AWS rates PHP RCE as Important so Amazon Linux 2023 patch may take 20 days

Posted by hayd |an hour ago |10 comments

hayd 11 minutes ago[1 more]

Update: After posting this Amazon security released a bulletin to say we should see the updates _some time tomorrow_. https://aws.amazon.com/security/security-bulletins/2026-143-...

Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.

otterley 12 minutes ago

Patch releases are currently scheduled for tomorrow (October 22): https://aws.amazon.com/security/security-bulletins/2026-143-...

mikeweiss 24 minutes ago[1 more]

Amazon has a bad track record for delivering critical updates quickly. During the Copy Fail - CVE-2026-31431 event they were behind every major Linux distro in updating Bottlerocket OS

80fj0348i 6 minutes ago[1 more]

Honest question: Does anyone actually use Amazon Linux in production? Everywhere I've every worked used a mainstream distro for cloud servers, like Debian, Ubuntu, Red Hat or SUSE.

hayd an hour ago[1 more]

comment in question: https://github.com/amazonlinux/amazon-linux-2023/issues/1148...