Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.
> Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.
Posts elsewhere have suggested that the embargo was broken early. Even the PHP release team itself didn't have sufficient time to update their public Docker images before it was published.
My understanding is the embargo was scheduled to end 14:00 UTC today, broken 07:41 UTC by Chainguard... It's now 22:00 UTC and AWS are talking about (some time) tomorrow.
The official story is that it was originally scheduled for 14:00 UTC tomorrow. Then yesterday they decided to move the date forward by 24 hours in response to information about the vulnerability leaking.
Amazon has a bad track record for delivering critical updates quickly. During the Copy Fail - CVE-2026-31431 event they were behind every major Linux distro in updating Bottlerocket OS
Honest question: Does anyone actually use Amazon Linux in production? Everywhere I've every worked used a mainstream distro for cloud servers, like Debian, Ubuntu, Red Hat or SUSE.
Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.
Posts elsewhere have suggested that the embargo was broken early. Even the PHP release team itself didn't have sufficient time to update their public Docker images before it was published.
Roughly one release every 15-20 days.
I'm not sure anything says what your editorialised title, and comment link says.
They were calling out that an NGINX CVE that was Important took 20 days. They're saying nothing about what classification Amazon has set on PHP,.
> So, from the CVE publication to an available fixed package it took 20 days, not a month.
They specifically call out that it's not the same as the Nginx case:
> In contrast to the PHP's case, that CVE wasn't Critical, but only Important, that doesn't have the same urgency.
Both are labelled Important, not Critical.