> Why haven’t they fixed Amazon Linux then? Same as none of their AMIs for bottlerocket have emSign revocations.

Last I checked, Amazon has also not patched their Lightsail blueprints for WordPress, or even communicated about the vulnerability with those customers at all, which is arguably way worse, because

(a) by design, all-in-one blueprints aren't really intended to use system PHP or have system PHP updated in a meaningful way; and

(b) hosting static sites such as WordPress is 90% of the selling point of Lightsail as a product

-1: if the fix breaks customers in other ways, they're screwed as well. Damned if you do, damned if you don't...