HN Explorer

22 comments

[ 0.22 ms ] story [ 6.3 ms ] thread
hayd
comment in question: https://github.com/amazonlinux/amazon-linux-2023/issues/1148...
Twirrim
Where, exactly, does Amazon classify the PHP RCE as Important?

I'm not sure anything says what your editorialised title, and comment link says.

They were calling out that an NGINX CVE that was Important took 20 days. They're saying nothing about what classification Amazon has set on PHP,.

> So, from the CVE publication to an available fixed package it took 20 days, not a month.

They specifically call out that it's not the same as the Nginx case:

> In contrast to the PHP's case, that CVE wasn't Critical, but only Important, that doesn't have the same urgency.

trgfdffd
It seems to me that this comment is just regarding an earlier vulnerability and doesn't comment on PHP2Shell?
mikeweiss
Amazon has a bad track record for delivering critical updates quickly. During the Copy Fail - CVE-2026-31431 event they were behind every major Linux distro in updating Bottlerocket OS
jamesfinlayson
Yes I was hit by waiting for Elastic Beanstalk to update nginx for the succession of fixes. Wasn't fun being pestered by my security team.
otterley
I think you mean tomorrow: https://aws.amazon.com/security/security-bulletins/2026-143-...
hayd
Update: After posting this Amazon security released a bulletin to say we should see the updates _some time tomorrow_. https://aws.amazon.com/security/security-bulletins/2026-143-...

Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.

edaemon
Even assuming they didn't have prior knowledge, I don't understand why AWS is going to take 24+ hours to incorporate an upstream fix.
80fj0348i
Honest question: Does anyone actually use Amazon Linux in production? Everywhere I've every worked used a mainstream distro for cloud servers, like Debian, Ubuntu, Red Hat or SUSE.
iririririr
aren't everyone using lambda functions? and aws infra itself? they migth only consider the urgency of internal teams, so anything !java will be pushed.
jamesfinlayson
Yes. I had a project that was built with Elastic Beanstalk and was trying to move off it, but never got there. Amazon Linux and its package management was not great and I missed Debian/CentOS/Ubuntu.
pier25
sounds like they are trying to get rid of users of Amazon Linux honestly
[deleted]
(comment deleted)