AWS Security Digest·Week 25 of 2026·Jun 15-21, 2026·8 items
Summit Week: AWS Aims Security at Machine Speed
AWS unveils Continuum, a model-agnostic vulnerability lifecycle platform, and at AWS Summit New York pushes Security Agent into threat modeling and pull-request review. AWS WAF starts charging AI bots for content. On the patch side: Kiro IDE, the AgentCore Python SDK, and five containerd CVEs.
In this issue3high3medium2info
Highlights
3 items
$ tail -f /var/log/aws-security.log
high/Feature Launch/
AWS Continuum: Find, Validate, and Fix Vulnerabilities at Machine Speed
On June 17, AWS introduced Continuum, a model-agnostic vulnerability lifecycle platform using multiple frontier models, in gated preview.
Continuum chains discovery, prioritization with environment context, validation, and remediation. The validation stage runs sandboxed exploit testing to kill false positives before anyone gets paged, and remediation ships patch recommendations. Customers start in learn mode with a human in the loop and can graduate to enforce mode. The preview also includes Continuum pen testing, plus code scanning and threat modeling in preview.
This is AWS's flagship move toward autonomous find-validate-fix vulnerability management. If it works as promised, remediation SLAs will be renegotiated around it.
InspectorSecurity Hub
medium/Feature Launch/
AWS Security Agent Adds Threat Modeling and Pull-Request Review
AWS Security Agent gained STRIDE-based threat modeling of design documents and source code, in preview, announced June 17 at Summit New York.
Code review also moved into pull requests: scanning with proposed remediation, security requirements packs, simulated validation, and integrations for GitHub, GitLab, Bitbucket, and Confluence. A Kiro power was announced the same day, and the "AWS Agents for DevSecOps" Claude Code plugin followed on June 18. On-demand penetration testing is already generally available. There is a 2-month free trial.
The direction is clear: security review moves left into the PR and the IDE, with an agent proposing the fix instead of filing a report.
medium/Feature Launch/
AWS WAF Can Now Charge AI Bots for Content Access
AWS WAF Bot Control gained an AI traffic monetization capability, available since June 15: instead of blocking AI crawlers, WAF can return HTTP 402 Payment Required with JSON pricing details.
Payment settles in USDC stablecoin through Coinbase's x402 Facilitator, with per-request pricing by content path, bot category, or verification tier. Bot Control classifies over 650 distinct AI bot and agent types. The capability works on CloudFront web ACLs only, at no charge beyond standard WAF pricing.
Content owners get an economics lever over AI scraping instead of a binary block-or-allow decision.
WAFCloudFront
CVEs & Vulnerabilities
3 items
$ cat /var/reports/CVE_REPORT.txt
medium/CVE/
CVE-2026-11931: Kiro IDE Left Auth Tokens World-Readable
AWS bulletin 2026-045-AWS covers an incorrect default permissions issue in Kiro IDE on macOS and Linux.
The authentication token cache file was written world-readable (0644) instead of owner-restricted (0600), so other local users or processes could read authentication tokens. Reported by Sergio Garcia of BeyondTrust Phantom Labs.
Update to Kiro IDE 0.11.133.
Affected
Kiro IDE (macOS, Linux) < 0.11.133
Fixed In
Kiro IDE 0.11.133
Kiro
high/CVE/
CVE-2026-12530: pip Argument Injection in the Bedrock AgentCore Python SDK
AWS bulletin 2026-044-AWS covers a sanitization flaw in install_packages() in the AgentCore Code Interpreter client.
The function used an incomplete blocklist when building the pip install command, so attackers could pass --index-url to redirect package resolution to a server they control, or -r to read arbitrary files within the sandbox.
Upgrade bedrock-agentcore to 1.6.1. If you cannot, restrict calls to a fixed, hardcoded list of approved package names.
Affected
bedrock-agentcore >= 1.1.3 and < 1.6.1
Fixed In
bedrock-agentcore 1.6.1
Bedrock
high/CVE/
Five containerd CRI CVEs: Cross-Pod Code Execution, Host Command Injection, and More
AWS bulletin 2026-046-AWS relays five containerd CRI plugin vulnerabilities affecting versions 1.7 through 2.3, directly relevant to self-managed EKS and ECS nodes.
The worst: CVE-2026-50195 (CVSS 8.8), where unvalidated checkpoint image references enable image cache poisoning and cross-pod code execution on shared Kubernetes nodes, and CVE-2026-53488 (8.3), where unsanitized image labels enable arbitrary host command execution via a crafted image. The rest cover CDI annotation device injection (CVE-2026-53492), arbitrary host file read via symlinked log paths (CVE-2026-53489), and memory-exhaustion DoS (CVE-2026-47262).
Upgrade containerd to the patched releases in the upstream GitHub security advisories.
Affected
containerd CRI plugin 1.7, 2.0, 2.1, 2.2, 2.3
Fixed In
Patched releases per containerd GitHub security advisories
Spring 2026 SOC 1 and SOC 2 Reports Now Available in OSCAL Format
AWS released its Spring 2026 SOC 1 and SOC 2 reports in machine-readable OSCAL format, covering 188 services for the 12-month period from April 1, 2025 to March 31, 2026.
GRC teams can now automate attestation evidence ingestion instead of parsing PDFs.
info/Service Update/
Copy.fail Kernel Patches Available Across AWS Managed Platforms
AWS updated bulletin 2026-030-AWS on June 17 with patch availability for the Copy.fail Linux kernel privilege-escalation class across Amazon Linux, Bottlerocket, ECS, EKS, EMR, Fargate, Deep Learning AMIs, and SageMaker.
AWS still flags the issue as ongoing. Apply all available updates, and restart SageMaker notebooks to pick up the latest kernel version.
SageMakerEKSECS
Key Takeaway
1 item
$ cat WEEKLY_SUMMARY.md
This week made AWS's direction explicit: security tooling that finds, validates, and fixes on its own. Evaluate Continuum and Security Agent in learn mode, but do the boring work first: update Kiro IDE to 0.11.133, bedrock-agentcore to 1.6.1, and containerd on every node you manage.
These weekly digests are a starting point. Contact us for tailored threat briefings, security assessments, and architectural guidance for your AWS environment.
