Yet another Hacker News

AWS rates PHP RCE as Important so Amazon Linux 2023 patch may take 20 days

72 points hayd 1 hour ago 17 comments

hayd 1 hour ago | parent

comment in question: https://github.com/amazonlinux/amazon-linux-2023/issues/1148...

Twirrim 44 minutes ago | parent

Where, exactly, does Amazon classify the PHP RCE as Important?

I'm not sure anything says what your editorialised title, and comment link says.

They were calling out that an NGINX CVE that was Important took 20 days. They're saying nothing about what classification Amazon has set on PHP,.

> So, from the CVE publication to an available fixed package it took 20 days, not a month.

They specifically call out that it's not the same as the Nginx case:

> In contrast to the PHP's case, that CVE wasn't Critical, but only Important, that doesn't have the same urgency.

hayd 42 minutes ago | parent

https://explore.alas.aws.amazon.com/CVE-2026-109618.html https://explore.alas.aws.amazon.com/CVE-2026-109619.html

Both are labelled Important, not Critical.

pixl97 14 minutes ago | parent

Heh, what is critical in their eyes? Catching the servers physically on fire?

trgfdffd 15 minutes ago | parent

It seems to me that this comment is just regarding an earlier vulnerability and doesn't comment on PHP2Shell?

mikeweiss 40 minutes ago | parent

Amazon has a bad track record for delivering critical updates quickly. During the Copy Fail - CVE-2026-31431 event they were behind every major Linux distro in updating Bottlerocket OS

captn3m0 33 minutes ago | parent

Bottlerocket's changelog through the storm of Linux CVEs these last year has been bad as well: https://github.com/bottlerocket-os/bottlerocket/blob/develop...

Roughly one release every 15-20 days.

otterley 29 minutes ago | parent

Patch releases are currently scheduled for tomorrow (October 22): https://aws.amazon.com/security/security-bulletins/2026-143-...

hayd 28 minutes ago | parent

Update: After posting this Amazon security released a bulletin to say we should see the updates _some time tomorrow_. https://aws.amazon.com/security/security-bulletins/2026-143-...

Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.

otterley 23 minutes ago | parent

> Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.

Posts elsewhere have suggested that the embargo was broken early. Even the PHP release team itself didn't have sufficient time to update their public Docker images before it was published.

hayd 15 minutes ago | parent

My understanding is the embargo was scheduled to end 14:00 UTC today, broken 07:41 UTC by Chainguard... It's now 22:00 UTC and AWS are talking about (some time) tomorrow.

radlad 10 minutes ago | parent

Yes, PHP release was scheduled for Wednesday, 21 October 2026 at 14:00 UTC: https://news-web.php.net/php.announce/509

bunderbunder 4 minutes ago | parent

The official story is that it was originally scheduled for 14:00 UTC tomorrow. Then yesterday they decided to move the date forward by 24 hours in response to information about the vulnerability leaking.

edaemon 11 minutes ago | parent

Even assuming they didn't have prior knowledge, I don't understand why AWS is going to take 24+ hours to incorporate an upstream fix.

80fj0348i 23 minutes ago | parent

Honest question: Does anyone actually use Amazon Linux in production? Everywhere I've every worked used a mainstream distro for cloud servers, like Debian, Ubuntu, Red Hat or SUSE.

otterley 21 minutes ago | parent

I do. It works fine, particularly if you're using EKS- or ECS-optimized images.

pier25 8 minutes ago | parent

sounds like they are trying to get rid of users of Amazon Linux honestly