Status — 29 October 2026: patched replacement AMIs are now available on AWS Marketplace. Existing servers should still be checked and updated promptly; a new AMI does not update a running server.
AWS and the PHP project have disclosed two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Crafted requests reaching an affected PHP runtime can allow unauthenticated remote code execution.
Although Koha uses Perl, servers may also have PHP components installed. Check the installed PHP packages and update affected components. The presence of PHP packages alone does not establish that a server exposes a vulnerable PHP endpoint or has been compromised.
What existing customers should do
Update PHP on your running server. Publishing a new image does not update existing servers.
For Ubuntu 26.04 with PHP 8.5, take a current backup, then run the following through AWS Systems Manager Session Manager or your normal administrative connection. Restarting Apache briefly interrupts web requests.
sudo apt-get update
sudo apt-get install --only-upgrade \
libapache2-mod-php8.5 php8.5 php8.5-cli php8.5-common \
php8.5-mysql php8.5-readline
sudo apache2ctl configtest && sudo systemctl restart apache2
dpkg-query -W -f='${Package} ${Version}\n' \
libapache2-mod-php8.5 php8.5-common php8.5-cli
sudo systemctl is-active apache2
All three reported PHP packages must be 8.5.4-0ubuntu1.5 or later, and Apache must report active. Afterward, check your public catalogue and staff interface. If a command fails, Apache does not restart, or packages remain below the fixed version, contact KohaSupport.
apt-get update alone does not install the fix. It refreshes the package index. The installation command applies the updates, and restarting Apache loads the updated PHP module.
Ubuntu backports security fixes. PHP can still display version 8.5.4 after patching; check the full package revision rather than relying on php -v or the unversioned php metapackage.
Other Ubuntu and PHP versions
Ubuntu lists the following fixed package revisions for both vulnerabilities. Use the versions matching your server’s Ubuntu release and PHP branch.
| Ubuntu release | PHP branch | Fixed Ubuntu package version |
|---|---|---|
| 26.04 LTS | 8.5 | 8.5.4-0ubuntu1.5 |
| 24.04 LTS | 8.3 | 8.3.6-0ubuntu0.24.04.13 |
| 22.04 LTS | 8.1 | 8.1.2-1ubuntu2.28 |
Do not copy the PHP 8.5 commands onto a server using another branch. If you use another Ubuntu release, multiple PHP versions, PHP-FPM, additional PHP extensions, or third-party repositories, contact support for the corresponding package and worker-restart checks.
Replacement images
Patched replacement AMIs are now available on AWS Marketplace for Free x86, Basic ARM64 and x86, Standard ARM64 and x86, and Enterprise ARM64. These images include PHP packages at the fixed revision 8.5.4-0ubuntu1.5.
For new deployments, choose the latest AMI version on your AWS Marketplace product page. Existing servers still need their own PHP updates; publishing a new image does not update a running installation.