Bref runtimes and container images with the patched PHP are out. (31 minutes after php released 💪) github.com/brefphp/aws-lambd… to update: - composer update bref/bref && redeploy - Docker: pull bref/php-xx-fpm again PHP-FPM is the affected runtime, Octane / function runtime are not in the attack paths. Update everything anyway. CVE details: php.net/archive/2026.php#202…

PHP ships a critical security release today at 14:00 UTC (PHP 8.2+ only) what it means for Bref: - we'll update PHP (Lambda layers + Docker images) after new versions are out - then: `composer update bref/bref` and redeploy - *seems like* only the PHP-FPM runtime is impacted, not Octane or CLI/jobs. TBC I'll update here, join slack for live updates: bref.sh/slack