AWS Security Digest·Week 43 of 2026·Oct 19-25, 2026·17 items
PHP2Shell Seen Before Disclosure, a CA Key Failure and 11 AWS Bulletins
Eleven new AWS security bulletins this week. The lead is PHP2Shell, two PHP remote code execution flaws that Amazon Threat Intelligence says it saw attempted four days before public disclosure, followed by a bulletin on three roots being removed from AWS trust bundles after eMudhra intermediate CA keys proved recoverable, and an end-of-life Multi Model Server with no fix. On the defensive side, GuardDuty Runtime Monitoring gained optional detection rules and IAM Identity Center now keeps identities when you leave Active Directory.
In this issue3critical7high1medium6info
Highlights
3 items
$ tail -f /var/log/aws-security.log
critical/CVE/
PHP2Shell: Two PHP Remote Code Execution Flaws, Fixed Upstream, With an Exploitation Attempt Seen Four Days Before Disclosure
AWS Security Bulletin 2026-143-AWS covers two flaws in PHP web runtimes, CVE-2026-109618 and CVE-2026-109619, that the bulletin says can let an unauthenticated actor run code on affected PHP workers through crafted web requests. The bulletin states that AWS services are not impacted. Customers running affected PHP versions inside the listed services could be: Amazon EMR on EC2 clusters with Ganglia (releases 4.2.0 to 6.15.0), Elastic Beanstalk, Lambda functions that bring their own PHP (AWS Lambda has no managed PHP runtime), Amazon Linux and Lightsail.
The fixed PHP releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 5.4 to 8.1 are end of life, and bulletin 143 says no upstream fix was released for them; the AWS WAF post, updated on October 29, says the PHP security team has since published source backports for 7.4, 8.0 and 8.1. AWS says upgrading is the only complete fix. NVD has analyzed both CVEs: its CVSS 3.1 scores are 9.8 and 8.1, and the PHP project's own CVSS 4.0 score is 9.2 for both.
Amazon Threat Intelligence reports that MadPot telemetry shows a PHP2Shell exploitation attempt dated October 17, four days before the October 21 public disclosure. The post says it remains unclear how the actor acquired exploit information before disclosure. It describes proof-of-concept activity from around 02:00 UTC on October 21, about 12 hours before the 14:00 UTC release, with varied payloads that it says suggest multiple actors, and says it is unclear whether any of those attempts would have succeeded in real-world systems. It also says PHP2Shell is now seeing broad exploitation attempts in the wild, and lists indicator IP addresses and advice to investigate logs from at least October 17.
For teams that cannot patch immediately, AWS published AWS WAF mitigations. The AWSManagedRulesPHPRuleSet managed rule group added PHP2Shell_BODY in version 2.3 (October 22) and PHP2Shell_BODY_Extended in version 2.4, which became the default on October 23. Customers who pinned an older version must update it. AWS describes the rules as defense in depth, not a replacement for patching. The WAF post also describes a separate remote code execution issue, CVE-2026-115560, that the October 21 PHP releases do not fix. The post says it affects an uncommon configuration with session upload progress enabled and that PHP2Shell_BODY in rule group version 2.4 or later helps mitigate it. NVD had no record for it when we checked on October 29.
Affected
PHP 8.5.0 to 8.5.11, 8.4.0 to 8.4.26, 8.3.0 to 8.3.35 and 8.2.0 to 8.2.34
PHP 5.4 to 8.1 (end of life; no new upstream release, source backports published for 7.4, 8.0 and 8.1 per the Oct 29 update of the AWS WAF post)
Amazon EMR on EC2 releases 4.2.0 to 6.15.0 launched with Ganglia (EMR 7.0.0 or later, EMR on EKS and EMR Serverless are not affected)
Fixed In
PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35
Elastic Beanstalk: updated PHP platform versions (8.2 through 8.5)
Amazon Linux: updated PHP packages
Lightsail: new instances from updated blueprints (running instances cannot be updated in place)
EMRElastic BeanstalkLambdaLightsailWAF
high/Incident/
AWS Is Removing Three Roots Tied to the Weak eMudhra Intermediate CA Keys From Its Trust Bundles
AWS Security Bulletin 2026-150-AWS (published October 24, updated October 29) describes CVE-2026-111943, a key-generation failure at an external certificate authority, eMudhra (emSign). According to the bulletin, eight intermediate CA private keys (six for TLS, two for code signing) were generated with scalar values of small integers, which made them mathematically recoverable without specialized tooling. The issuing CA revoked the affected intermediates on October 18 and the cross-signing CA revoked its copies on October 19. AWS says customers whose TLS clients enforce revocation checking (OCSP or CRL, fail-closed) are not affected.
AWS is responding by removing the three roots the bulletin lists as affected (AAA Certificate Services, emSign Root TLS CA - G3 and emSign ECC Root CA - G3) from the AWS-owned trust bundles that its services use to validate outbound TLS connections to customer-configured endpoints, such as identity provider endpoints, origin servers and webhook destinations. The bulletin lists a rollout per service. As of its October 29 update, STS and Cognito had finished deploying, and CloudFront, Application Load Balancer, RDS for SQL Server, EMR, Lambda, Amplify and CodeBuild had dates running from October 28 to November 2.
What to check: any Application Load Balancer using OIDC or JWT authentication whose identity provider certificate chains to one of the affected roots (the bulletin asks customers to replace it with a certificate from an AWS-trusted CA by October 28, a date that had already passed on October 29); CloudFront origins whose certificates chain to those roots, which may fail validation as the roots are removed; the ca-certificates package on Amazon Linux 2 and 2023; botocore 1.43.117 or later; Lambda container images, which should be rebuilt and redeployed; EKS nodes on AL2023 AMI release v20261023 or later; Bottlerocket nodes on EKS or ECS at AMI v1.67.0 or below until updated AMIs ship (the bulletin gives an interim per-node trust override); and EC2 Windows Server instances that may not have received Microsoft's updated certificate trust lists. AWS Health notifications are going to affected ALB and CloudFront customers. The bulletin text changed after the end of this week, so check the live bulletin for current status.
NVD's record for CVE-2026-111943 describes a Go crypto/x509 denylist change, carries no score and does not mention eMudhra, so the bulletin is the primary source here.
Affected
Trust bundles that include the roots AAA Certificate Services, emSign Root TLS CA - G3 and emSign ECC Root CA - G3 (eight intermediate CA keys were recoverable)
Fixed In
botocore 1.43.117 or later (AWS SDK for Python used directly in Lambda: 1.43.118 or above)
Amazon Linux 2 and 2023: updated ca-certificates package
EKS-optimized AL2023 AMI release v20261023 or later
AWS Security Bulletin 2026-148-AWS covers two issues in Amazon Web Services Multi Model Server (MMS), an open-source model-serving tool that AWS published on GitHub, PyPI and Docker Hub and that has reached end of life. Its source repository has been archived and read-only since November 20, 2025. CVE-2026-115812 is an archive-extraction issue where a crafted model archive could write files outside the intended directory, potentially resulting in code execution with the privileges of the MMS process. CVE-2026-115813 is an issue in the model download path that could let the management interface be directed to make requests to unintended network destinations.
The bulletin says the MMS management interface does not require authentication, so deployments that bind it to a network-accessible address are at increased risk. AWS, acting as the CNA, scores CVE-2026-115812 at 9.8 under CVSS 3.1 and CVE-2026-115813 at 5.8. NVD had not analyzed either record when we checked on October 29.
There is no fixed version, and none is planned on any distribution channel. AWS recommends discontinuing MMS and migrating to a supported model-serving solution. The suggested workaround, binding the management interface to the loopback address, is not available in the configuration shipped for SageMaker-style deployments, which binds management to all addresses on the same port as inference. In that case the bulletin says to prioritize migration and, in the interim, make sure the serving port is reachable only by trusted callers.
Affected
Multi Model Server <= 1.1.11 (all released versions)
Fixed In
No fixed version: end of life. Migrate to a supported model-serving solution.
SageMaker
CVEs & Vulnerabilities
8 items
$ cat /var/reports/CVE_REPORT.txt
critical/CVE/
CVE-2026-112380: Missing Authorization in the WhatsApp Channel of Kiro Crew Lets a Group Member Instruct Another Session's Subagent
Kiro Crew is an open-source personal AI agent that can be reached from a web dashboard, a CLI or messaging channels such as WhatsApp, and that runs tools on the operator's machine. In certain configurations, where a WhatsApp group was added to the operator's allowed groups or where the direct-message policy was set to open, a member of that group could send instructions to another session's subagent. The subagent executed them on the operator's machine under that session's approval policy, and the audit trail was attributed to the operator rather than the actual sender.
The default configuration is not affected: whatsapp.groups defaults to empty and whatsapp.dm_policy defaults to self. AWS, as CNA, scores the issue 9.9 under CVSS 3.1; NVD lists the record as deferred. The workaround is to remove every entry from whatsapp.groups and keep whatsapp.dm_policy at self, or to disable the WhatsApp channel until you upgrade.
Affected
Kiro Crew >= 0.4.0 and < 0.7.2 (default configuration not affected)
Fixed In
Kiro Crew 0.7.2
Kiro Crew
high/CVE/
CVE-2026-112408: SageMaker Python SDK default_bucket() Does Not Check That Your Account Owns the Bucket
The default_bucket() function of the Amazon SageMaker Python SDK uses a predictably named S3 bucket and does not check that the caller's AWS account owns it. A remote actor who creates that bucket first could achieve code execution in a remote SageMaker execution environment and obtain IAM credentials.
AWS, as CNA, scores it 8.1 under CVSS 3.1 and 9.4 under CVSS 4.0; NVD has not analyzed it. If you cannot upgrade, pass an S3 bucket that your account owns explicitly through the default_bucket parameter of sagemaker.Session or through the SDK configuration file, and do not rely on the auto-generated default bucket name. AWS credits Dan Gansel of Upwind Security.
Affected
SageMaker Python SDK V2 before 2.257.3
SageMaker Python SDK V3 from 3.0.0 before 3.10.0
Fixed In
SageMaker Python SDK 2.257.3 (V2) or 3.10.0 (V3)
SageMakerS3
high/CVE/
CVE-2026-112407: Incorrect IAM Privilege Assignment in the AWS CICD-toolchain-for-serverless-applications Sample
CICD-toolchain-for-serverless-applications is an AWS sample application that provisions a CI/CD pipeline for serverless applications through the AWS Serverless Application Repository. Its IAM policy in versions before 1.0.11 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the application stack in the same AWS account, via application templates deployed by the toolchain pipeline.
There is no workaround. AWS recommends upgrading existing toolchain stacks to 1.0.11 or later. AWS, as CNA, scores it 8.8 under CVSS 3.1. The bulletin credits Changli of Xidian University.
Affected
CICD-toolchain-for-serverless-applications 1.0.7 to 1.0.10
Fixed In
CICD-toolchain-for-serverless-applications 1.0.11
Serverless Application RepositoryIAM
high/CVE/
CVE-2026-115414: OS Command Injection in the AWS SAM CLI Terraform Hook
The Terraform hook of AWS SAM CLI (sam build --hook-name terraform) generates a Makefile recipe that interpolates a Terraform resource address without fully neutralizing shell metacharacters. An actor who can influence the Terraform configuration or plan file consumed by a build could execute arbitrary commands as the build user on the host that runs the build.
The workaround is to make sure that the Terraform configuration and plan files used by the hook come only from trusted sources, and to audit third-party Terraform modules and shared repositories that feed the build. AWS, as CNA, scores it 7.8 under CVSS 3.1. The bulletin credits Shubham Raj of Cipher by Causal Security.
Affected
AWS SAM CLI >= 1.63.0 and <= 1.166.1
Fixed In
AWS SAM CLI 1.166.2
SAM CLITerraform
high/CVE/
CVE-2026-115419: Strands Agents A2A Server Did Not Isolate Conversation State Between Callers
The Agent2Agent (A2A) server component of the Strands Agents SDK exposes an agent over HTTP so that other agents and clients can call it. The server did not properly isolate conversation state between callers, so an authenticated remote user could access another caller's conversation history or influence model behavior for other callers in multi-tenant deployments.
No workaround fully addresses the issue. Until you upgrade, do not expose an A2A server to more than one user or tenant; if several callers need access, run a separate A2A server instance for each. The fixed versions isolate conversation state per A2A context_id. AWS, as CNA, scores it 8.1 under CVSS 3.1.
Affected
strands-agents (Python) before 1.43.0, all versions containing the multiagent.a2a module
@strands-agents/sdk (TypeScript) before 1.5.0
Fixed In
strands-agents 1.43.0
@strands-agents/sdk 1.5.0
Strands Agents
high/CVE/
CVE-2026-115417: Excessive Memory Allocation in the MQTT 3.1.1 Compatibility Adapter of aws-c-mqtt
aws-c-mqtt is a C99 implementation of MQTT 3.1.1 and MQTT5 that ships in the AWS Common Runtime and is bundled in the AWS IoT Device SDK for C++ v2. Under certain conditions, a memory allocation with an excessive size value (CWE-789) in the library's MQTT 3.1.1 compatibility adapter lets a remote actor cause a denial of service of the client process.
AWS recommends connecting only to trusted MQTT brokers (for example AWS IoT Core, which enforces the negotiated maximum packet size) and using TLS, and, where feasible, avoiding the 3.1.1 compatibility adapter in favor of a native MQTT5 or MQTT 3.1.1 client. Upgrading is the complete remediation. AWS, as CNA, scores it 7.5 under CVSS 3.1. The bulletin credits Eunho Kim.
Affected
aws-c-mqtt >= 0.9.1 and < 0.16.2
Fixed In
aws-c-mqtt 0.16.2
AWS IoTAWS Common Runtime
high/CVE/
CVE-2026-115416: Athena Engine Version 3 Query Metadata Could Be Read Across AWS Accounts (Fixed by AWS)
Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text (query metadata) from other AWS accounts. According to the bulletin, query results and data stored in Amazon S3 or other data sources were not accessible through this issue.
AWS remediated the issue on October 7, 2026, and no customer action is required. AWS, as CNA, scores it 7.7 under CVSS 3.1; NVD lists the record as deferred.
Affected
Amazon Athena engine version 3
Fixed In
Remediated by AWS on October 7, 2026; no customer action
Athena
medium/CVE/
CVE-2026-115845: Incomplete Input Validation in the run_script Sandbox of AWS MCP Server (Fixed by AWS)
AWS MCP Server is a managed server that gives AI agents access to AWS through the Model Context Protocol, including a run_script tool that runs Python scripts in a sandboxed environment. An incomplete list of disallowed inputs in the tool's Python code validator might allow an authenticated remote user to execute arbitrary code within their own isolated session environment through a crafted script.
AWS addressed the issue service-side and no customer action is required. AWS, as CNA, scores it 6.4 under CVSS 3.1.
Affected
AWS MCP Server (managed service, exclusively hosted)
GuardDuty Runtime Monitoring Adds More Than 50 Optional Detection Rules and Four New Finding Types
AWS says GuardDuty Runtime Monitoring now supports more than 50 optional rules for process, file and network activity, such as modifying sudoers files or disabling audit logging, across EC2, EKS, and ECS on EC2 and Fargate. The rules span 13 finding types mapped to MITRE ATT&CK tactics. Four finding types are new: CommandAndControl:Runtime/SuspiciousCommand, CredentialAccess:Runtime/SensitiveFileRead, Discovery:Runtime/SensitiveFileRead and Exfiltration:Runtime/SuspiciousCommand. Rules can be enabled in dry-run mode before they produce findings. The announcement says the capability is available in all commercial Regions and GovCloud (US).
GuardDuty
info/Feature Launch/
IAM Identity Center Keeps Users, Groups and Assignments When You Move Away From Active Directory
Changing the identity source of IAM Identity Center from Active Directory to an external identity provider (such as Okta or Entra ID) or to the Identity Center directory now retains users, groups, group memberships, permission set assignments and application assignments. AWS says you previously had to recreate them. The identity store and its IDs stay the same, so policies that reference those IDs keep working. AWS says this applies to organization instances of IAM Identity Center. Moving to Active Directory works as before and still removes users, groups and assignments. AWS also republished its Security Blog post on this transition on October 20 and recommends a dress rehearsal before the cutover.
IAM Identity Center
info/Feature Launch/
IAM Identity Center Identity Store Adds Optimistic Locking With a Revision Value
Users and groups in the Identity Store now carry a Revision value that changes on every attribute modification, whether it comes from SCIM, Active Directory sync or the console. You can pass the Revision on UpdateUser, UpdateGroup, DeleteUser and DeleteGroup; a mismatch returns a ConflictException. It is optional, supported through the Identity Store API and not through the SCIM endpoint, and group membership operations do not accept or change it.
IAM Identity Center
info/Feature Launch/
Network Firewall Domain Filtering Now Validates Resolved IPs Against Route 53 and Covers SFTP and SSH
AWS Network Firewall can now validate that the destination IP of a connection was resolved through the VPC's Route 53 Resolver, which AWS says extends domain-based filtering beyond HTTP and HTTPS to protocols such as SFTP and SSH and simplifies protection against SNI spoofing by checking resolved IPs against the SNI. It is available in commercial Regions where Network Firewall and Route 53 Resolver DNS Firewall are available, at no extra charge.
Network FirewallRoute 53
info/Feature Launch/
AWS Service Reference Information Adds Global Condition Keys, Service Names and a Data-Plane Flag
The machine-readable AWS Service Reference now includes all aws:-prefixed global condition keys in one file, a ServiceName field, and an IsDataPlane property that marks data-plane actions. It is useful for tooling that writes or checks IAM policies. There is no cost.
IAM
info/Feature Launch/
AWS Continuum for Code Vulnerabilities Is Generally Available (Vendor Claims)
AWS announced general availability of AWS Continuum for code vulnerabilities. AWS describes it as building a context graph of resource topology, identity relationships and network reachability, ingesting existing findings, scanning code, confirming exploitability in an isolated sandbox and prioritizing by business impact, then proposing fixes as pull requests with exploitability proof and blast radius. It has a Learn mode, where you approve fixes, and an Enforce mode, where it acts within guardrails, and works alongside GuardDuty and Security Hub. These are AWS's own descriptions; the announcement gives no measurements and we have not tested the product.
AWS ContinuumGuardDutySecurity Hub
Key Takeaway
1 item
$ cat WEEKLY_SUMMARY.md
If you run PHP anywhere in your accounts, including a custom Lambda runtime, Elastic Beanstalk or Lightsail, check the version against 8.5.12, 8.4.27, 8.3.36 and 8.2.35 first, and treat AWS WAF as a stopgap. Then check what depends on the three affected roots: Application Load Balancers using OIDC or JWT authentication, CloudFront origins, and the ca-certificates package and botocore version on your hosts. If you still serve models with Multi Model Server, plan the migration now, because no fix will come.
These weekly digests are a starting point. Contact us for tailored threat briefings, security assessments, and architectural guidance for your AWS environment.
