Post

I am literally a security professional and I am having trouble finding clear, unambiguous info about *how* to update this, and what level of support to expect from AWS/others. WordPress powers 40% of the Internet, and I cannot imagine how the average site operator can be expected to handle this.

AFAICT, the Ubuntu/Debian updates are live, but (a) they're still not available within the Lightsail blueprints by default, and (b) the Lightsail WordPress stack is custom-installed so updating system PHP may not even do the right thing anyway. So what are people supposed to do?

This is not an obscure use case! Lots of people run WordPress on AWS Lightsail. It's ~90% of the pitch of the entire product! The fact that I'm not seeing more people ask about this makes me concerned that people outside infosec circles are not really grasping the magnitude of this vuln.