cloud (IaaS)

Amazon Web Services: security status

customer-managedofficial notice · 2026-10-22

Summary

AWS bulletin 2026-143-AWS (published Oct 21, updated Oct 22): AWS services themselves are not impacted. Amazon WorkMail has been upgraded to PHP 8.3.36 with no customer action. Elastic Beanstalk has patched platform versions for PHP 8.2-8.5, applied automatically when Managed Platform Updates is on. Amazon Linux has updated PHP packages (no version numbers given). Lightsail has updated blueprints, but running instances cannot be updated in place. Lambda has no managed PHP runtime; custom runtimes and container images are the customer's job. PHP 5.4-8.1 have no fix.

Customer action:

If PHP runs on EC2, Lightsail or Lambda, ask your administrator or agency to update to 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or later. Lightsail needs a new instance from the updated blueprint and a migration. Elastic Beanstalk without Managed Platform Updates must update the platform version. PHP 8.1 and older have no fix; move to a supported branch.

Source: https://aws.amazon.com/security/security-bulletins/2026-143-aws/
Verified: 2026-10-24

IaaS. On EC2 and Lightsail the customer runs PHP; WorkMail and Elastic Beanstalk platforms are updated by AWS.

How this tool recognises the provider

AS numbers: AS16509AS14618
Text in the AS name: AMAZON-
Name servers: *awsdns*
CNAME: *.cloudfront.net*.amazonaws.com
Mail servers: *.amazonaws.com

Report a correction (GitHub)