> Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.
replyPosts elsewhere have suggested that the embargo was broken early. Even the PHP release team itself didn't have sufficient time to update their public Docker images before it was published.
My understanding is the embargo was scheduled to end 14:00 UTC today, broken 07:41 UTC by Chainguard... It's now 22:00 UTC and AWS are talking about (some time) tomorrow.
replyYes, PHP release was scheduled for Wednesday, 21 October 2026 at 14:00 UTC: https://news-web.php.net/php.announce/509
replyThe official story is that it was originally scheduled for 14:00 UTC tomorrow. Then yesterday they decided to move the date forward by 24 hours in response to information about the vulnerability leaking.
replyEven assuming they didn't have prior knowledge, I don't understand why AWS is going to take 24+ hours to incorporate an upstream fix.
replyProbably because it takes time for them to run all the regression tests. They don't want to break something while fixing something else. Damned either way.
replyIn the meantime, you can mitigate the vulnerability significantly by following the instructions here: https://www.abstract.security/blog/php2shell-critical-php-rc...
[dead]
replydeleted
reply