here, and the exact commands I’d run to check, patch and harden a Lightsail server. There’s also a nasty surprise for anyone still on a Bitnami blueprint, so read that section carefully.

What Is the PHP2Shell Vulnerability?

The PHP2Shell vulnerability is a pair of critical flaws in the PHP runtime (CVE-2026-109618 and CVE-2026-109619) that let an unauthenticated attacker execute code on a web server. Both sit in PHP’s engine itself, so a site can be exposed even when its own application code is perfectly secure.

Both CVEs carry a CVSS v4.0 score of 9.2. The first one is about memory: when a request hits PHP’s memory_limit at just the wrong moment, PHP can leave half-built data lying around and later treat it as valid. The second is about stale state, where a fatal error leaves an internal pointer aimed at memory from a previous request, and the next request on the same worker can abuse it.

There’s a quieter problem hiding behind the RCE headlines. Attackers can also read worker process memory without ever getting code execution. That memory can hold passwords, session tokens, API keys and database credentials from other people’s requests.

---

Which PHP Versions Are Affected and Fixed?

Every PHP release from 5.4 through 8.5 has at least one of these bugs. The PHP project shipped fixes on 21 October 2026 for the four branches it still supports.

PHP branch	Vulnerable	Fixed in	Status
8.5	Below 8.5.12	8.5.12	Supported
8.4	Below 8.4.27	8.4.27	Supported
8.3	Below 8.3.36	8.3.36	Supported
8.2	Below 8.2.35	8.2.35	Supported
8.1, 8.0, 7.4	All	Source patches only	End of life
7.3 and older	All	No fix	End of life

Two things trip people up here. First, Linux distributions often backport the fix into a package that still shows an older-looking version number, so php -v alone won’t tell you the truth. You need to check the package changelog for the CVE ID, which I’ll show you below.

Second, the way you run PHP matters. The PHP team rates Apache with mod_php as the highest-risk setup, because a single request can trigger the attack before any of your application code even runs. PHP-FPM is harder to exploit but not safe. And that matters a lot on Lightsail, which I’ll get to.

The official write-up from the PHP Foundation is worth reading in full if you want the technical background.

---

Suggested Reading: Stateless MCP: Why I’m Moving MCP Servers Off Our Laptops

How Did AI Find These PHP Vulnerabilities?

AI-discovered PHP vulnerabilities aren’t a theory anymore. One of the underlying memory bugs was first spotted by a PHP core developer back in 2024, during an external audit, but nobody found a path from that crash to code execution at the time. It just sat there.

This year, security researchers pointed large language models at PHP’s C source and asked them to go hunting. Calif used OpenAI’s GPT-5.6 Sol. Wiz used its own Wiz Atlas agent alongside Google’s Gemini 4 Argon and GPT-5.6 Sol. The PHP security team itself ran scans with Anthropic’s Claude Mythos and used OpenAI’s Daybreak Red to validate reports.

AI models compressed months of exploit research into roughly one week. The researchers used them not just to find the bugs, but to write exploits, adapt them to different PHP versions and memory layouts, debug failures and validate the patch. For anyone running a server, that means the gap between “bug exists” and “working exploit exists” is now measured in days, not quarters.

The volume is also new. Since 1 July 2026, the PHP security team has published 15 CVEs and waded through more than 100 invalid, duplicate or unreproducible reports, a lot of them AI-generated. A small, donation-funded team is now dealing with a flood that used to take years to build up.

And the attackers clearly kept pace. Amazon’s threat intelligence team spotted a PHP2Shell exploitation attempt on 17 October, four days before disclosure. Within an hour of the advisories going live on 21 October, watchTowr’s honeypots were seeing active attempts. Governments in France, Finland, Denmark and the Netherlands took public sites offline rather than wait.

I’ve patched a lot of servers over the years, and the old rhythm was: read the advisory, schedule a maintenance window for the weekend, done. That rhythm doesn’t survive contact with AI-assisted attackers. If you take one thing from this article, let it be that.

---

First, Check Which Lightsail Blueprint You’re On

Before you run a single command, find out who packaged your LAMP stack. This decides everything that follows.

Open your instance in the Lightsail console and look at the blueprint information in the header. It will say either Lightsail or Bitnami.

• LAMP packaged by Lightsail — a standard Debian 12 server with PHP 8.5 installed as normal .deb packages, the admin SSH user, and sites under /var/www. You can patch it in place with apt.
• LAMP packaged by Bitnami — PHP is a self-contained bundle under /opt/bitnami/php. Running apt upgrade will not touch it.

I know the Lightsail blueprint well, because I moved six of my own sites (including this one) off Bitnami onto it earlier this year. One thing I noticed then matters a lot now: out of the box, Apache on that blueprint runs PHP through mpm_prefork and mod_php. That’s exactly the setup the PHP team rates as the easiest to exploit, so a fresh Lightsail LAMP instance starts in the riskiest configuration unless you change it.

That Bitnami detail is the nasty surprise I mentioned. AWS stopped updating Bitnami-packaged blueprints on 19 May 2026, and from 19 November 2026 you won’t even be able to create new Bitnami instances. Existing ones keep running, but nobody is shipping them a patched PHP. If you’re on Bitnami, skip ahead to the Bitnami section after reading the steps below, because your fix is a migration, not an update.

---

Suggested Reading: How to Build a RAG Chatbot With Your Own Documents

How to Patch PHP on AWS Lightsail (Lightsail LAMP Blueprint)

Here’s the exact order I’d follow on a Lightsail-packaged LAMP instance. Connect using the browser-based SSH client in the Lightsail console. If you want to use your own terminal instead, open port 22 to your IP address on the Networking tab first, because Lightsail blueprints only allow browser SSH at launch.

I’m using PHP 8.5 in the commands below, since that’s what the blueprint ships. If you’ve installed a different branch, swap the version number.

1. Take a snapshot before you touch anything

A snapshot is your undo button. You can create one in the console under the Snapshots tab, or from the AWS CLI on your own machine:

aws lightsail create-instance-snapshot \
  --instance-name my-lamp-server \
  --instance-snapshot-name pre-php2shell-patch

While you’re there, enable automatic snapshots too. Lightsail keeps seven daily snapshots and rotates the oldest out, which costs very little for the peace of mind.

2. Find your PHP version and how Apache runs it

php -v
sudo apache2ctl -M 2>/dev/null | grep -iE 'php|mpm'
systemctl list-units --type=service | grep -i fpm

If apache2ctl -M lists php_module and mpm_prefork_module, you’re on the blueprint’s default mod_php setup, the highest-risk one. If it lists mpm_event_module and a php8.5-fpm service is running, you’re on PHP-FPM.

One trap here: php -v and php -i report the command-line PHP, not the one serving your sites. They’re usually the same package version on Debian, but the settings are different, so don’t trust CLI output for php.ini values.

3. Update the PHP packages

sudo apt update
apt list --upgradable 2>/dev/null | grep -i php
sudo apt upgrade

The middle command shows you which PHP packages have updates waiting. If nothing PHP-related appears, the repository your PHP comes from may not have published its fix yet, so jump to the interim mitigations below and check again in a few hours.

It’s worth knowing which repository that is. Debian 12 itself only ships PHP 8.2, so a PHP 8.5 package has to come from somewhere else. This command shows you the source:

apt-cache policy php8.5-fpm php8.5-common

4. Confirm the fix is really in the package

Remember, the version string can lie. You want PHP 8.5.12 or later, but the safest check is the package’s own changelog, which ships on the server:

dpkg -l | grep -E '^ii +php8\.5'
zcat /usr/share/doc/php8.5-common/changelog.Debian.gz | grep -E 'CVE-2026-10961[89]|8\.5\.1[2-9]'

If the CVE IDs or the 8.5.12 release show up, the fix is installed. If nothing comes back, you’re not patched yet, whatever you assumed.

5. Restart every PHP process

This is the step people forget. The patched code only runs once the old workers are gone.

sudo systemctl restart php8.5-fpm   # only if you use PHP-FPM
sudo systemctl restart apache2
sudo systemctl status apache2 php8.5-fpm --no-pager

On the default mod_php setup, restarting Apache is enough, because PHP lives inside the Apache processes. On PHP-FPM, Apache is just a proxy, so the FPM restart is the one that actually loads the patched code.

Updating WordPress, Laravel or any other app won’t help here, by the way. The flaw lives in the runtime underneath them, so the runtime is what needs replacing.

6. Check your memory settings after patching

The fix changes how PHP handles its memory limit. Once a request hits memory_limit, PHP now ends the process outright, and shutdown handlers don’t run. If you have scripts that live close to their limit (big imports, image processing, report generation), test them now and raise memory_limit or post_max_size deliberately where you need to.

---

Suggested Reading: Best Computer for AI Workload in 2026 That Actually Deliver

Interim Mitigations If You Can’t Patch Right Now

Sometimes the patched package isn’t out for your distribution yet, or you’re on an end-of-life PHP version. These settings narrow the attack surface while you sort out a real fix. They are not a fix, and the PHP maintainers are clear that only updating fully protects a server.

Rather than editing the main php.ini, I’d add a small drop-in file so the change is easy to spot and remove later. Put it in the conf.d folder of the PHP your web server actually loads: /etc/php/8.5/apache2/conf.d/ for the default mod_php setup, or /etc/php/8.5/fpm/conf.d/ for PHP-FPM. Call it something like 99-php2shell.ini:

; Blocks the confirmed session upload-progress path for CVE-2026-109619
session.upload_progress.enabled = 0

; PHP 8.5 only — also needed for CVE-2026-109619
fatal_error_backtraces = 0

; Keep request bodies small to make memory exhaustion harder
post_max_size = 8M

The fatal_error_backtraces line matters on Lightsail in particular, since the blueprint ships PHP 8.5. Do check post_max_size against your sites, though. My WooCommerce and WordPress sites need a lot more than 8 MB for media uploads, so pick the smallest value your sites can live with, not the smallest possible one.

Then cap request sizes at the Apache level too, so oversized uploads never reach PHP. Add this inside your virtual host or in /etc/apache2/apache2.conf:

LimitRequestBody 10485760

Restart Apache (and PHP-FPM) afterwards. A couple of honest caveats here. Turning off session upload progress does nothing for CVE-2026-109618, and the PHP team specifically warns against using RLIMIT_AS or RLIMIT_DATA limits as a workaround, because they can trigger the same vulnerable path.

If your site already sits behind Cloudflare, you’re getting some extra cover, since it switched on firewall rules for PHP2Shell by default. Though attackers were already reshaping their payloads to get around those rules, so treat it as a seatbelt, not a substitute for patching.

---

Lightsail LAMP Stack Security: Hardening for the Next One

PHP2Shell won’t be the last AI-discovered bug. These are the changes I’d make once the patch is in, so the next emergency is less of an emergency.

Move from mod_php to PHP-FPM. This is the single biggest change on a Lightsail LAMP instance, since the blueprint defaults to mod_php. I made this switch on my own server during the Bitnami migration, mainly because mod_php forces mpm_prefork, which can’t serve HTTP/2 at all. Now it’s a security win too. Take a snapshot first, then:

PHPVER=$(php -r 'echo PHP_MAJOR_VERSION.".".PHP_MINOR_VERSION;')
sudo apt-get install -y "php${PHPVER}-fpm"
sudo a2dismod "php${PHPVER}" mpm_prefork
sudo a2enmod mpm_event proxy_fcgi setenvif http2
sudo a2enconf "php${PHPVER}-fpm"
sudo apache2ctl -t && sudo systemctl restart "php${PHPVER}-fpm" apache2

Two things to watch. After the switch, the PHP settings that matter live under /etc/php/8.5/fpm/, not /etc/php/8.5/apache2/, so copy over any custom values (memory limit, upload sizes, OPcache) you had set. And never run a2enmod php8.5 again later, because it quietly drags Apache back to prefork.

Turn on unattended security updates. This shrinks the window between a fix being published and your server getting it:

sudo apt install unattended-upgrades needrestart
sudo dpkg-reconfigure -plow unattended-upgrades

needrestart restarts affected services after an update, which matters because an installed patch is just a file on disk until PHP restarts. One catch on Debian: unattended-upgrades only applies updates from Debian’s own security archive by default. If apt-cache policy showed your PHP 8.5 coming from a third-party repository, add that repository’s origin to /etc/apt/apt.conf.d/50unattended-upgrades, or your PHP will never update itself.

Keep the Lightsail firewall tight. In the Networking tab, keep SSH on port 22 limited to your own IP address, or to Lightsail’s browser client as the blueprint ships. Only ports 80 and 443 need to be open to the world. It won’t stop PHP2Shell, but it removes easy extra doors.

Rebuild your containers too. If you run any PHP apps in Docker or Podman on the same instance, the base image carries its own PHP. Pull a patched image and rebuild. I covered the trade-offs between the two runtimes in my Docker vs Podman comparison if you’re weighing that up.

---

Running Bitnami LAMP on Lightsail? Migrate Now

Bitnami LAMP instances on Lightsail can’t get a patched PHP through normal updates. Bitnami bundles its own PHP under /opt/bitnami/php, and AWS ended updates for Bitnami blueprints on 19 May 2026. That leaves migration to the Lightsail-packaged LAMP blueprint as the only clean way out.

In the meantime, apply the same php.ini mitigations to Bitnami’s config at /opt/bitnami/php/etc/php.ini, then restart the whole stack:

sudo /opt/bitnami/ctlscript.sh restart

I’ve done this migration myself for six sites, and it’s straightforward, just a bit tedious. I wrote up the whole process, along with the scripts I used, in my guide on how to migrate WordPress from Bitnami without losing your settings. Here’s the short version:

1. Snapshot the old Bitnami instance.
2. Export your database with mysqldump and copy your web files off the server.
3. Create a new instance and choose LAMP with Lightsail as the blueprint provider, not Bitnami.
4. Patch PHP and switch to PHP-FPM using the steps above, before you restore anything.
5. Restore your files under /var/www, create an Apache vhost for each site and enable it with a2ensite, then import the database.
6. Test each site on the new instance’s IP address.
7. Detach the static IP from the old instance and attach it to the new one, so your DNS keeps working with no propagation delay.
8. Reissue your SSL certificates with Certbot, since certificates don’t carry over.

Step 4 is the one I’d stress. Bitnami ran PHP-FPM with mpm_event, so moving to the Lightsail blueprint’s default mod_php setup would actually make your server more exposed to PHP2Shell, and silently drop you to HTTP/1.1 at the same time.

As a bonus, Lightsail-packaged blueprints enforce IMDSv2 and restrict port 22 at launch, which is a better security baseline than the old Bitnami images. Keep the old instance around for a few days, then take a final snapshot and delete it.

---

Suggested Reading: Best Mechanical Keyboards For Gamers or Home Office

How to Tell If Your Server Was Already Hit

Exploitation attempts started before the patch existed, so it’s worth a look even after you’ve updated. These bugs live below your application, which means your app logs may show nothing at all. Apache’s logs are a better place to start:

sudo grep -i 'Allowed memory size' /var/log/apache2/*error.log
sudo grep -i 'Segmentation fault' /var/log/apache2/*error.log
sudo grep -iE 'exited on signal|SIGSEGV' /var/log/php8.5-fpm.log
sudo awk '$9 == 500' /var/log/apache2/*access.log | tail -50

The wildcards matter if you host several sites with their own per-site log files, like I do. The FPM log line only applies if you’ve switched to PHP-FPM, and it’s where crashed workers show up.

The warning signs are unusual multipart POST requests followed by memory-limit errors, bursts of HTTP 500 responses, oddly large PHPSESSID cookies, and PHP workers crashing or restarting for no clear reason.

If you see that pattern, assume secrets were exposed, since the memory disclosure bug doesn’t need code execution to work. Rotate your database passwords, API keys and any tokens in your config files. If you find signs of actual code execution, rebuilding from a snapshot taken before 17 October 2026 is safer than trying to clean a server in place.

---

The Takeaway

PHP2Shell is a critical, actively exploited flaw in the PHP runtime, and the fix is simple: patch PHP, confirm the CVE in the changelog, and restart every worker. On a Lightsail-packaged LAMP instance that’s about fifteen minutes of work. On Bitnami, it’s a migration you should start today.

The bigger lesson is about speed. AI found these bugs, AI helped weaponize them, and the next one will move just as fast, so automate your updates and snapshots now while you’re thinking about it.

---

FAQ About PHP Vulnerabilities