News for hackers. Stuff that matters.

A comment on Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure. Parent comment

Re:Amazon identifies Oct 17 PHP2Shell exploitation prior to ... by otterley on Thursday October 22, 2026 @10:14AM (#50195628)
I don't think you're being understanding or empathetic here.

Any vendor that delivers updated packages without thorough regression testing that ends up causing an incident for their customers as a result will get a thrashing from the community. Remember the CrowdStrike BSOD incident in 2024?

Maybe Ubuntu and others are cutting corners to deliver more quickly. It's their risk to take, but it's still a risk.

[ Parent | on HN ]
Re:Amazon identifies Oct 17 PHP2Shell exploitation prior to ... by bcvvvy on Thursday October 22, 2026 @10:51AM (#50196225)
Every vendor is winging it there. Even RHEL. Ubuntu ships shit half the time as well even on LTS.

If you need to test it you should pin packages.

[ Parent | on HN ]
Re:Amazon identifies Oct 17 PHP2Shell exploitation prior to ... by otterley on Thursday October 22, 2026 @11:53AM (#50197124)
> If you need to test it you should pin packages.

Unfortunately people rarely follow best practices.

Customers frequently do risky things like using launch templates that refer to the latest AMI. AMI changes, Auto Scaling launches a new/replacement instance in the fleet without adequate testing, *boom*.

[ Parent | on HN ]