AWS WAF issues official PHP2Shell guidance

Unless you have been living under a rock, you likely have heard about the PHP2Shell vulnerability that went public early last Wednesday, which affects about 69% of the servers that make up the internet.

A vulnerability so bad and wide-ranging that the NSA has advised people to patch it or take down your servers.

Hopefully, for your sake, you were able to get your servers patched last week. If for any reason you are still working on patching your servers and are running on AWS, they have issued official guidance on how to set up rules to help mitigate the attack:

https://aws.amazon.com/blogs/security/using-aws-waf-to-apply-mitigations-for-php2shell-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/

To be clear, this IS NOT A REPLACEMENT FOR PATCHING only a stopgap. Where there is a will, there is a way, and nefarious actors on the internet are incredibly persistent.

Even if you already patched, you might want to turn it on in count mode to see who is trying to exploit your servers.

Sorry I didn’t get to this post earlier, but as you can imagine, last week I was pretty busy making sure a lot of things were either patched, locked down, or shut down.

Good luck and stay safe.