Weekly AWS Security News
CVEs, service updates, breach analysis, and threat intelligence. Your curated weekly digest for cloud security professionals.
By Toc Consulting - AWS Security & Cloud Architecture
Six AWS Bulletins: A Neptune Flaw Rated 9.9 and a KVM Host-Memory Issue
Six new AWS security bulletins this week, led by an Amazon Neptune query-engine issue that its CVE record scores 9.9 (CRITICAL) and a Linux kernel virtio-net/TAP flaw that affects self-managed KVM hosts but not EC2, Lambda or Fargate. On the defensive side, OpenSearch Service gets per-index KMS keys, Security Hub adds resource criticality and the Cyber Risk Institute profile, Secrets Manager rotates Databricks and Twilio credentials, and Transfer Family host keys can live in Secrets Manager.
Eight AWS Bulletins, Including a Cross-Account Athena Authorization Gap
Eight new AWS security bulletins this week, led by a code injection in the deprecated Bedrock AgentCore Starter Toolkit and a now-fixed Athena engine version 3 authorization gap that could have exposed query metadata across accounts. On the defensive side, GuardDuty RDS Protection now watches database query activity for exfiltration and destruction, and IAM Identity Center can restrict where Identity Store and SCIM API calls come from.
A CVSS 10.0 in AWS Labs' Loom and a SageMaker Unified Studio Credential Exposure
Seven new AWS bulletins this week, led by a CVSS 10.0 authentication bypass in Loom, an AWS Labs agent orchestration platform, and a SageMaker Unified Studio flaw that, in projects with Trusted Identity Propagation enabled, could let a project contributor obtain another member's temporary role credentials. On the defensive side, Security Hub added remediation plans, GuardDuty can now be enforced through Organizations declarative policies, and CloudTrail now shows where data-event logging is missing.
An Amazon Connect Setup Lambda That Let Any Invoker Exceed Their IAM Permissions
A setup-only Lambda function in the Amazon Connect Salesforce integration let any principal allowed to invoke it perform AWS operations their own IAM permissions would deny. Also patched: a Kiro IDE flaw that could let a crafted repository, opened as an untrusted workspace, cause the agent to modify its auto-loaded global configuration, a code-execution bug in the pgcollection PostgreSQL extension, and a single-packet shutdown in s2n-quic. On the launch side, AWS Network Security Manager reached general availability.
AWS Pushes Back the Shield Advanced Migration Deadline as an EKS NetworkPolicy Bug Surfaces
AWS pushes back the Shield Advanced Layer-7 migration deadline, giving customers until January 29, 2027 to move off legacy automatic mitigation. Also this week: a cross-namespace NetworkPolicy bypass in Amazon EKS's Network Policy Agent, and a TLS certificate validation flaw in the AWS IoT Device SDK for Python.
Five New AWS Bulletins, Led by a Postgres MCP Server RCE
No major breach this week, but a busy one for AWS security bulletins: five new CVEs, led by a critical OS command injection in postgres-mcp-server that turns its read-only safeguard into full command execution. Also patched: a mysql-mcp-server read-only bypass, an SSM Session Manager SSRF exposing temporary IAM credentials, an XXE in the AWS Advanced JDBC Wrapper, and a denial-of-service in the AWS SDK for Go v2.
JetBrains' Cadence Breach Exposes AWS Credentials, Not Just Code
JetBrains concludes its investigation into a three-week breach of its Cadence CI/CD service, confirming attackers compromised AWS IAM users and credentials and accessed files in JetBrains-owned S3 buckets, alongside PyCharm source code and user data. Four new AWS security bulletins close the month, and AWS opens beta registration for its new AI Business Strategist certification.
One CVE, Root Privileges: SSM Agent's Path Traversal Bug
A genuinely quiet week closes with a single but serious finding: a path traversal flaw in the SSM Agent's download-content plugin can be abused to write files - with root privileges - outside the intended directory.
9,300 Leaked AWS Keys Are Still Live, Five Years Later
Truffle Security reports that more than 9,300 of 10,616 re-tested leaked AWS keys still authenticate, 768 of them with full administrator or root access, some five years after first appearing publicly. Security Hub Extended adds Supply Chain Security as its tenth category. AWS also ships seven security bulletins this week, mostly across OpenSearch Dashboards and FreeRTOS-Kernel.
Four OpenSearch and SDK Bulletins in Two Days
A quiet week for feature launches turns into a busy one for patching: AWS ships four security bulletins in 48 hours, three touching OpenSearch (authorization bypass, SSRF, and a SQL grammar bypass) and one an out-of-bounds Base64 decoder bug in the AWS SDK for C++.
AgentCore Gets Long-Lived Runtimes, and a Temporal Policy Language
Bedrock AgentCore Runtime Instances reach general availability, letting agents run on dedicated EC2 instances for up to 14 days instead of the 8-hour microVM limit. AWS open-sources Dogwood, a Cedar-compatible policy language with temporal logic for governing sequences of agent tool calls. A path traversal bug in the AWS Transform MCP Server gets patched.
AWS Names North Korea in the npm Supply Chain Attacks
AWS attributes the debug, chalk, and axios npm compromises to North Korea's SAPPHIRE SLEET group, with Wiz data showing roughly 1 in 10 cloud environments hit within a two-hour window. Shield Advanced begins migrating to the WAF Anti-DDoS managed rule group as its default Layer 7 protection. Four new AWS security bulletins land, including an unauthenticated DoS in aws-smithy-json.
A GuardDuty Investigator on Demand, and Agentic Tooling Patches Again
GuardDuty gets an on-demand investigation agent in public preview, Secrets Manager starts publishing secret-change events to EventBridge, and CloudTrail learns to filter network activity logging by identity. Five more bulletins close out July, including a TLS 1.3 record-drop flaw in s2n-tls and a third AgentCore SDK patch this summer.
GuardDuty AI Protection Arrives, and the Bulletins Pile Up
GuardDuty extends threat detection to Bedrock and SageMaker workloads, Security Hub goes multicloud with Azure support and an AI asset inventory, and Cognito removes the last big migration blocker by importing password hashes. Seven AWS bulletins land in four days, including a prompt-and-response leak in AgentCore telemetry.
72 Hours to Full Compromise: AI Joins the Attackers
Sygnia documents a lone actor compromising a global enterprise's AWS estate in under 72 hours with AI-assisted workflows. Wiz finds the same symlink trust flaw in six AI coding assistants. On defense: Security Hub gains internet-facing network scanning and AWS Config adds 191 managed rules.
WAF's HTTP/2 Blind Spot, and CitrixBleed Rides Again
AWS discloses an HTTP/2 body-inspection bypass in WAF rated CVSS 9.8, and a new CitrixBleed-class NetScaler flaw is exploited within 24 hours of its patch. On the launch side: ACM speaks ACME, GuardDuty watches sensitive file modifications, and WAF extends to AgentCore Gateway. Three more toolchain bulletins land on July 1.
GuardDuty Learns to Investigate, Sign-In Learns to Say No
GuardDuty previews AI-powered investigations, and AWS Sign-In gains resource-based policies plus RCPs that lock console access to expected networks. Researchers deliver a triple hit: Unit 42's universal bucket hijacking, a targeted AWS-console phishing kit that handles MFA, and Wiz's disclosure of an Amazon Q Developer flaw that leaked AWS credentials on repo open.
Summit Week: AWS Aims Security at Machine Speed
AWS unveils Continuum, a model-agnostic vulnerability lifecycle platform, and at AWS Summit New York pushes Security Agent into threat modeling and pull-request review. AWS WAF starts charging AI bots for content. On the patch side: Kiro IDE, the AgentCore Python SDK, and five containerd CVEs.
A Toolchain CVE Storm Meets a SaaS Token Heist
Four AWS bulletins land in a single week, all in the build and agent toolchain: AgentCore CLI code injection, CDK command injection, s2n-quic memory exhaustion, and a heap double-free in the HTTP client under the C++ and Java SDKs. Meanwhile the Klue breach shows again what stolen OAuth integration tokens are worth.
OpenAI Models Land in Bedrock, Cognito Goes Multi-Region
OpenAI GPT-5.5, GPT-5.4, and Codex reach general availability on Amazon Bedrock under the same governance controls as the rest of AWS. Amazon Cognito adds near-real-time multi-Region replication of identities and credentials, Bedrock AgentCore Identity integrates Secrets Manager, and two new CVEs hit Kiro IDE and Graph Explorer.
Network Firewall Filters the Web by Category
AWS Network Firewall can now allow or block traffic by website category, including generative-AI services, with the matches visible in CloudWatch Logs Insights. AWS also published Well-Architected guidance for defending the software supply chain against attacks like Shai-Hulud, and a path to move centralized firewall inspection onto Transit Gateway attachments.
Security Hub Hunts Down Unused Access
Security Hub learns to find identity risk that no one is using: unused IAM permissions, roles, and credentials, measured against 90 days of real activity. The Extended plan grows to 21 partners across 9 categories. Secrets Manager Agent picks up pre-fetching and cross-account role assumption, and Amazon Inspector Classic reaches end of support.
DirtyFrag Hits Half of AWS
AWS publishes bulletin 2026-030-AWS, a single rolling document for the Copy.fail / DirtyFrag Linux kernel privilege-escalation class. If you run Amazon Linux, Bottlerocket, ECS, EKS, EMR, Fargate, or SageMaker, this is the bulletin you bookmark. Security Agent meanwhile learns to read whole repositories.
The DirtyFrag Bulletin Begins
AWS opens what will become the defining CVE story of May: a Linux kernel privilege escalation tracked across half a dozen services. JDBC Wrapper ships column-level client-side encryption via KMS. AgentCore previews agent-to-agent payments via Coinbase and Stripe. AWS MCP Server reaches GA. WorkSpaces for AI Agents enters preview.
Five FreeRTOS CVEs, One ECS RCE, One WorkSpaces LPE
Heavy patch week if you ship IoT on FreeRTOS or run Windows containers: five FreeRTOS CVEs across three bulletins, an ECS Agent command injection to SYSTEM, a WorkSpaces local-privilege escalation. AWS CIRT publishes the March 2026 attacker-technique catalog with three notable new entries. Audit Manager officially closes to new customers. The What's Next with AWS 2026 event lands with the OpenAI partnership.
AWS Picks a Fight with Quantum Decryption
Secrets Manager rolls out hybrid post-quantum TLS using ML-KEM, baked into the agent, the Lambda extension, and the CSI driver. Three CVE bulletins land in the same week (QnABot, Ops Wheel, tough/tuftool). AWS finally gives the IAM Service Authorization Reference the deep-dive treatment.
Vercel Got Pwned Through a Calendar App
A Vercel employee had OAuth-trusted Context.ai with their corporate Google account. Lumma Stealer hit Context.ai. The attacker walked from Google Workspace into Vercel and read non-sensitive environment variables. Also this week: Vect ransomware lists Trivy/LiteLLM victims, AWS patches EFS CSI and Encryption SDK for Python.
Axios CVE Looks Bad on Paper, Works Mostly Nowhere
A CVSS 9.9 in Axios chains prototype pollution into IMDSv2 credential theft. Node.js already blocks the technique at the runtime layer, so production Node apps are mostly safe. Browser apps and other runtimes are not. AWS also ships Project Glasswing with Anthropic and patches a Firecracker virtio-pci out-of-bounds write.
Two AWS Agents Reach GA the Same Day
Security Agent and DevOps Agent both ship to general availability after their re:Invent 2025 preview. S3 finally rolls out the SSE-C default-off across 37 Regions, the kill announced back in January. Audit Manager stops onboarding new customers as of April 30.
The European Commission Lost Its AWS Account
Over 350 GB stolen from the European Commission's AWS environment, confirmed publicly March 27. AWS clarifies its services were not breached, this is shared-responsibility 101 played out at the highest level of EU government. LiteLLM packages get backdoored to steal IMDS credentials. RSAC 2026 happens in San Francisco.
Four CVEs, One Cisco Zero-Day, One Trivy Compromise
AWS issues four security bulletins in a single week, signaling fresh scrutiny on developer tooling and cryptographic libraries. Trivy CI/CD pipelines get backdoored by TeamPCP. Amazon publishes 36-day-old honeypot intel on Interlock ransomware exploiting Cisco Firewall Management Center.
Security Hub Goes Multicloud, Sovereign Cloud Gets SOC 2
Security Hub Extended officially expands to AWS, Azure, GCP, OCI, and Kubernetes, the long-anticipated cross-cloud play. European Sovereign Cloud completes SOC 2 Type 2 and BSI C5 audits. IAM Roles Anywhere ships post-quantum signing via ML-DSA. Inspector Classic gets a May 2026 EOL date.
AgentCore Picks Up Cedar Policies
Bedrock AgentCore Policy hits GA, mixing LLM authorship with Cedar policy-as-code, the first AWS service to do that at scale. IAM gets a simplified role-creation flow with inline panels. AWS adds DESC 2026 certification for the UAE.
The Heaviest Security Week of Q1
Security Hub Extended Plan reaches GA with 14+ partners on day one, the launch most enterprises have been waiting for. LexisNexis loses 2 GB via a misconfigured AWS environment. Three AWS-LC crypto library CVEs land in one drop. VPC Encryption Controls move from preview to paid.
600 FortiGate Boxes Compromised, 55 Countries
Amazon publishes the full picture of the AI-augmented FortiGate campaign tracked since Week 5: 600+ devices compromised across 55 countries, with LLM-generated tooling automating reconnaissance through lateral movement. AWS development tools get the agent-plugin treatment. Kiro IDE expands to GovCloud.
Aurora Now Encrypts by Default
New Aurora clusters get encryption at rest with zero opt-in, closing a gap that has caused too many "we forgot to enable encryption" audit findings. AWS Backup adds PrivateLink for SAP HANA workloads. Elastic Beanstalk patches a Windows Server vulnerability.
Security Groups Finally Tell You What Uses Them
Security Groups finally show a "Related Resources" tab listing every dependent resource, a quality-of-life win years overdue. Security Agent now scopes shared VPCs. Claude Opus 4.6 lands in Amazon Bedrock.
The FortiGate Campaign Starts Buzzing
Amazon Threat Intelligence begins tracking an AI-augmented campaign compromising FortiGate enterprise firewalls at scale. STS OIDC federation enhancements ship. SageMaker quietly tightens its public endpoint defaults.
Security Agent Reads Your GitHub
Security Agent extends preview support to GitHub Enterprise Cloud, so your code, IaC, and supply chain now sit on the same scanning surface. Network Firewall picks up GenAI traffic classification. S3 lets you change a bucket's encryption type without re-uploading objects.
The European Sovereign Cloud Goes Live
AWS European Sovereign Cloud goes live in Brandenburg, run by EU residents under German law, physically and logically isolated from other Regions. The Sovereign Reference Framework establishes how it is governed.
Kiro IDE Ships RCE in Its Welcome Mat
A CVSS 8.4 command injection in AWS's new Kiro IDE lets a crafted project execute code the moment you open it. Client VPN gets simplified onboarding. AWS is named ISG Leader for Sovereign Cloud for the third year running.
S3 SSE-C Encryption Gets the Boot
AWS announces SSE-C will be disabled by default on new general-purpose S3 buckets starting April 2026, closing the Codefinger ransomware vector. Security Hub and Security Agent updates from re:Invent 2025 keep rolling out.
Stay Ahead of AWS Security Changes
We publish a new digest every week covering the most impactful AWS security announcements, CVEs, and threat intelligence. Bookmark this page or contact us for custom briefings.
Get in Touch