Update: After posting this Amazon security released a bulletin to say we should see the updates _some time tomorrow_. https://aws.amazon.com/security/security-bulletins/2026-143-...
Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.
> Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.
Posts elsewhere have suggested that the embargo was broken early. Even the PHP release team itself didn't have sufficient time to update their public Docker images before it was published.
My understanding is the embargo was scheduled to end 14:00 UTC today, broken 07:41 UTC by Chainguard... It's now 22:00 UTC and AWS are talking about (some time) tomorrow.
Yes, PHP release was scheduled for Wednesday, 21 October 2026 at 14:00 UTC: https://news-web.php.net/php.announce/509
The official story is that it was originally scheduled for 14:00 UTC tomorrow. Then yesterday they decided to move the date forward by 24 hours in response to information about the vulnerability leaking.
Even assuming they didn't have prior knowledge, I don't understand why AWS is going to take 24+ hours to incorporate an upstream fix.
Probably because it takes time for them to run all the regression tests. They don't want to break something while fixing something else. Damned either way.
In the meantime, you can mitigate the vulnerability significantly by following the instructions here: https://www.abstract.security/blog/php2shell-critical-php-rc...
[dead]