PHP于2026年10月20-21日发布了修复两个远程代码执行漏洞的安全更新，两个CVE的CVSS v4.0评分均为9.21。这两个漏洞分别为CVE-2026-109618和CVE-2026-109619，影响PHP 8.2至8.5版本，允许未认证的远程攻击者崩溃PHP工作进程1。
尽管漏洞评分达到9.2的严重程度，AWS在其Amazon Linux安全中心将这两个CVE标记为"Important"等级而非"Critical"1。AWS官方声称"可达到的攻击场景范围较窄，在实际中难以被利用"1。这一评定导致Amazon Linux 2023的PHP补丁发布计划推迟至2026年10月22日，引起用户的广泛不满1。AWS Elastic Beanstalk和AWS Lightsail等服务受到影响1。AWS随后发布公告确认将按目标日期发布更新补丁1。
PHP released two remote code execution vulnerabilities with CVSS 9.2 severity ratings on October 20-21, 2026, affecting versions 8.2 through 8.5 1. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote attackers to crash PHP worker processes 1. However, AWS assigned both vulnerabilities an "Important" rather than "Critical" rating within its Amazon Linux Security Center, pushing the patch release for Amazon Linux 2023 to October 22, 2026 1. According to AWS, the "reachable scenarios are narrow and assessed as difficult to leverage in practice" 1, a characterization that prompted significant user backlash.
AWS subsequently issued a statement confirming it would deliver the patch by the target date of October 22, 2026 1. The delay affects multiple AWS services, including AWS Elastic Beanstalk and AWS Lightsail 1. The classification discrepancy—treating severe remote code execution flaws as "Important" rather than "Critical"—drew criticism from the community over the adequacy of the severity assessment and the resulting patch timeline.
评论
还没有评论，欢迎留下第一条。