Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.
otterley 2 hours ago [-]
> Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.
Posts elsewhere have suggested that the embargo was broken early. Even the PHP release team itself didn't have sufficient time to update their public Docker images before it was published.
hayd 2 hours ago [-]
My understanding is the embargo was scheduled to end 14:00 UTC today, broken 07:41 UTC by Chainguard... It's now 22:00 UTC and AWS are talking about (some time) tomorrow.
The official story is that it was originally scheduled for 14:00 UTC tomorrow. Then yesterday they decided to move the date forward by 24 hours in response to information about the vulnerability leaking.
edaemon 1 hours ago [-]
Even assuming they didn't have prior knowledge, I don't understand why AWS is going to take 24+ hours to incorporate an upstream fix.
otterley 1 hours ago [-]
Probably because it takes time for them to run all the regression tests. They don't want to break something while fixing something else. Damned either way.
Amazon has a bad track record for delivering critical updates quickly. During the Copy Fail - CVE-2026-31431 event they were behind every major Linux distro in updating Bottlerocket OS
Honest question: Does anyone actually use Amazon Linux in production? Everywhere I've every worked used a mainstream distro for cloud servers, like Debian, Ubuntu, Red Hat or SUSE.
otterley 2 hours ago [-]
I do. It works fine, particularly if you're using EKS- or ECS-optimized images.
benjaopazoc 1 hours ago [-]
We did, until this morning
iririririr 1 hours ago [-]
aren't everyone using lambda functions? and aws infra itself? they migth only consider the urgency of internal teams, so anything !java will be pushed.
He referenced an nginx Important CVE taking 20 days to be patched - after it was noted that these PHP CVEs were also labelled by AWS as Important (not Critical). This employee took issue to another user's comment describing 20 days as "nearly a month".
Amazon Linux users/AWS customers barely got any tangible information from the CVE publication at 14:00UTC until this bulletin was posted at 21:30UTC. Very disappointing.
Twirrim 2 hours ago [-]
Where, exactly, does Amazon classify the PHP RCE as Important?
I'm not sure anything says what your editorialised title, and comment link says.
They were calling out that an NGINX CVE that was Important took 20 days. They're saying nothing about what classification Amazon has set on PHP,.
> So, from the CVE publication to an available fixed package it took 20 days, not a month.
They specifically call out that it's not the same as the Nginx case:
> In contrast to the PHP's case, that CVE wasn't Critical, but only Important, that doesn't have the same urgency.
Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.
Posts elsewhere have suggested that the embargo was broken early. Even the PHP release team itself didn't have sufficient time to update their public Docker images before it was published.
In the meantime, you can mitigate the vulnerability significantly by following the instructions here: https://www.abstract.security/blog/php2shell-critical-php-rc...
Roughly one release every 15-20 days.
He referenced an nginx Important CVE taking 20 days to be patched - after it was noted that these PHP CVEs were also labelled by AWS as Important (not Critical). This employee took issue to another user's comment describing 20 days as "nearly a month".
Amazon Linux users/AWS customers barely got any tangible information from the CVE publication at 14:00UTC until this bulletin was posted at 21:30UTC. Very disappointing.
I'm not sure anything says what your editorialised title, and comment link says.
They were calling out that an NGINX CVE that was Important took 20 days. They're saying nothing about what classification Amazon has set on PHP,.
> So, from the CVE publication to an available fixed package it took 20 days, not a month.
They specifically call out that it's not the same as the Nginx case:
> In contrast to the PHP's case, that CVE wasn't Critical, but only Important, that doesn't have the same urgency.
Both are labelled Important, not Critical.