GuardDuty
11 items across 3 sections
Week 26 - June 22-28, 2026
GuardDuty previews AI-powered investigations, and AWS Sign-In gains resource-based policies plus RCPs that lock console access to expected networks. Researchers deliver a triple hit: Unit 42's universal bucket hijacking, a targeted AWS-console phishing kit that handles MFA, and Wiz's disclosure of an Amazon Q Developer flaw that leaked AWS credentials on repo open.
Week 27 - June 29 - July 5, 2026
AWS discloses an HTTP/2 body-inspection bypass in WAF rated CVSS 9.8, and a new CitrixBleed-class NetScaler flaw is exploited within 24 hours of its patch. On the launch side: ACM speaks ACME, GuardDuty watches sensitive file modifications, and WAF extends to AgentCore Gateway. Three more toolchain bulletins land on July 1.
Week 29 - July 13-19, 2026
GuardDuty extends threat detection to Bedrock and SageMaker workloads, Security Hub goes multicloud with Azure support and an AI asset inventory, and Cognito removes the last big migration blocker by importing password hashes. Seven AWS bulletins land in four days, including a prompt-and-response leak in AgentCore telemetry.
Week 30 - July 20-26, 2026
GuardDuty gets an on-demand investigation agent in public preview, Secrets Manager starts publishing secret-change events to EventBridge, and CloudTrail learns to filter network activity logging by identity. Five more bulletins close out July, including a TLS 1.3 record-drop flaw in s2n-tls and a third AgentCore SDK patch this summer.
Week 40 - Sep 28 - Oct 4, 2026
Seven new AWS bulletins this week, led by a CVSS 10.0 authentication bypass in Loom, an AWS Labs agent orchestration platform, and a SageMaker Unified Studio flaw that, in projects with Trusted Identity Propagation enabled, could let a project contributor obtain another member's temporary role credentials. On the defensive side, Security Hub added remediation plans, GuardDuty can now be enforced through Organizations declarative policies, and CloudTrail now shows where data-event logging is missing.
Week 41 - Oct 5 - Oct 11, 2026
Eight new AWS security bulletins this week, led by a code injection in the deprecated Bedrock AgentCore Starter Toolkit and a now-fixed Athena engine version 3 authorization gap that could have exposed query metadata across accounts. On the defensive side, GuardDuty RDS Protection now watches database query activity for exfiltration and destruction, and IAM Identity Center can restrict where Identity Store and SCIM API calls come from.
AWS ECS Security Best Practices
Comprehensive guide to securing Amazon Elastic Container Service. Covers task role separation, non-root containers, ECR image scanning, secrets management, GuardDuty runtime monitoring, network isolation, ECScape mitigation, and container image signing.
AWS VPC Security Best Practices
Comprehensive guide to securing AWS Virtual Private Cloud. Covers Security Groups, NACLs, VPC Flow Logs, VPC Endpoints, Block Public Access, Encryption Controls, Network Firewall, Transit Gateway, and GuardDuty threat detection.
AWS GuardDuty Security Best Practices
Comprehensive guide to AWS GuardDuty threat detection. Covers Extended Threat Detection, Runtime Monitoring for ECS/EKS/EC2, Malware Protection, S3 and RDS Protection, automated response, multi-account management, and SIEM integration.
AWS EKS Security Best Practices
Comprehensive guide to securing Amazon Elastic Kubernetes Service. Covers Pod Identity, RBAC least privilege, Pod Security Standards, network policies, secrets encryption, GuardDuty EKS protection, EKS Auto Mode, and CIS EKS Benchmark compliance.
Need Help with AWS Security?
Our AWS security experts can help you implement best practices across all these topics.
Contact Us