Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.
> Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.
Posts elsewhere have suggested that the embargo was broken early. Even the PHP release team itself didn't have sufficient time to update their public Docker images before it was published.
Amazon has a bad track record for delivering critical updates quickly. During the Copy Fail - CVE-2026-31431 event they were behind every major Linux distro in updating Bottlerocket OS
Honest question: Does anyone actually use Amazon Linux in production? Everywhere I've every worked used a mainstream distro for cloud servers, like Debian, Ubuntu, Red Hat or SUSE.
Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.
Posts elsewhere have suggested that the embargo was broken early. Even the PHP release team itself didn't have sufficient time to update their public Docker images before it was published.
Roughly one release every 15-20 days.
I'm not sure anything says what your editorialised title, and comment link says.
They were calling out that an NGINX CVE that was Important took 20 days. They're saying nothing about what classification Amazon has set on PHP,.
> So, from the CVE publication to an available fixed package it took 20 days, not a month.
They specifically call out that it's not the same as the Nginx case:
> In contrast to the PHP's case, that CVE wasn't Critical, but only Important, that doesn't have the same urgency.
Both are labelled Important, not Critical.