<- Back
Comments (26)
- haydUpdate: After posting this Amazon security released a bulletin to say we should see the updates _some time tomorrow_. https://aws.amazon.com/security/security-bulletins/2026-143-...Scant messaging throughout the day. I don't understand why AWS, seemingly, didn't have prior knowledge of this/have it ready very soon after the CVE announcement.
- mikeweissAmazon has a bad track record for delivering critical updates quickly. During the Copy Fail - CVE-2026-31431 event they were behind every major Linux distro in updating Bottlerocket OS
- HoyaSaxaPoor showing from AWS especially since Wiz’s blog post explicitly mentions that AWS was given advance notice.But they did in fact release the updated Amazon Linux image about 15 minutes ago: https://github.com/amazonlinux/amazon-linux-2023/issues/1148...
- haydWe didn't get much information throughout the day, besides these comments by an AWS employee/Amazon Linux maintainer on this thread: https://github.com/amazonlinux/amazon-linux-2023/issues/1148...He referenced an nginx Important CVE taking 20 days to be patched - after it was noted that these PHP CVEs were also labelled by AWS as Important (not Critical). This employee took issue to another user's comment describing 20 days as "nearly a month".Amazon Linux users/AWS customers barely got any tangible information from the CVE publication at 14:00UTC until this bulletin was posted at 21:30UTC. Very disappointing.
- otterleyPatch releases are currently scheduled for tomorrow (October 22): https://aws.amazon.com/security/security-bulletins/2026-143-...
- 80fj0348iHonest question: Does anyone actually use Amazon Linux in production? Everywhere I've every worked used a mainstream distro for cloud servers, like Debian, Ubuntu, Red Hat or SUSE.
- anonundefined
- pier25sounds like they are trying to get rid of users of Amazon Linux honestly