I contacted support; we have business+ and got these unsatisfactory responses (the second one doesn't even address AL2023):

Our service team is aware of the reported issue and is actively working on it.
There is no specific ETA available at the moment; however, updates will be published on our public CVE pages at https://explore.alas.aws.amazon.com/ once available.
We recommend monitoring the advisories once released and evaluating the impact based on your specific environment.

and

Thank you for your patience. My name is redacted and I have taken over your case from my colleague.

We are aware of CVE-2026-109618 and CVE-2026-109619, which affect PHP interpreter. These issues affect PHP branches 8.2 through 8.5 at default configuration and can allow an unauthenticated remote actor to crash PHP worker processes. We can confirm that the reachable scenarios are narrow and assessed as difficult to leverage in practice.

AWS will incorporate the fix released by PHP to the following affected services:

AWS Elastic Beanstalk: ElasticBeanstalk mitigation is introduced on the latest platform version. Customers with running environments will be automatically updated to the latest platform version in the selected maintenance window through Managed Platform Updates. No action is required to update to the latest version. Customers who have not enabled Managed Platform Updates can update their environment's platform version by following our documentation [1].

AWS Lightsail: AWS Lightsail will evaluate and build the fix for new Lightsail blueprints so customers can incorporate the fix.

If you have questions or concerns, please follow up on this support case.

[1] https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.platform.upgrade.html