PHP Vulnerability Responses by Company

Bref

Global cloud / infrastructure
Aliases / services
ブレフ / bref/bref / Bref Lambda / Bref
Official website
https://bref.sh/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Bref 2/3 (Lambda layers and Docker runtimes)

Response status
Patched Lambda layers published
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Provider of PHP runtimes for AWS Lambda.

Bref 3.0.14 and 2.4.22 reference patched PHP layers. Unmaintained Bref 1 layers were not rebuilt.

Scope: Existing functions still require updating and redeployment. The announced Bref Cloud rollout schedule is not completion evidence.

What users should do

Update to the relevant release with composer update bref/bref -W and redeploy Lambda functions. Pull updated images for Docker deployments.

Official service URL

Source URLs

  1. Bref PHP security releasehttps://bref.sh/news/06-php-security-release-october-2026Response evidence
Related official sources
  1. Bref PHP security releaseOfficial notice

Comments