PHP Vulnerability Assessment and Remediation on AWS by Firemind

Overview: When a critical flaw lands in PHP itself, every PHP application is exposed, however well its own code is written. The first question is always the same: where does PHP run in our estate? Built on Firemind's IT Operations Engine, this service answers it from your AWS accounts, fixes what can be fixed, and keeps watching so the exposure stays closed.

Current advisory: PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Two critical flaws in PHP allow unauthenticated remote code execution and the reading of secrets from server memory. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older receive no official fix. CERT-EU advises organisations to find their PHP applications first.

Where PHP hides on AWS

• Amazon EC2 servers running PHP from operating-system packages
• Containers on Amazon ECS, Amazon EKS, AWS Fargate and AWS App Runner built on PHP, WordPress or Drupal images
• AWS Elastic Beanstalk PHP environments and Amazon Lightsail WordPress and LAMP servers
• AWS Lambda functions using a custom PHP runtime, which are easy to forget
• Firewall, phone-system and server-management appliances launched from AWS Marketplace machine images. They bundle their own PHP and are often reachable on an admin login page

What you receive

• Find. An inventory of every PHP runtime in scope, with its version, exposure (internet-facing or internal) and fix status. It's built from Amazon Inspector findings, AWS Systems Manager Inventory, container image metadata and your code repositories, not from questionnaires. Machine and container images held in your AWS accounts are also inspected from the inside, with access you grant during onboarding, including the keys for any encrypted images.
• Fix. Patching through AWS Systems Manager Patch Manager, base-image updates and redeployment for containers, and runtime updates for Lambda. Where a patch has to wait, PHP's interim configuration mitigations are pushed through Systems Manager and AWS WAF rules are added in front of exposed sites. Because the flaws can leak memory, secrets those processes could see are rotated, and AWS CloudTrail is reviewed for unusual activity from the affected roles.
• Keep green. Continuous checks that patched versions stay patched and that new instances, images and functions don't reintroduce an exposed version, with drift flagged and fixed under the same rules.

What stays out of scope

Appliances keep their PHP inside the vendor's sealed image, so they're found, reported and tracked against the vendor's fix rather than patched by us. Sites hosted for you by agencies or third parties sit outside your AWS estate. They're listed for you to raise with the provider.

How it works

1. Connect. After the private offer is accepted, you deploy an IAM role using AWS CloudFormation. A full description of the role and its policy statements is provided before deployment. The Engine works through the AWS API under temporary credentials, and every action is recorded in your own AWS CloudTrail.
2. Scan. The first exposure report is ready within days of connection.
3. Heal. Fixes run inside your change rules. Low-risk, reversible changes run automatically. Higher-risk changes, such as restarting production services or taking a site offline, wait for a named approver.
4. Monitor. Keep-green checks run continuously for the term you choose.

Deployment: Pilot scopes run from Firemind's AWS environment. In production the Engine runs inside your own AWS accounts. Running the Engine in your accounts may incur AWS infrastructure charges, for example Amazon Bedrock and compute. These are billed separately from this AWS Marketplace transaction and are your responsibility.

Pricing: Delivered through an AWS Marketplace private offer, scoped to your estate. Assessment, remediation and keep-green monitoring can be contracted together or separately. Contact hello@firemind.com  to scope.

About Firemind: AWS Premier Tier Services Partner. 200+ clients since 2018, ISO 27001 certified, in partnership with AWS, NVIDIA and Anthropic. Core markets: UK and Ireland, Finland, Germany and the Netherlands.