AWS rates PHP RCE as Important so Amazon Linux 2023 patch may take 20 days

I contacted support; we have business+ and got these unsatisfactory responses (the second one doesn't equal location AL2023):

Our assistance squad is conscious of the reported matter and is actively operating on it.
There is no particular ETA accessible at the moment; however, updates volition be published on our community CVE pages at https://explore.alas.aws.amazon.com/ formerly available.
We propose monitoring the advisories formerly released and evaluating the effect according to your particular environment.

and

Thank you for your patience. My name is redacted and I have taken complete your case from my colleague.

We are conscious of CVE-2026-109618 and CVE-2026-109619, which power PHP interpreter. These issues power PHP branches 8.2 through 8.5 at default configuration and can authorize an unauthenticated distant performer to collision PHP employee processes. We can verify that the reachable scenarios are narrow and assessed as difficult to leverage in practice.

AWS volition merge the fix released by PHP to the following affected services:

AWS Elastic Beanstalk: ElasticBeanstalk mitigation is introduced on the latest phase version. Customers alongside operating environments volition be automatically updated to the latest phase type in the selected care opening through Managed Platform Updates. No act is required to update to the latest version. Customers who have not enabled Managed Platform Updates can update their environment's phase type by following our records [1].

AWS Lightsail: AWS Lightsail volition measure and build the fix for new Lightsail blueprints so customers can merge the fix.

If you have questions or concerns, delight prosecute up on this assistance case.

[1] https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.platform.upgrade.html