We didn't get much information throughout the day, besides these comments by an AWS employee/Amazon Linux maintainer on this thread: https://github.com/amazonlinux/amazon-linux-2023/issues/1148...

He referenced an nginx Important CVE taking 20 days to be patched - after it was noted that these PHP CVEs were also labelled by AWS as Important (not Critical). This employee took issue to another user's comment describing 20 days as "nearly a month".

Amazon Linux users/AWS customers barely got any tangible information from the CVE publication at 14:00UTC until this bulletin was posted at 21:30UTC. Very disappointing.