> Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.
Posts elsewhere have suggested that the embargo was broken early. Even the PHP release team itself didn't have sufficient time to update their public Docker images before it was published.
My understanding is the embargo was scheduled to end 14:00 UTC today, broken 07:41 UTC by Chainguard... It's now 22:00 UTC and AWS are talking about (some time) tomorrow.
Yes, PHP release was scheduled for Wednesday, 21 October 2026 at 14:00 UTC: https://news-web.php.net/php.announce/509
The official story is that it was originally scheduled for 14:00 UTC tomorrow. Then yesterday they decided to move the date forward by 24 hours in response to information about the vulnerability leaking.