andyvanosdale

It's not about changing anything, and that was not what was posted in my comment. Amazon saying they saw some signs of people probing for this back on October 17 shows that the shade that the PHP publicly threw on Chainguard was misdirected and a deflection on their own efforts to coordinate the release. It should change the PHP team's deflection, if anything.

Nothing is standard in the security researcher world. I have no interest in PHP nor Chainguard, but I have a greater interest. PHP folks can deflect the blame to Chainguard, but really, it's the PHP team who mishandled this from years ago. There were likely other disclosures or discoveries of this, if Amazon were starting to see this probed on October 17. Heck, OpenAI found this at nearly the same time as the original POC disclosure.

While I get that your intentions are good, if your proxy has a vulnerability, it can be exploited. Many people use nginx as a proxy, and it has its own vulnerabilities that have been fixed over the years. You may have solved one problem while opening up another. Even those fronting services have their own vulnerabilities that have to be fixed.

If a system is accessible by someone else, it is inherently insecure and needs to be hardened.

If this was being probed and/or exploited on October 17th, this throws shade on the PHP team for throwing shade on Chainguard in their public announcement.

Essentially, the PHP team is deflecting and abdicating their responsibilities in all this mess they created. "Chainguard broke embargo", "support us with money", "we are just volunteers", "we had knowledge years ago but no POC because we wanted to ship features and not security fixes". All just deflections.

This fiasco shows me that I would never use PHP for any project I'm part of. The PHP team royally messed up, and they are deflecting the blame left, right, up, and down.

Can they, yes. Just about anyone can be used for just about anything.

Should they, no. Why should Amazon continuously support, checks notes... 14 year old devices??? Likely the number of customers using a device like that anymore is super small.

It's definitely not worse than GitHub being down...