If you are like me running this WordPress instance on Amazon Lightsail, please take note of some vulnerabilities CVE-2026-109618 and CVE-2026-109619. On October 21, 2026, the PHP project released security updates that fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated Critical with a CVSS v4.0 score of 9.2 out of 10. Both vulnerabilities can allow an unauthenticated attacker to run code remotely on a server that uses PHP to serve web requests.
CVE-2026-109618 and CVE-2026-109619 (collectively dubbed “php2shell”) are critical security vulnerabilities in PHP, the programming engine that powers millions of websites and web applications (like WordPress, Drupal, and custom backend systems).
Both flaws allow an unauthenticated attacker over the internet to perform Remote Code Execution (RCE)—meaning a hacker can trick a vulnerable server into running malicious commands, giving them control over the web server without needing a password or login.
AWS released a User Guide for Amazon Lightsail, on how to upgrade your PHP
If you are running the older Bitnami blueprint on Amazon Lightsail,, there is also a guide but the recommendation from AWS is to migrated to a Lightsail Blueprint instead.
As this site is a relatively small website and just a single instance, completing this exercise took less than 5 minutes. If you are managing multiple instances and sites, its time to review your patching and operatability.
