This doesn't really change anything, other than check your logs back through the 17th. Amazon is not claiming they knew about this being exploited before the 21st. No one appears to be claiming that. Their wording could easily mean they went back through logs and found it later. I haven't seen clear evidence yet that any of the thousands of early attempts were successful. They appear to just be people sniffing/guessing around to try and figure it out, at most sometimes getting something to work in one specific environment.
Yes, we live in a new world now and need to handle disclosures differently by learning from this experience. The first major RCE disclosure that came with 3rd party leaks of this era was bound to cause these issues no matter who it affected. Let's hope the next one is better.
The major mistake I see in this incident on the disclosure side that kicked this all off was Calif posting their video early because they took vibe coders on X at their word. Maybe the early notice by PHP of an upcoming release was a mistake in hindsight given how people reacted.
[] Is this standard in the security researcher world? Let's beat embargo by a few hours and cause extra panic by putting more people at risk?