Security Hub
15 items across 3 sections
Week 1 - Jan 1-5, 2026
AWS announces SSE-C will be disabled by default on new general-purpose S3 buckets starting April 2026, closing the Codefinger ransomware vector. Security Hub and Security Agent updates from re:Invent 2025 keep rolling out.
Week 9 - Feb 24 - Mar 2, 2026
Security Hub Extended Plan reaches GA with 14+ partners on day one, the launch most enterprises have been waiting for. LexisNexis loses 2 GB via a misconfigured AWS environment. Three AWS-LC crypto library CVEs land in one drop. VPC Encryption Controls move from preview to paid.
Week 11 - Mar 10-15, 2026
Security Hub Extended officially expands to AWS, Azure, GCP, OCI, and Kubernetes, the long-anticipated cross-cloud play. European Sovereign Cloud completes SOC 2 Type 2 and BSI C5 audits. IAM Roles Anywhere ships post-quantum signing via ML-DSA. Inspector Classic gets a May 2026 EOL date.
Week 21 - May 18-24, 2026
Security Hub learns to find identity risk that no one is using: unused IAM permissions, roles, and credentials, measured against 90 days of real activity. The Extended plan grows to 21 partners across 9 categories. Secrets Manager Agent picks up pre-fetching and cross-account role assumption, and Amazon Inspector Classic reaches end of support.
Week 28 - July 6-12, 2026
Sygnia documents a lone actor compromising a global enterprise's AWS estate in under 72 hours with AI-assisted workflows. Wiz finds the same symlink trust flaw in six AI coding assistants. On defense: Security Hub gains internet-facing network scanning and AWS Config adds 191 managed rules.
Week 29 - July 13-19, 2026
GuardDuty extends threat detection to Bedrock and SageMaker workloads, Security Hub goes multicloud with Azure support and an AI asset inventory, and Cognito removes the last big migration blocker by importing password hashes. Seven AWS bulletins land in four days, including a prompt-and-response leak in AgentCore telemetry.
Week 34 - Aug 17-23, 2026
Truffle Security reports that more than 9,300 of 10,616 re-tested leaked AWS keys still authenticate, 768 of them with full administrator or root access, some five years after first appearing publicly. Security Hub Extended adds Supply Chain Security as its tenth category. AWS also ships seven security bulletins this week, mostly across OpenSearch Dashboards and FreeRTOS-Kernel.
Week 39 - Sep 21 - Sep 27, 2026
A setup-only Lambda function in the Amazon Connect Salesforce integration let any principal allowed to invoke it perform AWS operations their own IAM permissions would deny. Also patched: a Kiro IDE flaw that could let a crafted repository, opened as an untrusted workspace, cause the agent to modify its auto-loaded global configuration, a code-execution bug in the pgcollection PostgreSQL extension, and a single-packet shutdown in s2n-quic. On the launch side, AWS Network Security Manager reached general availability.
Week 40 - Sep 28 - Oct 4, 2026
Seven new AWS bulletins this week, led by a CVSS 10.0 authentication bypass in Loom, an AWS Labs agent orchestration platform, and a SageMaker Unified Studio flaw that, in projects with Trusted Identity Propagation enabled, could let a project contributor obtain another member's temporary role credentials. On the defensive side, Security Hub added remediation plans, GuardDuty can now be enforced through Organizations declarative policies, and CloudTrail now shows where data-event logging is missing.
Week 41 - Oct 5 - Oct 11, 2026
Eight new AWS security bulletins this week, led by a code injection in the deprecated Bedrock AgentCore Starter Toolkit and a now-fixed Athena engine version 3 authorization gap that could have exposed query metadata across accounts. On the defensive side, GuardDuty RDS Protection now watches database query activity for exfiltration and destruction, and IAM Identity Center can restrict where Identity Store and SCIM API calls come from.
Week 42 - Oct 12 - Oct 18, 2026
Six new AWS security bulletins this week, led by an Amazon Neptune query-engine issue that its CVE record scores 9.9 (CRITICAL) and a Linux kernel virtio-net/TAP flaw that affects self-managed KVM hosts but not EC2, Lambda or Fargate. On the defensive side, OpenSearch Service gets per-index KMS keys, Security Hub adds resource criticality and the Cyber Risk Institute profile, Secrets Manager rotates Databricks and Twilio credentials, and Transfer Family host keys can live in Secrets Manager.
AWS CloudTrail Security Best Practices
Comprehensive guide to securing AWS CloudTrail. Covers organization trails, KMS encryption, log integrity validation, S3 bucket hardening, CloudWatch integration, data events, Network Activity Events, Insights, SCP anti-tampering, CloudTrail Lake, and continuous audit.
AWS Secrets Manager Security Best Practices
Comprehensive guide to securing AWS Secrets Manager. Covers automatic rotation, custom Lambda rotation, KMS encryption, resource policies, VPC endpoints, multi-region replication, batch retrieval, and continuous compliance.
AWS Security Hub Best Practices
Comprehensive guide to AWS Security Hub for centralized security posture management. Covers central configuration, security standards (FSBP, CIS v5.0), automation rules, cross-region aggregation, custom insights, integrations with GuardDuty, Inspector, and Config, and operational best practices for multi-account environments.
Need Help with AWS Security?
Our AWS security experts can help you implement best practices across all these topics.
Contact Us