Hacker News
PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
hayd
|next
[-]
Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.
edaemon
|root
|parent
|next
[-]
otterley
|root
|parent
[-]
In the meantime, you can mitigate the vulnerability significantly by following the instructions here: https://www.abstract.security/blog/php2shell-critical-php-rc...
otterley
|root
|parent
|next
|previous
[-]
Posts elsewhere have suggested that the embargo was broken early. Even the PHP release team itself didn't have sufficient time to update their public Docker images before it was published.
hayd
|root
|parent
[-]
bunderbunder
|root
|parent
|next
[-]
radlad
|root
|parent
|previous
[-]
mikeweiss
|next
|previous
[-]
captn3m0
|root
|parent
[-]
Roughly one release every 15-20 days.
otterley
|next
|previous
[-]
80fj0348i
|next
|previous
[-]
hayd
|next
|previous
[-]
He referenced an nginx Important CVE taking 20 days to be patched - after it was noted that these PHP CVEs were also labelled by AWS as Important (not Critical). This employee took issue to another user's comment describing 20 days as "nearly a month".
Amazon Linux users/AWS customers barely got any tangible information from the CVE publication at 14:00UTC until this bulletin was posted at 21:30UTC. Very disappointing.
Twirrim
|root
|parent
|next
[-]
I'm not sure anything says what your editorialised title, and comment link says.
They were calling out that an NGINX CVE that was Important took 20 days. They're saying nothing about what classification Amazon has set on PHP,.
> So, from the CVE publication to an available fixed package it took 20 days, not a month.
They specifically call out that it's not the same as the Nginx case:
> In contrast to the PHP's case, that CVE wasn't Critical, but only Important, that doesn't have the same urgency.
hayd
|root
|parent
[-]
Both are labelled Important, not Critical.