DEV Community: CODELEVEL - Jacob Binczyk

How to check your server has the php2shell patch

CODELEVEL - Jacob Binczyk — Mon, 26 Oct 2026 16:11:25 +0000

On 21 October the PHP team released 8.2.35, 8.3.36, 8.4.27 and 8.5.12, the php2shell patch for CVE-2026-109618 and CVE-2026-109619. Both flaws let an attacker run code on the server without logging in, and both are now being exploited. If your site or online shop runs on PHP, check this week that the process actually serving it has the fix.

In short

The flaws are being exploited, so patch now rather than at the next maintenance window.
After updating, restart PHP-FPM or Apache, and rebuild your container images.
The PHP team ships fixes for PHP 8.2 only until 31 December 2026.

The flaws are already being exploited

News of the flaws and the release date leaked the day before the planned release. According to The Hacker News, watchTowr reported active attack attempts just 19 minutes after the patches went out, and by early on 22 October Cloudflare had counted millions.

On 26 October BleepingComputer reported a confirmed successful takeover. It happened on a honeypot running Apache with mod_php and PHP 8.4.26, and the researcher Marcus Hutchins confirmed the finding independently. A day earlier Aviatrix described a breach at an unnamed European government body, where the attackers left a web shell on an unpatched server to keep their access.

Servers running mod_php in Apache are the most exposed, but PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are affected too. With millions of attempts, any unpatched PHP server can expect this traffic, small ones included.

What to check this week

An installed package is not enough on its own. Go through these in order:

The package version, not the output of php -v. Ubuntu 24.04 backported the fix into its own PHP 8.3.6, so php -v still says 8.3.6. The fix is in package 8.3.6-0ubuntu0.24.04.13 or newer. Debian 12 has 8.2.35, and RHEL 9 got the same version in RHSA-2026:87072.
A restart. PHP-FPM workers and Apache with mod_php keep the old code in memory until you restart them.
Containers. Updating the host does not change the PHP inside your image, so rebuild it with docker build --pull and deploy it. If your Dockerfile pins a version such as php:8.2.34-fpm, bump that first.
Hosting. On shared hosting the provider patches PHP, so ask them whether the fix is in. As Malwarebytes points out, updating WordPress does not update PHP, which is a separate engine the site runs on.

The commands for PHP from Ubuntu 24.04 and RHEL 9 packages:

# Ubuntu 24.04 (Debian 12: replace 8.3 with 8.2, package 8.2.35-1~deb12u1 or newer)
dpkg-query -W php8.3-fpm   # 8.3.6-0ubuntu0.24.04.13 or newer
sudo ls -l /proc/$(pgrep -o php-fpm8.3)/exe
sudo systemctl restart php8.3-fpm

# RHEL 9, php:8.2 module
rpm -q php-fpm   # 8.2.35 or newer
sudo ls -l /proc/$(pgrep -o php-fpm)/exe
sudo systemctl restart php-fpm

If the path ends in (deleted), the process is still running the version from before the update and needs a restart. With mod_php you restart Apache itself: systemctl restart apache2 on Debian and Ubuntu, systemctl restart httpd on RHEL.

PHP 8.2 gets fixes until 31 December

According to the PHP support schedule, security fixes for PHP 8.2 end on 31 December 2026. If a similar flaw turns up in January, the PHP team will not release a fixed 8.2, so the official Docker images will not get one either. That is what happened this week to PHP 8.1 and older, which got only source patches.

Debian, Red Hat and some hosts backport fixes to older versions, but on their own schedules. If your 8.2 comes from their packages, ask how long they will keep shipping fixes. If it comes from php.net or the official Docker image, plan the move before the end of the year. I would go straight to 8.4, which gets fixes until the end of 2028, a year longer than 8.3. Staging first, then production.

Who decides when you cannot patch straight away

Sometimes the update has to wait. Then someone has to choose between a workaround and taking the service offline. A workaround means, for example, turning off session.upload_progress.enabled, lowering the request size limit or adding a WAF rule. It does not replace the patch, but it shortens the time the server is an easy target. Some companies took their sites offline for a few hours, and that was a sensible call.

Write down on a single page who makes that decision in your company, how to reach them quickly, which services can go offline without much harm and who does the update itself. My maintenance service includes alerts and a response in business hours, and I handle critical incidents in the evening too.

Originally published on codelevel.pl. Prices are net, for businesses. AWS, Hetzner and OVH are trademarks of their owners; CODELEVEL is not a partner, reseller or representative of any of them.

SSL certificate validity drops to 100 days in March 2027

CODELEVEL - Jacob Binczyk — Mon, 26 Oct 2026 12:20:11 +0000

From 15 March 2027 no newly issued public TLS certificate, still usually called an SSL certificate, may be valid for more than 100 days. The limit is set by the CA/B Forum Baseline Requirements, the rules every certificate authority has to follow. Let's Encrypt moves first: from 10 February 2027 its certificates will last 64 days by default.

If your certificate renews itself, all you need to check is that someone hears when a renewal fails. A certificate installed by hand will have to be replaced at least three times a year from March, and in practice four.

The limit falls from 200 to 100 days

A certificate issued before 15 March 2026 could be valid for 398 days, just over a year, which is where the habit of a yearly swap comes from. The limit has been 200 days since 15 March 2026, so a certificate issued today won't last even seven months. From 15 March 2027 it falls to 100 days, and from 15 March 2029 to 47.

The chart for this part is in the original post.

Check the issuer and the expiry date

Your browser shows the issuer and the expiry date in the certificate details when you click the icon next to the address. For several hostnames this command is quicker; it runs on Linux with OpenSSL 1.1.1 or 3.x, with your own hostname in both places:

echo | openssl s_client -connect shop.example.com:443 \
  -servername shop.example.com 2>/dev/null \
  | openssl x509 -noout -issuer -enddate -checkend 1209600

The first line of output is the issuer and the second is notAfter, the expiry date. The number 1209600 is 14 days in seconds. With less time left, OpenSSL adds "Certificate will expire" and exits with an error, so the same command can go into a script that raises an alert.

The issuer is a good clue to who renews the certificate: Let's Encrypt and Amazon usually mean automation, while with Sectigo or DigiCert someone most often bought a file and installed it by hand. Check every hostname separately, because a customer portal or a VPN gateway often has a different certificate from the website. Behind a proxied Cloudflare record or CloudFront the command shows the CDN's certificate, so run it once more on the server itself, with 127.0.0.1:443 after -connect.

Where Let's Encrypt renewal breaks

Let's Encrypt stopped sending expiry reminder emails on 4 June 2025. According to the certbot documentation, versions before 4.0 renew a certificate 30 days before expiry and 4.0 onwards once less than a third of its lifetime remains, so certbot renew run from a timer or cron is in time either way.

A certificate issued with --manual, often a wildcard with a DNS record added by hand, won't renew on its own unless certbot gets a script that adds the record. Let's Encrypt suggests checking home-made scripts and cron jobs with a fixed interval, because they may now run too late. A web server that is never reloaded keeps serving the old certificate, so pass the reload command to certbot's --deploy-hook and certbot will run it after every successful renewal.

ACM with email validation waits for a click

Since 18 February 2026 AWS Certificate Manager has issued public certificates valid for at most 198 days, and AWS says customers need to do nothing. With DNS validation, ACM renews the certificate on its own as long as it is in use by an AWS service, a load balancer for example, and ACM's CNAME records are still in DNS.

With email validation, ACM sends an email 45 days before expiry to addresses such as admin@ and webmaster@ at your domain. The certificate renews only after someone clicks the link in it, so with 198-day certificates someone has to click roughly every five months. You can't switch the validation method to DNS, so you have to request a new certificate with DNS validation and swap it in on your services. It is worth doing now, because from 15 March 2028 the CA/B Forum rules forbid certificate authorities from validating by email to those addresses.

Hand-installed certificates are slow to replace

In October 2026 the main browsers stopped trusting eight intermediate certificates of the certificate authority eMudhra, all within three days. Where certificates are installed by hand, the site then has to wait for a new certificate and for someone to install it.

What it means for a small team

This week, check every hostname you use, in the browser or with the command, and note who issued each certificate.

With Let's Encrypt there is nothing to replace, but nobody will warn you when renewal breaks. Add monitoring that alerts you 14 days before expiry. I can also run it alongside uptime and disk alerts as part of server maintenance.

In ACM, only the certificates with email validation need replacing: the ones someone approved by clicking a link in an email from Amazon. Request new ones with DNS validation before the next email arrives.

Replace a commercial certificate you install by hand wherever you can: on an ordinary server with one from Let's Encrypt, and on a load balancer or CloudFront with one from ACM. Where you can't, put the expiry dates in a calendar and in your monitoring. Do it before 15 March 2027 or, failing that, get your next commercial certificate issued before that day, because it can still be valid for up to 200 days instead of 100.

Originally published on codelevel.pl. Prices are net, for businesses. AWS, Hetzner and OVH are trademarks of their owners; CODELEVEL is not a partner, reseller or representative of any of them.

What Magento hosting on AWS costs a month

CODELEVEL - Jacob Binczyk — Wed, 21 Oct 2026 15:53:02 +0000

Running a small Magento shop on AWS in Frankfurt costs from about USD 204 to about USD 804 a month, according to AWS price lists as of 12 October 2026. Where you land depends on how many services you hand to AWS and whether you pay for a standby in a second zone. On shared hosting, Magento 2.4 usually won't even install, because it needs a search engine that cheap plans don't include.

I assumed a shop with up to about 10,000 products and about 30 people browsing at once, with most pages served from the Varnish cache, so 4 vCPU and 16 GB of RAM in total are enough.

Magento 2.4 needs a separate search engine

Since Magento 2.4, Adobe requires Elasticsearch or OpenSearch in every installation. For the latest release, 2.4.9, the system requirements table lists only OpenSearch 3.

Hostinger's help centre says Elasticsearch isn't available on its web and cloud plans, so Magento 2 needs a VPS. A Hostinger VPS for Magento with 4 vCPU and 16 GB of RAM costs about USD 29 a month after the promotional period, according to its price list on 14 October 2026.

On a VPS you administer the system, the database and OpenSearch yourself, and keep a backup off the server. My post on Hetzner or AWS for a small company covers how much work that is.

Three versions of the same shop on AWS

I priced all three at on-demand rates before VAT, in Frankfurt, with 200 GB of data transfer out to the internet a month.

A single EC2 server with 4 vCPU and 16 GB of RAM runs the whole shop, database and search engine included, for about USD 204. In practice it is a VPS inside AWS, so when that machine goes down, the shop stops.
For about USD 428, the application gets a smaller server, and the database, cache and search engine move to managed AWS services. All of it runs in one Availability Zone, one of three separate groups of data centres in the Frankfurt region, so there is still nothing to fail over to.
The version with standby has two application servers behind a load balancer, a database with a standby copy in a second zone, two cache nodes, and images in S3 served through a CDN. It costs about USD 804. Only search stays on one node in one zone, so if it fails, category pages and search stop.

The chart for this part is in the original post.
The calculator shows a similar setup under the “Web application, shop or CMS” profile, next to Hetzner and OVH prices.

A second zone nearly doubles the bill

The database adds the most. RDS Multi-AZ keeps a standby instance in another zone and fails the database over to it when the primary stops working. AWS charges twice the single-zone rate for both the instance and its storage.

The Magento shop I moved to AWS runs on similar services: RDS MySQL, OpenSearch, Redis, Varnish and a CDN. Its hosting bill is higher than before the move, because the shop had to hold up through campaign traffic peaks and recover quickly from a failure.

What it means for a small shop

If the shop sells evenly all year and can live with a few hours of downtime after a server failure, a VPS or a Magento hosting plan with OpenSearch is enough.

For a shop that makes its money in campaigns and can't go down while they run, I recommend the third version. In the second version you pay for managed services, yet when its only application server or database fails, the shop goes offline.

Before you choose the third version, open the sales report in the Magento admin and work out the revenue per hour on the best day of your last campaign. Multiply it by the hours a server failure would keep the shop down. Compare that with what the third version would cost you extra over a year: the gap between about USD 804 and your current monthly hosting bill, times twelve. If one outage costs you more, the standby pays for itself even with one failure a year.

Originally published on codelevel.pl. Prices are net, for businesses. AWS, Hetzner and OVH are trademarks of their owners; CODELEVEL is not a partner, reseller or representative of any of them.

Hetzner or AWS for a small company

CODELEVEL - Jacob Binczyk — Tue, 20 Oct 2026 21:01:06 +0000

In the example below, Hetzner costs 29–36% of the AWS on-demand bill for a steady workload. You pay the difference back in work, because Hetzner has no managed database, and someone has to own the backups, failover, patching and alerts. On an AWS bill of about USD 750 a month the saving on Hetzner does not cover maintenance, so the move does not pay back. In the example with a bill of about USD 2,700, you keep about a third.

A small SaaS on AWS and on Hetzner

For the calculator I costed a handful of typical architectures using prices from 23 September 2026. One is a small SaaS in Frankfurt: an application in containers, a PostgreSQL database with a standby in a second zone, a cache, file storage and a CDN. On Hetzner the same thing runs on five cloud servers, or on two dedicated servers plus one small cloud server. Add a load balancer, Object Storage in place of S3, an outside CDN, and backups at Hetzner and outside it.

Setup	Per month, net, USD
AWS on-demand	746
AWS with one-year reservations	597
Hetzner Cloud	215
Hetzner dedicated servers	271

What you take on when you leave AWS

Hetzner Cloud gives you servers, private networks, firewalls and load balancers, but no managed database and no managed Kubernetes.

You run the database, its replica and failover yourself, for example PostgreSQL with Patroni and etcd on three servers. With RDS Multi-AZ, AWS keeps a standby in another zone and fails over to it.
Hetzner Cloud copies the server's disk once a day, while RDS restores the database to a point in time you pick. To get the same, you archive the WAL, for example with pgBackRest, to storage outside Hetzner, and test the restore regularly.
You install OS and PostgreSQL patches yourself, where on Fargate and RDS AWS does it. The alert about a failed database comes to you, evenings included.
Spare capacity has to be planned ahead. Since 26 June Hetzner has been stopping some customers from creating new cloud servers, and the restriction was still in place on 8 October. I covered what that means, along with the June price rises, in the post on OVH and Hetzner prices.

Hetzner takes cloud tickets at any hour, but general enquiries are handled on weekdays from 8 a.m. to 6 p.m. CET.

How much work that is

The calculator adds maintenance to the Hetzner side, because server prices alone can't be compared fairly with managed services. The dedicated setup is three machines, so my Business plan at EUR 470 net a month, about USD 540, covers it. That includes 4 hours of work, patching and a monthly restore test, but restoring the database to a point in time comes only with the Growth plan. If someone on your team does it instead, price their hours at their rate.

After maintenance the difference is gone: Hetzner with the Business plan costs about USD 810 a month, more than AWS. Five cloud servers need the Growth plan at EUR 1,170, so nothing is left there either, and the same goes for one-year reservations on AWS. The migration costs from EUR 2,300 net, and I deduct the exit plan's price from it if you order the migration within 90 days of the plan, so at this bill there is nothing to pay it back from.

When to stay on AWS

Your traffic spikes, say in peak season or after a campaign. On AWS, Fargate adds tasks for the peak if you set up autoscaling. Hetzner Cloud also bills by the hour, but you have to script the scaling yourself, and a dedicated server is paid for the whole month.
Your application uses Lambda, SQS or DynamoDB. Each one has to be replaced with something you run yourself, which usually means code changes.
Your customers ask for specific certifications. AWS has SOC and PCI DSS among the programmes on its compliance list. Hetzner holds ISO/IEC 27001, and BSI C5 Type 2 for its cloud. If a customer contract requires a SOC 2 report, check this before you decide.
Nobody in the company looks after servers, and you don't want to pay someone outside to do it.

What it means for a small team

In the example above, the difference in the bill does not cover maintenance. For the larger application in the cloud exit example, AWS costs about USD 2,700 a month, and after Hetzner dedicated servers and maintenance you keep about a third of that.

Enter your bill in the calculator and look at the “You keep each month” line. The calculator also prices OVH dedicated servers, which come out cheaper than Hetzner's in this example: at USD 746 it shows up to USD 170 a month and a payback of 14 months. If the move doesn't pay back within two years, start by cutting the AWS bill.

Originally published on codelevel.pl. Prices are net, for businesses. AWS, Hetzner and OVH are trademarks of their owners; CODELEVEL is not a partner, reseller or representative of any of them.

How to set up AWS budget alerts

CODELEVEL - Jacob Binczyk — Tue, 20 Oct 2026 21:00:25 +0000

Set up one monthly budget in AWS Budgets with two alerts: one when actual spend reaches 80% of the amount, and one when the forecast for the end of the month goes over 100%. Budgets and their e-mail alerts are free, and the whole thing takes about fifteen minutes.

The second safety net, Cost Anomaly Detection, is already running on many accounts. When it finds an anomaly, it sends a daily summary to the address the AWS account was opened with. Both can be up to a day late, and an e-mail on its own switches nothing off.

A monthly budget, step by step

In the console, open Billing and Cost Management, then Budgets, then Create budget. Choose Customize (advanced) so you can set the thresholds yourself:

Type Cost budget, period Monthly, Recurring budget, method Fixed. If AWS credits pay your bill, turn off credits in the budget options, because they are included by default and the budget then sees spend near zero.
Amount: the average of your last three invoices plus 20%.
First threshold (Add an alert threshold): 80, % of budgeted amount, Actual.
Second threshold: 100, % of budgeted amount, Forecasted.
Under Email recipients, enter the address the alerts should go to.

When spend speeds up mid-month, the forecast alert arrives long before the 80% one.

The chart for this part is in the original post.
The forecast needs about five weeks of data. On a new account the forecast alert stays silent until then, so add a third threshold at 100% of actual spend.

For a test account that should stay within the Free Tier, use the Zero spend budget template instead. It e-mails you as soon as you spend anything beyond the free limits.

Who should get the e-mail

AWS Budgets now sends a verification e-mail to every new address. The link is valid for 12 hours, and to confirm the address you have to be signed in to the AWS account that added it. An unconfirmed address gets no alerts.

That means a business owner who doesn't sign in to the console can't confirm their own address. For this case AWS suggests a distribution list whose membership you manage outside AWS. Create an address such as billing-alerts@yourcompany.com, put yourself and your developer on it, and have the developer confirm it once in the console.

Addresses added before verification was introduced show the status Expiring in the recipient list and keep working for a grace period. The documentation doesn't say how long that lasts, so choose Send Notification for each of them and confirm them now.

Cost Anomaly Detection

A budget looks at the month's total. Cost Anomaly Detection looks for unusual jumps in individual services. On many accounts AWS set it up automatically at no cost: a monitor for AWS services and a daily e-mail summary. AWS then only reports anomalies above $100 that are also more than 40% above expected spend.

If your bill is a few hundred dollars a month, $100 is a high bar. In Billing and Cost Management, open Cost Anomaly Detection, then the Alert subscriptions tab, lower the amount in the Threshold field to a level that would hurt, and add the same group address. If the Cost monitors tab is empty, create a monitor of the AWS services type.

Cost Anomaly Detection can take up to 24 hours to spot an anomaly, and it ignores an AWS service you've just started using for its first 10 days.

The same budget in Terraform

If you keep your infrastructure in Terraform, put the budget in code. An example for the aws_budgets_budget resource in AWS provider 6.x:

resource "aws_budgets_budget" "monthly" {
  name         = "monthly"
  budget_type  = "COST"
  time_unit    = "MONTHLY"
  limit_amount = "500"
  limit_unit   = "USD"

  notification {
    notification_type          = "FORECASTED"
    threshold                  = 100
    threshold_type             = "PERCENTAGE"
    comparison_operator        = "GREATER_THAN"
    subscriber_email_addresses = ["billing-alerts@yourcompany.com"]
  }
}

The 80% alert is a second notification block with ACTUAL and 80, and if you use AWS credits, add cost_types { include_credit = false }. The address still has to be confirmed in the console.

What the alerts won't do

AWS Budgets data is refreshed up to three times a day, usually 8–12 hours apart, so an instance started in the evening may only show up in an alert the next day.

An alert doesn't stop anything either. That is what budget actions are for: once a threshold is crossed they restrict permissions on the account or stop chosen EC2 and RDS instances, either automatically or after you approve. An automatic action on a production database can easily turn an expensive month into an outage, so in a small company I'd only use actions with manual approval.

You don't need the older CloudWatch billing alarm in a new setup: a budget does the same job and adds a forecast.

What a small team should set up

If a forgotten instance or a Lambda stuck in a loop pushes spend over a threshold, you'll usually see it in an e-mail within a day or two, not on the invoice. When the first alert arrives, open Cost Explorer, group costs by service and set the date range to month-to-date. You'll see which service grew.

What an alert won't tell you is whether your current bill is too high, because you set the budget at the level you are used to. If costs have been creeping up for months, an AWS cost audit is worth doing.

Originally published on codelevel.pl. Prices are net, for businesses. AWS, Hetzner and OVH are trademarks of their owners; CODELEVEL is not a partner, reseller or representative of any of them.

The Data Act ends cloud switching fees on 12 January 2027

CODELEVEL - Jacob Binczyk — Mon, 12 Oct 2026 07:23:59 +0000

From 12 January 2027 the Data Act bars cloud providers from charging EU customers switching fees, including data egress charges for moving data to a new provider or to your own servers. Traffic between two clouds you use side by side can still be charged.

If you are leaving AWS altogether, don't wait for January, because AWS already waives transfer charges on request when you move out. When you move one whole service, such as all of S3, and keep the application on AWS, the ban only helps from 12 January. AWS needs the Data Act switching request at least two months before such a switch starts, counted from the day the request is complete, so to start on 12 January, send it well before 12 November.

What the Data Act says

The Data Act, Regulation (EU) 2023/2854, has applied since 12 September 2025, according to the European Commission, so you can use its switching procedure now. Until 11 January 2027 a provider may charge for a switch, but no more than the costs directly linked to it.

AWS's programme for customers who leave

The programme has run since March 2024 and covers every AWS region. According to the AWS post updated on 30 September 2025, you apply through AWS Support, and once the request is approved you get credits for data transfer out to the internet and 90 days to finish the move. AWS's FAQ still says 60 days, so check the term in AWS's reply to your request. According to the FAQ, within that term you delete all remaining data from your account or close it, so you can't keep even backups in S3.

Outside the AWS programme and outside the Data Act procedure, you pay list price for the transfer. The first 100 GB a month are free, and sending 5 TB from Frankfurt to the internet in one month costs about $450 at AWS's list prices of 16 September 2026.

How a Data Act switch works on AWS

If the payer account, the one that pays the bill, has an EU country in its account settings, AWS's Data Act addendum covers it together with every account billed through it. A payer account whose country is outside the EU, the UK included, doesn't qualify. The addendum distinguishes a Complete Switch, which moves all your services, from a Service Switch, which moves one or more whole services while the rest stays on AWS. For S3, a whole service means every bucket on every account under that payer.

The chart for this part is in the original post.
Once the switch starts, you have a transitional period of 30 calendar days to move the data. If AWS finds that technically impossible, it can extend the period to seven months at most. If you copy data before the switch starts, in December for example, you may pay list price for that transfer.

When the application writes to the new provider and all the data is there, check the copy: compare object counts and checksums, and include older versions in versioned buckets. Then delete the moved service's data from AWS, and only then notify AWS that the switch is complete. The switch ends when AWS receives your notice, at the end of the transitional period at the latest, and the data must be gone from AWS by then. If you don't send the notice or you leave data on AWS, you pay standard rates and have to reimburse AWS for any credits or fee waivers you received for the switch.

What it means for a small company

Nothing changes on 12 January if you stay on AWS and move nothing.

For a full move off AWS, ask AWS Support to waive the transfer charges before you start copying data. The hosting cost calculator estimates what you will pay at Hetzner or OVH. Savings Plans, Reserved Instances and any minimum spend in your AWS agreement still apply after you leave, which is why I check them first when I draw up a cloud exit plan.

If the application and its data are to stay split across two clouds, Article 34 of the regulation lets providers go on charging for the traffic between them after 12 January 2027, at no more than what the traffic costs them.

The date matters most when you want to move all of S3 and keep the application on AWS. If the move can wait, set the Service Switch to start on 12 January 2027 or later. If AWS only receives the complete request on 1 December, the switch starts on 1 February at the earliest.

Just make sure nothing stays in S3. A single bucket with logs or Terraform state is enough to make it something other than a Service Switch, and then you pay list price for the transfer.

Originally published on codelevel.pl. Prices are net, for businesses. AWS, Hetzner and OVH are trademarks of their owners; CODELEVEL is not a partner, reseller or representative of any of them.

What EC2-Other means on your AWS bill

CODELEVEL - Jacob Binczyk — Mon, 12 Oct 2026 07:05:38 +0000

EC2-Other is the Cost Explorer line where AWS puts EC2 charges other than instance hours. According to the AWS cost management blog, it holds EBS volumes and their snapshots, NAT gateways, some of your data transfer and a few smaller fees.

To see what makes up that amount, filter Cost Explorer to Service = EC2-Other and group the result by Usage type.

Breaking down EC2-Other in Cost Explorer

Open Cost Explorer in the Billing and Cost Management console and set the range to the last six months by month, so you can see which part is growing.

Outside us-east-1, usage types start with a Region code: EUC1- in Frankfurt. The main usage types in EC2-Other:

Usage type	What it is	What to check
EBS:VolumeUsage.gp2 and .gp3	Provisioned volume storage	Unattached volumes and gp2 volumes
EBS:SnapshotUsage	Volume snapshots	Snapshots of deregistered AMIs
NatGateway-Hours	NAT gateway hours	Number of gateways
NatGateway-Bytes	Data processed by NAT	Traffic to S3 and DynamoDB
DataTransfer-Regional-Bytes	Traffic between Availability Zones	Services that talk across zones

Public IPv4 addresses, which older AWS posts list under EC2-Other, now sit under the VPC service. Since 1 February 2024 each one costs about $3.65 a month, even when nothing uses it.

Volumes and snapshots

You pay for the gigabytes a volume has provisioned, even while the instance is stopped. When you terminate an instance, AWS deletes only the root volume by default, so any other volumes stay in the available state and keep costing money. How to list them, and when it pays to move from gp2 to gp3, is in my AWS cost audit checklist.

Deregistering an AMI leaves its snapshots in place by default, so you keep paying for them. When you deregister, tick "Delete associated snapshots" in the console or add --delete-associated-snapshots to aws ec2 deregister-image. A snapshot made together with an image has a description like Created by CreateImage(i-…) for ami-…, so you can check whether that image still exists.

NAT gateways

A NAT gateway is the part of the network that lets servers without a public address reach the internet, for example to download updates. You pay for every hour it runs, even when no traffic goes through it, and separately for every GB it processes.

If NatGateway-Hours dominates, count your gateways. A test environment usually manages with one per VPC. In production, AWS recommends keeping the gateway in the same zone as the resources that send a lot of data through it, because you then avoid cross-zone transfer charges.

When NatGateway-Bytes is the bigger cost, find out where the traffic goes. Traffic to S3 and DynamoDB in the same Region can go through a free gateway endpoint. Once you associate it with the route tables of your private subnets, that traffic stops passing through the NAT gateway. Check your bucket policies first: a condition on the gateway's address in aws:SourceIp will stop letting that traffic in, because the key is absent for requests through a VPC endpoint, so replace it with an aws:SourceVpce condition.

What it means for a small team

Start with the usage type that grows month after month while your application's traffic stays flat. If it is NatGateway-Bytes and the application keeps files in S3, add an S3 endpoint first. If it is VolumeUsage or SnapshotUsage, start with the list of available volumes and delete only the ones you are sure nobody needs. If in doubt, take a snapshot first.

Rather than clicking through Cost Explorer, you can load an export of the whole bill grouped by Usage type, without the service filter, into the CSV analysis. The file never leaves your browser, and the analysis shows NAT gateways, traffic between zones, snapshots and gp2 volumes separately when they are a significant part of the bill.

If EC2-Other is a large share of the bill and the usage type split does not explain it, I can go through the account as part of an AWS cost audit.

Originally published on codelevel.pl. Prices are net, for businesses. AWS, Hetzner and OVH are trademarks of their owners; CODELEVEL is not a partner, reseller or representative of any of them.

What I check in an AWS cost audit

CODELEVEL - Jacob Binczyk — Mon, 12 Oct 2026 05:05:22 +0000

In an AWS cost audit I start with six places: EC2 instance size, Savings Plans, EBS volumes, public IPv4 addresses, NAT Gateway and CloudWatch logs. Five of them are resources left over from a test or still running on their defaults. The sixth is a discount for steady load that nobody has taken.

You can see each of them yourself. Open Cost Explorer, set the last three months and group costs by Usage type. The usage types are in the table, and Savings Plans have a separate report, described below. In Frankfurt, usage types carry the prefix EUC1-.

What you check	Usage type in Cost Explorer
EC2 instances	`BoxUsage:<instance type>`
Volumes and snapshots	`EBS:VolumeUsage.gp2`, `EBS:SnapshotUsage`
IPv4 addresses	`PublicIPv4:IdleAddress`, `PublicIPv4:InUseAddress`
NAT Gateway	`NatGateway-Hours`, `NatGateway-Bytes`
CloudWatch logs	`DataProcessing-Bytes`, `TimedStorage-ByteHrs`

You can also load a Cost Explorer export into the CSV analysis, which flags most of these. The file stays in your browser. The prices below are on-demand rates in Frankfurt according to AWS pricing on 8 October 2026.

EC2 instances bigger than the traffic needs

An instance is usually sized at launch, with headroom, and nobody looks at it again. Turn on Compute Optimizer in the AWS console. It is free and uses the last 14 days of metrics to show which instances are too big. It only takes memory into account when the CloudWatch agent runs on the instance.

Also check whether the application would run on Graviton, AWS's own ARM processors. In Frankfurt an m7g.large with Graviton is 19% cheaper than an m7i.large with an Intel processor. Resizing means stopping the instance, but you cannot move to ARM by changing the type alone. You need a new instance from an arm64 image, and for containers an arm64 build in CI as well.

A test environment often runs around the clock while the team uses it ten hours a day, Monday to Friday: 50 of the 168 hours in a week. AWS's Instance Scheduler starts and stops EC2 and RDS on a schedule you assign to the instance with a tag.

Always-on servers billed on demand

If some instances have run non-stop for months and you pay the on-demand rate for them, you are paying more than you need to. Compute Savings Plans cut the rate by up to 66% in exchange for a one- or three-year commitment.

In Cost Explorer, open Savings Plans and then the Coverage report. It shows how much of your cost a plan covers. Buy a plan only for the capacity that always runs, and only after you have downsized the instances. Buy it earlier and you commit to paying for the headroom for the whole term.

gp2 volumes, orphaned volumes and old snapshots

In Frankfurt a gp3 volume is 20% cheaper than gp2, and you can change the type without detaching the volume. Large gp2 volumes are faster than gp3 at its base price, though: from 334 GiB they have twice the throughput, and above 1,000 GiB more IOPS. For those volumes, buy the missing performance on gp3, or the disk will slow down.

A volume in the available state is not attached to any instance, and you pay for it all the same. The command works in one region, so run it with --region for each one you use:

aws ec2 describe-volumes \
  --filters Name=status,Values=available \
  --query "Volumes[].[VolumeId,Size,VolumeType,CreateTime]" \
  --output table

Before deleting a volume, take a snapshot of it. It costs $0.054 per GB-month, less than the volume, and lets you restore the data.

Snapshots pile up when a backup script creates copies and never deletes any. Replace the script with a Data Lifecycle Manager policy that deletes old copies itself. Delete the script's older copies by hand, because DLM does not touch them.

Public IPv4 addresses

Since February 2024 AWS has charged $3.65 a month for every public IPv4 address, including one attached to a running instance.

IdleAddress on the bill means addresses nothing is using. Release each one that is not in DNS or on a customer's or supplier's allowlist. The free Public IP Insights shows what each address is attached to. An instance behind a load balancer rarely needs its own public IP. If it connects to the internet itself, though, without an address it will need a NAT gateway, which costs more than ten addresses.

Traffic through NAT Gateway

A NAT gateway is the gateway through which servers without a public address reach the internet. In Frankfurt it costs about $38 a month, plus $0.052 for every GB that passes through it. When such a server reads and writes files in S3, all of that traffic goes through the gateway by default.

If NatGateway-Bytes costs more than NatGateway-Hours, find out where the application sends its traffic. Traffic to S3 and DynamoDB in the same region can go through a gateway endpoint, which AWS does not charge for. It is a route table entry, so the application code stays as it is.

CloudWatch logs

In Frankfurt ingesting a gigabyte of logs costs $0.63, and CloudWatch Logs keeps log data indefinitely by default.

In the CloudWatch console, open Log groups and sort by size. For groups showing Never Expire in the Retention column, set the period you actually need, for example 30 days for application logs. If DataProcessing-Bytes costs more than TimedStorage-ByteHrs, reduce the volume of logging in the application itself.

What to do this week

Create a budget in AWS Budgets with an e-mail alert. Budgets and their notifications are free, and the alert arrives when actual or forecast spend for the month crosses the amount you set. After that, activate your environment tags as cost allocation tags so Cost Explorer can separate staging from production.

Leave changes to instances, volumes and NAT with a developer, because each one needs testing. The sample report shows the result: a list of such changes, each with its monthly amount. It uses sample data that does not come from any client.

Originally published on codelevel.pl. Prices are net, for businesses. AWS, Hetzner and OVH are trademarks of their owners; CODELEVEL is not a partner, reseller or representative of any of them.

RDS has been charging extra for MySQL 8.0 since August

CODELEVEL - Jacob Binczyk — Thu, 08 Oct 2026 13:27:27 +0000

Standard support for MySQL 8.0 on RDS ended on 31 July 2026. Since 1 August AWS has been adding an Extended Support charge to every such database that has it enabled. The API, the CLI and Terraform enable it by default; in the console you have to tick it. The charge is already on your August and September bills.

If you run MySQL 8.0, move it to 8.4, which has standard support until 31 July 2029. Aurora MySQL 3, the 8.0-compatible line, has standard support until 30 April 2028, so there is no surcharge there yet.

What Extended Support costs

In Frankfurt, the AWS price list on 6 October 2026 gives $0.122 per vCPU-hour for the first two years, which is about $89 a month for each vCPU. From 1 August 2028 the rate doubles to $0.244. A Multi-AZ database keeps a standby copy in a second zone, and AWS charges for that standby too, so you pay twice as much.

Take a db.m6g.large in Multi-AZ, with 2 vCPUs. The instance alone costs about $264 a month in Frankfurt, and Extended Support adds $356 on top. For August and September AWS has already added about $714 to that database.

The chart for this part is in the original post.
Reserved Instances won't reduce the surcharge, because RI discounts don't apply to Extended Support.

Where it shows on the bill

Extended Support is a separate line item on the bill, next to instance hours and storage. In Cost Explorer, type ExtendedSupport into the Usage Type filter and select every result. The Frankfurt usage type for MySQL 8.0 is EUC1-ExtendedSupport:Yr1-Yr2:MySQL8.0.

The same filter catches databases on older versions too. MySQL 5.7 has been billed at the year-three rate since 1 March 2026. You can also load a Cost Explorer export grouped by usage type into the CSV analysis, which lists the largest items on the bill.

To see which databases you are paying for, run this command in each region:

aws rds describe-db-instances --region eu-central-1 \
  --query "DBInstances[?Engine=='mysql'].[
    DBInstanceIdentifier,
    EngineVersion, MultiAZ,
    EngineLifecycleSupport]" \
  --output table

Any 8.0.x row with open-source-rds-extended-support in the last column is a database you are paying the surcharge on.

Switching it off means an upgrade

You can change EngineLifecycleSupport at any time. But if you disable Extended Support on an 8.0 database, RDS upgrades it automatically to the next supported version, 8.4, whether or not you have tested the application on it. The charge stops once the database reaches a supported version. I described the same mechanism for PostgreSQL 14, where the deadline is still ahead.

How to move to 8.4

The target is 8.4, because newer MySQL versions are only available on RDS in the Database Preview environment, which AWS does not allow for production.

AWS recommends a blue/green deployment. RDS builds a copy of the database and replicates production changes into it, and you upgrade the copy to 8.4 and test the application against it. The copy is read-only and should stay that way, because writes to it break replication and can end up in production after the switch-over. Run tests that write against a database restored from a snapshot.

The switch-over itself usually takes under a minute. Afterwards the old database stays as …-old1, still on 8.0, and AWS keeps charging for the instance and for Extended Support. Delete it once you no longer need a way back.

An in-place upgrade takes about 10 minutes, and the database is down for that time. The documentation describes no way back to 8.0 after a successful upgrade.

On the copy, read PrePatchCompatibility.log: RDS runs prechecks before it stops the database and cancels the upgrade if any of them fail. Then check the changes listed in AWS's announcement of MySQL 8.4 on RDS:

New users in 8.4 get the caching_sha2_password plugin by default, while existing ones keep mysql_native_password. Make sure the application can connect with an account created after the upgrade.
restrict_fk_on_non_standard_key is on by default and stops you creating foreign keys built on non-unique or partial keys. Check that your schema migrations don't create any.
The old replication statements are syntax errors in 8.4, so in scripts and monitoring replace SHOW MASTER STATUS with SHOW BINARY LOG STATUS.
Compare the timing of your heaviest queries, because 8.4 changes InnoDB defaults.

When to do it

Ideally in October 2026. On the example db.m6g.large, every month of delay costs about $356. If the account has several 8.0 databases, start with the largest by vCPU count, standby included, since the charge scales with it.

Move anything on Aurora MySQL 3 to Aurora MySQL 8.4 during 2027, ahead of the 30 April 2028 deadline.

Originally published on codelevel.pl. Prices are net, for businesses. AWS, Hetzner and OVH are trademarks of their owners; CODELEVEL is not a partner, reseller or representative of any of them.