PHP2Shell on Amazon Linux 2: Patched PHP 7.2 (x86_64 + ARM64)

PHP2Shell on Amazon Linux 2 has no fix from AWS for PHP 7.2. CVE-2026-109618 and CVE-2026-109619 let an unauthenticated request run code on a PHP server, Amazon Linux 2 reached end of support on June 30, 2026, and the php7.2 topic in amazon-linux-extras still ships the vulnerable 7.2.34-1.amzn2. GetPageSpeed now builds a patched PHP 7.2 for Amazon Linux 2 on both x86_64 and AWS Graviton (aarch64). It upgrades Amazon’s packages in place, with the same names, paths and extensions.

CVE-2026-109618  RCE via out-of-memory corruption   CVSS v4.0 9.2
CVE-2026-109619  RCE via stale global state         CVSS v4.0 9.2
Amazon Linux 2:  only the php8.2 extras topic is fixed (ALAS2PHP8.2-2026-015)
PHP 7.2 fix:     GetPageSpeed 7.2.34-33.amzn2, x86_64 and aarch64 (Graviton)

How to fix PHP2Shell on Amazon Linux 2 with PHP 7.2

If your instance runs PHP 7.2 from amazon-linux-extras (php-cli-7.2.34-1.amzn2), upgrade it in place:

sudo yum -y install https://extras.getpagespeed.com/release-latest.rpm
sudo yum -y update getpagespeed-extras-release
sudo amazon-linux-extras install -y epel
sudo yum --enablerepo=getpagespeed-extras-php72 upgrade 'php-*'
sudo systemctl restart php-fpm

The commands do the following:

1. Install the GetPageSpeed release package, or update it to 11-93 or later if it is already installed. Earlier releases only define the PHP 7.2 channel on aarch64.
2. Enable EPEL, which provides libargon2 for the password_hash() Argon2 support.
3. Upgrade every installed php-* package from the getpagespeed-extras-php72 channel.
4. Restart PHP-FPM. If you run Apache with mod_php, restart httpd instead.

Your php.ini, php.d/*.ini and PHP-FPM pool files are kept, because the package names do not change. Then confirm the build:

php -v

PHP 7.2.34 (cli) (built: Oct 26 2026 16:38:10) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Built by GetPageSpeed LLC
Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies
    with Zend OPcache v7.2.34, Copyright (c) 1999-2018, by Zend Technologies

The commands are identical on x86_64 and Graviton: yum picks the right architecture from $basearch.

Keep receiving PHP 7.2 security updates

The channel is disabled by default, so a plain yum update does not see it. On an instance that runs PHP 7.2 only, enable it permanently so yum update and yum-cron pick up the next security build:

sudo yum-config-manager --enable getpagespeed-extras-php72

The channel carries nothing but PHP 7.2 and has a higher priority than Amazon’s repositories, so it never pulls Amazon’s older PHP back in.

New PHP 7.2 install on Amazon Linux 2

On a fresh instance, install the packages you need directly:

sudo yum -y install https://extras.getpagespeed.com/release-latest.rpm
sudo amazon-linux-extras install -y epel
sudo yum --enablerepo=getpagespeed-extras-php72 install php-cli php-fpm php-mysqlnd php-gd php-intl php-mbstring php-opcache php-xml php-zip
sudo systemctl enable --now php-fpm

PHP 7.2 side by side with another PHP (software collection)

The same build also ships as a Remi-style software collection, php72-php-*, installed under /opt/remi/php72. It lives next to whatever system PHP you have and comes from the main getpagespeed-extras repository, so no channel needs enabling:

sudo yum -y install https://extras.getpagespeed.com/release-latest.rpm
sudo amazon-linux-extras install -y epel
sudo yum -y install php72-php-cli php72-php-fpm php72-php-mysqlnd php72-php-gd
sudo systemctl enable --now php72-php-fpm
scl enable php72 -- php -v

Use this shape when you migrated Remi’s php72 collection from CentOS 7, or when one application must stay on PHP 7.2 while the rest of the instance moves on.

Is your Amazon Linux 2 PHP vulnerable to PHP2Shell?

List your PHP packages:

rpm -qa 'php*-common' --qf '%{NAME}-%{VERSION}-%{RELEASE}\n'

Compare the result with what AWS and GetPageSpeed ship for Amazon Linux 2:

The PHP 7.2 build is the only GetPageSpeed PHP for Amazon Linux 2 today. PHP 7.3, 7.4, 8.0 and 8.1 are patched for CentOS 7, but those builds are not published for Amazon Linux 2. If you need one of them on Amazon Linux 2, tell us which version and architecture: the PHP 7.2 lane exists because a customer asked for it.

What PHP2Shell is

The PHP security team published two critical advisories on October 21, 2026, and researchers named the pair PHP2Shell.

CVE-2026-109618 is remote code execution via out-of-memory corruption. PHP handles an out-of-memory error by jumping out of whatever it was doing. If that happens during request startup, for example while parsing a multipart upload, the request data is left half initialised and the cleanup that follows trusts it.

CVE-2026-109619 is remote code execution via stale global state. Some request-owned state survives after its memory has been freed, and the next request served by the same worker can use it before normal initialisation resets it.

Both rate CVSS v4.0 9.2 and need no authentication. Every PHP web SAPI is affected: PHP-FPM, Apache mod_php and php-cgi. The PHP project fixed only 8.2 and later, and released no fix at all for PHP 7.3 and older. The full background, including the interim php.ini mitigations and why they are only partial, is in PHP2Shell on CentOS 7.

Why Amazon Linux 2 PHP 7.2 is stuck

Amazon Linux 2 reached end of support on June 30, 2026. AWS still published one PHP2Shell advisory for it, ALAS2PHP8.2-2026-015, which moves the php8.2 extras topic to the fixed upstream 8.2.35. Its CVE tracker lists the core Amazon Linux 2 php as “No Fix Planned”, and the older php7.2 to php8.1 topics get no advisory at all. Their last builds predate the disclosure.

Moving a PHP 7.2 application to PHP 8.2 is a code migration, not a package update: removed functions, changed type juggling, and extensions that need newer releases. Moving the whole instance to Amazon Linux 2023 is bigger still. Neither fits into the days after a remote code execution is disclosed and exploited in the wild.

The GetPageSpeed build closes the gap without touching the application. It keeps PHP 7.2.34 and its ABI, and only adds the security fixes.

What the GetPageSpeed PHP 7.2 build contains

The Amazon Linux 2 packages come from the same source as the GetPageSpeed PHP 7.2 build for CentOS 7 and carry the same security stack:

• the PHP2Shell fix for CVE-2026-109618 and CVE-2026-109619, ported from the official PHP 7.4 fix;
• the 2024 to 2026 PHP security fixes that the 7.2 branch never received upstream;
• the October 2026 security batch, ported to 7.2 (mysqlnd, OpenSSL hostname checks, SOAP, phar, stream filters, FastCGI ACLs and HTTP redirects).

The CentOS 7 page lists every CVE the build fixes.

Each build was installed on clean amazonlinux:2 systems on both architectures, as a fresh install and as an in-place upgrade over Amazon’s php-7.2.34-1.amzn2, and yum downgrade back to Amazon’s packages was tested too. The fresh install loads gd with WebP, intl with ICU 69, zip, mysqlnd, pdo_mysql, curl, openssl and OPcache.

Oracle (oci8). php-oci8 and php72-php-oci8 link against Oracle Instant Client 21 on x86_64. Instant Client 21 does not exist for ARM Linux, so on Graviton they link against Instant Client 19 (libclntsh.so.19.1). Install the matching oracle-instantclient-basic from Oracle: GetPageSpeed does not redistribute Oracle’s libraries.

Rollback and caveats

yum downgrade returns you to Amazon’s packages while the php7.2 extras topic is enabled:

sudo yum downgrade 'php-*'
sudo systemctl restart php-fpm

One behaviour changes. A request that hits memory_limit now ends its PHP worker immediately: shutdown functions do not run and buffered output is not sent. The PHP security team made the same trade in its own end-of-life backports, because unsafe unwinding after an out-of-memory error is exactly what PHP2Shell abuses. PHP-FPM starts a new worker, so the site keeps serving.

Reading TIFF images with gd does not work against the libtiff 4.0.3 that Amazon Linux 2 ships. JPEG, PNG, GIF and WebP are unaffected.

Amazon Linux 2 itself remains end of life. This build keeps the PHP layer patched; it does not make the operating system supported. Plan the move to Amazon Linux 2023 or another supported distribution, but don’t run an exposed PHP while you plan it.

FAQ

Does this work on AWS Graviton (arm64) instances?

Yes. The same 7.2.34-33.amzn2 release is built natively for aarch64 and x86_64, so the install commands work unchanged on Graviton instance families such as t4g, m6g, c7g and r8g.

Is Amazon Linux 2 PHP 7.4 or 8.1 patched?

Not by AWS. The php7.4 and php8.1 extras topics have no PHP2Shell advisory, and GetPageSpeed builds only PHP 7.2 for Amazon Linux 2 today. On PHP 8.x the shortest path is switching to the fixed php8.2 topic. For PHP 7.4 or 8.1 on Amazon Linux 2, contact us.

Will my existing php.ini and PHP-FPM pools survive the upgrade?

Yes. The GetPageSpeed packages use Amazon’s package names, file paths and configuration file markings, so yum upgrade replaces the binaries and keeps every modified configuration file.

Do I need a GetPageSpeed subscription for the PHP 7.2 fix?

Not for personal, development or evaluation use: the packages install from the public GetPageSpeed repository with no signup. Commercial production use on your own servers requires GetPageSpeed Ultra ($500/year, up to 10 servers) under the repository terms. Agencies that administer client instances need GetPageSpeed Fleet.

Is setting session.upload_progress.enabled=0 enough?

No. It blocks one confirmed path for CVE-2026-109619 and does nothing for CVE-2026-109618. The PHP security team says only an update is a complete fix.

Conclusion

PHP2Shell on Amazon Linux 2 leaves PHP 7.2 users without a vendor fix: the OS is past end of support, and AWS patched only the php8.2 topic. The GetPageSpeed php72 channel upgrades Amazon’s PHP 7.2 in place to a patched 7.2.34-33.amzn2 on x86_64 and Graviton alike, with one yum transaction and a PHP-FPM restart.

Running Amazon Linux 2 for a business? Every new PHP CVE has to be ported again to a branch upstream abandoned years ago. GetPageSpeed Ultra funds that work and keeps up to 10 of your servers patched for the next one, together with the full GetPageSpeed repository of NGINX builds and modules for Amazon Linux.