AWS rates PHP RCE as Important so Amazon Linux 2023 patch may take 20 days

Update: After posting this Amazon security released a bulletin to say we should see the updates _some time tomorrow_. https://aws.amazon.com/security/security-bulletins/2026-143-...

Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.

Patch releases are currently scheduled for tomorrow (October 22): https://aws.amazon.com/security/security-bulletins/2026-143-...

Amazon has a bad track record for delivering critical updates quickly. During the Copy Fail - CVE-2026-31431 event they were behind every major Linux distro in updating Bottlerocket OS

Honest question: Does anyone actually use Amazon Linux in production? Everywhere I've every worked used a mainstream distro for cloud servers, like Debian, Ubuntu, Red Hat or SUSE.

comment in question: https://github.com/amazonlinux/amazon-linux-2023/issues/1148...