AWS rates PHP RCE as Important so Amazon Linux 2023 patch may take 20 days (github.com)

62 pointsby haydan hour ago14 comments

hayd 18 minutes ago

Update: After posting this Amazon security released a bulletin to say we should see the updates _some time tomorrow_. https://aws.amazon.com/security/security-bulletins/2026-143-...

Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.

otterley 13 minutes ago

> Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.

Posts elsewhere have suggested that the embargo was broken early. Even the PHP release team itself didn't have sufficient time to update their public Docker images before it was published.

hayd 5 minutes ago

My understanding is the embargo was scheduled to end 14:00 UTC today, broken 07:41 UTC by Chainguard... It's now 22:00 UTC and AWS are talking about (some time) tomorrow.

edaemon 5 minutes ago

[delayed]

mikeweiss 31 minutes ago

Amazon has a bad track record for delivering critical updates quickly. During the Copy Fail - CVE-2026-31431 event they were behind every major Linux distro in updating Bottlerocket OS

captn3m0 24 minutes ago

Bottlerocket's changelog through the storm of Linux CVEs these last year has been bad as well: https://github.com/bottlerocket-os/bottlerocket/blob/develop...

Roughly one release every 15-20 days.

otterley 19 minutes ago

Patch releases are currently scheduled for tomorrow (October 22): https://aws.amazon.com/security/security-bulletins/2026-143-...

80fj0348i 13 minutes ago

Honest question: Does anyone actually use Amazon Linux in production? Everywhere I've every worked used a mainstream distro for cloud servers, like Debian, Ubuntu, Red Hat or SUSE.

otterley 12 minutes ago

I do. It works fine, particularly if you're using EKS- or ECS-optimized images.

hayd an hour ago

comment in question: https://github.com/amazonlinux/amazon-linux-2023/issues/1148...

Twirrim 35 minutes ago

Where, exactly, does Amazon classify the PHP RCE as Important?

I'm not sure anything says what your editorialised title, and comment link says.

They were calling out that an NGINX CVE that was Important took 20 days. They're saying nothing about what classification Amazon has set on PHP,.

> So, from the CVE publication to an available fixed package it took 20 days, not a month.

They specifically call out that it's not the same as the Nginx case:

> In contrast to the PHP's case, that CVE wasn't Critical, but only Important, that doesn't have the same urgency.

hayd 32 minutes ago

https://explore.alas.aws.amazon.com/CVE-2026-109618.html https://explore.alas.aws.amazon.com/CVE-2026-109619.html

Both are labelled Important, not Critical.

pixl97 5 minutes ago

Heh, what is critical in their eyes? Catching the servers physically on fire?

trgfdffd 6 minutes ago

It seems to me that this comment is just regarding an earlier vulnerability and doesn't comment on PHP2Shell?