Everyone rushes to put a WAF rule in front of a zero-day like PHP2Shell (CVE-2026-109618 / CVE-20...

Everyone rushes to put a WAF rule in front of a zero-day like PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Fewer teams test whether that rule actually stops the exploit—or just breaks their own CMS.
For teams running PHP behind CloudFront and AWS WAF while scheduling patches, check AWS’s managed rule updates first. If you’re writing a custom rule as a stopgap, five details matter in production:
• Start in Count mode: Watch real traffic before you block. Legitimate file uploads and CMS content edits (WordPress, Drupal, MediaWiki) look a lot like attack traffic on the wire.
• Match narrowly: A blanket block on multipart/form-data will break user uploads and editorial workflows immediately. Public research details the specific request patterns current exploits use—scope your rule to those indicators.
• Know your body inspection limit: AWS WAF only inspects the first slice of a request body (16 KB by default, up to 64 KB on CloudFront/ALB). Check your Web ACL limit and choose your OversizeHandling setting (CONTINUE, MATCH, or NO_MATCH) deliberately—otherwise an attacker can pad a payload past the inspection window, or a large legitimate upload gets dropped.
• Make sure traffic can’t skip CloudFront: A WAF on CloudFront does nothing if attackers can hit your origin directly. Restrict your ALB/EC2 security groups to the AWS-managed CloudFront prefix list, require a custom secret header from CloudFront at the origin, and enforce Origin Access Control (OAC) for S3 assets.
• Patch anyway: A WAF rule only buys maintenance window time. The actual fix is PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
For teams running CMS workloads behind AWS WAF: how do you handle OversizeHandling on endpoints that have to accept large file uploads?
#AWS #CloudFront #PHP #WebSecurity #CloudArchitecture