Amazon Linux 2のPHP 8.2 Extraに出たphp2shell（CVE-2026-109618 / CVE-2026-109619）の修正版を、SSM Run Commandだけで適用しました。リリース当日はyum clean allを挟まないと修正版が見えなかった点と、緩和措置の解除までをまとめています。

\n","protected","

Amazon Linux 2で動かしているWordPressのサーバーに、php2shell（CVE-2026-109618とCVE-2026-109619）の修正版を適用しました。修正版が出たかの確認から緩和措置の解除まで、SSHせずにSSM Run Commandだけで済ませています。

修正版が出るまで入れていた緩和措置

PHPはamazon-linux-extrasのPHP 8.2から入れた8.2.34です。修正版が出るまでのつなぎとして、次の緩和措置を入れていました。

/etc/php.d/99-php2shell-mitigation.iniでPHP側の緩和設定

/etc/nginx/conf.d/default.confにmultipart/form-dataを403で返すルール

cronのガードスクリプト一式（/etc/cron.d/php2shell-guardから呼ばれるもの）

multipartを403で返しているので、管理画面からのファイルアップロードもできない状態です。そのため、修正版が来たら真っ先に外すつもりでリリースを待っていました。

AL2で修正が出るのはPHP 8.2のExtraだけ

Amazon LinuxのCVEページを見ると、AL2の行は2つだけです。「Amazon Linux 2 – Php8.2 Extra」はFixedで、アドバイザリはALAS2PHP8.2-2026-015、修正版はphp-8.2.35-1.amzn2.0.1です。一方、「Amazon Linux 2 – Core」はNo Fix Plannedで、PHP 7.4や8.0、8.1のExtraは行自体がありません。

つまり、yumで直せるのはextrasのPHP 8.2を使っているサーバーだけです。今回のサーバーはこれに当てはまりました。

修正版が出たかはSSM Run Commandで確認する

SSHせずに済むよう、SSM Run Commandで次の2本を定期的に実行していました。

yum --enablerepo=amzn2extra-php8.2 list available \\\n  php php-cli php-fpm php-common php-mysqlnd php-opcache \\\n  php-process php-xml php-mbstring php-gd php-intl 2>/dev/null\nyum updateinfo list --security 2>/dev/null | grep -i php | tail -10

AWS CLIからはsend-commandで実行し、get-command-invocationで結果を受け取ります。

aws ssm send-command \\\n  --region us-west-2 \\\n  --instance-ids <InstanceId> \\\n  --document-name AWS-RunShellScript \\\n  --parameters 'commands=[ ... ]'\naws ssm get-command-invocation \\\n  --region us-west-2 \\\n  --command-id <CommandId> \\\n  --instance-id <InstanceId>

リリース当日はyum clean allしないと修正版が見えなかった

アドバイザリが公開された当日に確認すると、list availableの結果は空のままでした。「298 packages excluded due to repository priority protections」という行が出るだけで、8.2.35は見つかりません。

原因はyumのメタデータキャッシュでした。yum clean allを挟んでからやり直すと、指定した11パッケージすべてに8.2.35-1.amzn2.0.1が表示されます。updateinfoのほうにもALAS2PHP8.2-2026-015 important/Sec.が出てきました。

適用から緩和解除まで

適用もSSM Run Commandから実行します。

yum update -y --advisory ALAS2PHP8.2-2026-015\nsystemctl restart php-fpm

php系の13パッケージが8.2.35-1.amzn2.0.1に上がり、php -vでもPHP 8.2.35 (cli)になっていました。続けて緩和措置を外します。

rm -f /etc/php.d/99-php2shell-mitigation.ini \\\n      /etc/cron.d/php2shell-guard \\\n      /usr/local/bin/php2shell-guard.sh \\\n      /usr/local/share/php2shell-rule.txt

nginx側は、default.confに入れたifブロックをコメント行ごと削除し、nginx -tを通してからreloadしました。編集前のファイルはdefault.conf.bak-php2shellとしてバックアップしてあります。

最後に管理画面からファイルをアップロードして、multipartのPOSTが403にならないことを確認しました。

まとめ

AL2でextrasのPHP 8.2を使っているサーバーなら、yum update --advisory ALAS2PHP8.2-2026-015とphp-fpmの再起動で修正版に上げられます。

\n","SSM Run CommandでAmazon Linux 2のPHP 8.2にphp2shellの修正版を適用する","https://wp-api.wp-kyoto.net/?p=20089&post_date=20261022112057",[],{"_91":315,"_93":316,"_95":317,"_97":318,"_99":319},[326],[325],[324],[321,322,323],[320],{"_85":102,"_103":104,"_105":106},{"_103":139},{"_103":138},{"_103":137},{"_103":114},{"_103":116},{"_103":143,"_119":327},{"_121":328},[123],{"_26":448,"_275":564,"_229":62,"_44":565,"_85":566,"_38":567,"_88":153,"_344":54,"_65":568,"_72":569},{"_26":203,"_275":547,"_229":62,"_44":204,"_85":205,"_38":206,"_88":153,"_344":54,"_65":548,"_72":549},{"_26":522,"_275":523,"_229":62,"_44":524,"_85":525,"_38":526,"_88":153,"_344":54,"_65":527,"_72":528},{"_26":345,"_275":499,"_229":62,"_44":500,"_85":501,"_38":502,"_88":153,"_344":54,"_65":503,"_72":504},{"_26":472,"_275":473,"_229":62,"_44":474,"_85":475,"_38":476,"_88":153,"_344":448,"_65":477,"_72":478},{"_26":443,"_275":444,"_229":62,"_44":445,"_85":446,"_38":447,"_88":153,"_344":448,"_65":449,"_72":450},{"_26":418,"_275":419,"_229":62,"_44":420,"_85":421,"_38":422,"_88":153,"_344":54,"_65":423,"_72":424},{"_26":393,"_275":394,"_229":62,"_44":395,"_85":396,"_38":397,"_88":153,"_344":54,"_65":398,"_72":399},{"_26":369,"_275":340,"_229":62,"_44":370,"_85":371,"_38":372,"_88":153,"_344":54,"_65":373,"_72":374},{"_26":339,"_275":340,"_229":62,"_44":341,"_85":342,"_38":343,"_88":153,"_344":345,"_65":346,"_72":347},245,92,"https://wp-api.wp-kyoto.net/category/saas-faas/cloudflare/","Cloudflare","cloudflare","parent",171,[],{"_91":348,"_93":349,"_95":350,"_183":351,"_97":352,"_99":353},[365],[364],[363],[361],[355,356,357],[354],{"_85":102,"_103":104,"_105":106},{"_103":360},{"_103":359},{"_103":358},"https://wp-api.wp-kyoto.net/wp-json/wp/v2/llms-texts?categories=245","https://wp-api.wp-kyoto.net/wp-json/wp/v2/thoughs?categories=245","https://wp-api.wp-kyoto.net/wp-json/wp/v2/posts?categories=245",{"_195":106,"_103":362},"https://wp-api.wp-kyoto.net/wp-json/wp/v2/categories/171",{"_103":168},{"_103":170},{"_103":366,"_119":367},"https://wp-api.wp-kyoto.net/wp-json/wp/v2/categories/245",{"_121":368},[123],2,"https://wp-api.wp-kyoto.net/category/htmlcss/","Frontend","htmlcss",[],{"_91":375,"_93":376,"_95":377,"_97":378,"_99":379},[389],[388],[387],[381,382,383],[380],{"_85":102,"_103":104,"_105":106},{"_103":386},{"_103":385},{"_103":384},"https://wp-api.wp-kyoto.net/wp-json/wp/v2/llms-texts?categories=2","https://wp-api.wp-kyoto.net/wp-json/wp/v2/thoughs?categories=2","https://wp-api.wp-kyoto.net/wp-json/wp/v2/posts?categories=2",{"_103":168},{"_103":170},{"_103":390,"_119":391},"https://wp-api.wp-kyoto.net/wp-json/wp/v2/categories/2",{"_121":392},[123],256,94,"https://wp-api.wp-kyoto.net/category/ai-ml/","AI / ML","ai-ml",[],{"_91":400,"_93":401,"_95":402,"_97":403,"_99":404},[414],[413],[412],[406,407,408],[405],{"_85":102,"_103":104,"_105":106},{"_103":411},{"_103":410},{"_103":409},"https://wp-api.wp-kyoto.net/wp-json/wp/v2/llms-texts?categories=256","https://wp-api.wp-kyoto.net/wp-json/wp/v2/thoughs?categories=256","https://wp-api.wp-kyoto.net/wp-json/wp/v2/posts?categories=256",{"_103":168},{"_103":170},{"_103":415,"_119":416},"https://wp-api.wp-kyoto.net/wp-json/wp/v2/categories/256",{"_121":417},[123],185,133,"https://wp-api.wp-kyoto.net/category/amazon-alexa-2/","Amazon Alexa","amazon-alexa-2",[],{"_91":425,"_93":426,"_95":427,"_97":428,"_99":429},[439],[438],[437],[431,432,433],[430],{"_85":102,"_103":104,"_105":106},{"_103":436},{"_103":435},{"_103":434},"https://wp-api.wp-kyoto.net/wp-json/wp/v2/llms-texts?categories=185","https://wp-api.wp-kyoto.net/wp-json/wp/v2/thoughs?categories=185","https://wp-api.wp-kyoto.net/wp-json/wp/v2/posts?categories=185",{"_103":168},{"_103":170},{"_103":440,"_119":441},"https://wp-api.wp-kyoto.net/wp-json/wp/v2/categories/185",{"_121":442},[123],229,150,"https://wp-api.wp-kyoto.net/category/javascript/react/","React","react",174,[],{"_91":451,"_93":452,"_95":453,"_183":454,"_97":455,"_99":456},[468],[467],[466],[464],[458,459,460],[457],{"_85":102,"_103":104,"_105":106},{"_103":463},{"_103":462},{"_103":461},"https://wp-api.wp-kyoto.net/wp-json/wp/v2/llms-texts?categories=229","https://wp-api.wp-kyoto.net/wp-json/wp/v2/thoughs?categories=229","https://wp-api.wp-kyoto.net/wp-json/wp/v2/posts?categories=229",{"_195":106,"_103":465},"https://wp-api.wp-kyoto.net/wp-json/wp/v2/categories/174",{"_103":168},{"_103":170},{"_103":469,"_119":470},"https://wp-api.wp-kyoto.net/wp-json/wp/v2/categories/229",{"_121":471},[123],175,155,"https://wp-api.wp-kyoto.net/category/javascript/node-js/","Node.js","node-js",[],{"_91":479,"_93":480,"_95":481,"_183":482,"_97":483,"_99":484},[495],[494],[493],[492],[486,487,488],[485],{"_85":102,"_103":104,"_105":106},{"_103":491},{"_103":490},{"_103":489},"https://wp-api.wp-kyoto.net/wp-json/wp/v2/llms-texts?categories=175","https://wp-api.wp-kyoto.net/wp-json/wp/v2/thoughs?categories=175","https://wp-api.wp-kyoto.net/wp-json/wp/v2/posts?categories=175",{"_195":106,"_103":465},{"_103":168},{"_103":170},{"_103":496,"_119":497},"https://wp-api.wp-kyoto.net/wp-json/wp/v2/categories/175",{"_121":498},[123],163,"https://wp-api.wp-kyoto.net/category/saas-faas/","SaaS / FaaS","saas-faas",[],{"_91":505,"_93":506,"_95":507,"_97":508,"_99":509},[519],[518],[517],[511,512,513],[510],{"_85":102,"_103":104,"_105":106},{"_103":516},{"_103":515},{"_103":514},"https://wp-api.wp-kyoto.net/wp-json/wp/v2/llms-texts?categories=171","https://wp-api.wp-kyoto.net/wp-json/wp/v2/thoughs?categories=171","https://wp-api.wp-kyoto.net/wp-json/wp/v2/posts?categories=171",{"_103":168},{"_103":170},{"_103":362,"_119":520},{"_121":521},[123],4,211,"https://wp-api.wp-kyoto.net/category/wordpress/","WordPress","wordpress",[],{"_91":529,"_93":530,"_95":531,"_97":532,"_99":533},[543],[542],[541],[535,536,537],[534],{"_85":102,"_103":104,"_105":106},{"_103":540},{"_103":539},{"_103":538},"https://wp-api.wp-kyoto.net/wp-json/wp/v2/llms-texts?categories=4","https://wp-api.wp-kyoto.net/wp-json/wp/v2/thoughs?categories=4","https://wp-api.wp-kyoto.net/wp-json/wp/v2/posts?categories=4",{"_103":168},{"_103":170},{"_103":544,"_119":545},"https://wp-api.wp-kyoto.net/wp-json/wp/v2/categories/4",{"_121":546},[123],231,[],{"_91":550,"_93":551,"_95":552,"_97":553,"_99":554},[561],[560],[559],[556,557,558],[555],{"_85":102,"_103":104,"_105":106},{"_103":219},{"_103":218},{"_103":217},{"_103":168},{"_103":170},{"_103":196,"_119":562},{"_121":563},[123],336,"https://wp-api.wp-kyoto.net/category/javascript/","JavaScript","javascript",[],{"_91":570,"_93":571,"_95":572,"_97":573,"_99":574},[584],[583],[582],[576,577,578],[575],{"_85":102,"_103":104,"_105":106},{"_103":581},{"_103":580},{"_103":579},"https://wp-api.wp-kyoto.net/wp-json/wp/v2/llms-texts?categories=174","https://wp-api.wp-kyoto.net/wp-json/wp/v2/thoughs?categories=174","https://wp-api.wp-kyoto.net/wp-json/wp/v2/posts?categories=174",{"_103":168},{"_103":170},{"_103":465,"_119":585},{"_121":586},[123],[634,635,636,637,638,639,640,641,642,643],"clerkState",{"_590":591},"__internal_clerk_state",{"_592":593,"_594":595,"_596":62,"_597":62,"_598":60,"_599":62,"_600":62,"_601":62,"_602":62,"_603":62,"_604":62,"_605":62,"_606":62,"_607":608,"_609":62,"_610":62,"_611":60,"_612":60},"__clerk_ssr_state",{"_622":623,"_624":-5,"_625":-5,"_626":-5,"_627":-5,"_628":-5,"_629":-5,"_630":-5,"_631":-5,"_632":-5,"_633":-5,"_614":60},"__publishableKey","pk_live_Y2xlcmsud3Ata3lvdG8ubmV0JA","__proxyUrl","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__signInForceRedirectUrl","__signUpForceRedirectUrl","__signInFallbackRedirectUrl","__signUpFallbackRedirectUrl","__clerk_debug",{"_613":60,"_614":60,"_615":62,"_616":617,"_618":62,"_619":595,"_620":60,"_621":62},"__clerkJSUrl","__clerkJSVersion","__telemetryDisabled","__telemetryDebug","isSignedIn","isAuthenticated","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","tokenType","session_token","sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge",{"_26":448,"_275":564,"_229":62,"_44":565,"_85":566,"_38":567,"_88":153,"_344":54,"_65":794,"_72":795},{"_26":203,"_275":547,"_229":62,"_44":204,"_85":205,"_38":206,"_88":153,"_344":54,"_65":778,"_72":779},{"_26":522,"_275":523,"_229":62,"_44":524,"_85":525,"_38":526,"_88":153,"_344":54,"_65":762,"_72":763},{"_26":345,"_275":499,"_229":62,"_44":500,"_85":501,"_38":502,"_88":153,"_344":54,"_65":746,"_72":747},{"_26":472,"_275":473,"_229":62,"_44":474,"_85":475,"_38":476,"_88":153,"_344":448,"_65":728,"_72":729},{"_26":443,"_275":444,"_229":62,"_44":445,"_85":446,"_38":447,"_88":153,"_344":448,"_65":710,"_72":711},{"_26":418,"_275":419,"_229":62,"_44":420,"_85":421,"_38":422,"_88":153,"_344":54,"_65":694,"_72":695},{"_26":393,"_275":394,"_229":62,"_44":395,"_85":396,"_38":397,"_88":153,"_344":54,"_65":678,"_72":679},{"_26":369,"_275":340,"_229":62,"_44":370,"_85":371,"_38":372,"_88":153,"_344":54,"_65":662,"_72":663},{"_26":339,"_275":340,"_229":62,"_44":341,"_85":342,"_38":343,"_88":153,"_344":345,"_65":644,"_72":645},[],{"_91":646,"_93":647,"_95":648,"_183":649,"_97":650,"_99":651},[659],[658],[657],[656],[653,654,655],[652],{"_85":102,"_103":104,"_105":106},{"_103":360},{"_103":359},{"_103":358},{"_195":106,"_103":362},{"_103":168},{"_103":170},{"_103":366,"_119":660},{"_121":661},[123],[],{"_91":664,"_93":665,"_95":666,"_97":667,"_99":668},[675],[674],[673],[670,671,672],[669],{"_85":102,"_103":104,"_105":106},{"_103":386},{"_103":385},{"_103":384},{"_103":168},{"_103":170},{"_103":390,"_119":676},{"_121":677},[123],[],{"_91":680,"_93":681,"_95":682,"_97":683,"_99":684},[691],[690],[689],[686,687,688],[685],{"_85":102,"_103":104,"_105":106},{"_103":411},{"_103":410},{"_103":409},{"_103":168},{"_103":170},{"_103":415,"_119":692},{"_121":693},[123],[],{"_91":696,"_93":697,"_95":698,"_97":699,"_99":700},[707],[706],[705],[702,703,704],[701],{"_85":102,"_103":104,"_105":106},{"_103":436},{"_103":435},{"_103":434},{"_103":168},{"_103":170},{"_103":440,"_119":708},{"_121":709},[123],[],{"_91":712,"_93":713,"_95":714,"_183":715,"_97":716,"_99":717},[725],[724],[723],[722],[719,720,721],[718],{"_85":102,"_103":104,"_105":106},{"_103":463},{"_103":462},{"_103":461},{"_195":106,"_103":465},{"_103":168},{"_103":170},{"_103":469,"_119":726},{"_121":727},[123],[],{"_91":730,"_93":731,"_95":732,"_183":733,"_97":734,"_99":735},[743],[742],[741],[740],[737,738,739],[736],{"_85":102,"_103":104,"_105":106},{"_103":491},{"_103":490},{"_103":489},{"_195":106,"_103":465},{"_103":168},{"_103":170},{"_103":496,"_119":744},{"_121":745},[123],[],{"_91":748,"_93":749,"_95":750,"_97":751,"_99":752},[759],[758],[757],[754,755,756],[753],{"_85":102,"_103":104,"_105":106},{"_103":516},{"_103":515},{"_103":514},{"_103":168},{"_103":170},{"_103":362,"_119":760},{"_121":761},[123],[],{"_91":764,"_93":765,"_95":766,"_97":767,"_99":768},[775],[774],[773],[770,771,772],[769],{"_85":102,"_103":104,"_105":106},{"_103":540},{"_103":539},{"_103":538},{"_103":168},{"_103":170},{"_103":544,"_119":776},{"_121":777},[123],[],{"_91":780,"_93":781,"_95":782,"_97":783,"_99":784},[791],[790],[789],[786,787,788],[785],{"_85":102,"_103":104,"_105":106},{"_103":219},{"_103":218},{"_103":217},{"_103":168},{"_103":170},{"_103":196,"_119":792},{"_121":793},[123],[],{"_91":796,"_93":797,"_95":798,"_97":799,"_99":800},[807],[806],[805],[802,803,804],[801],{"_85":102,"_103":104,"_105":106},{"_103":581},{"_103":580},{"_103":579},{"_103":168},{"_103":170},{"_103":465,"_119":808},{"_121":809},[123]]

Tag: Amazon Linux 2

SSM Run CommandでAmazon Linux 2のPHP 8.2にphp2shellの修正版を適用する