AWS Security Digest·Week 28 of 2026·Jul 6-12, 2026·7 items
72 Hours to Full Compromise: AI Joins the Attackers
Sygnia documents a lone actor compromising a global enterprise's AWS estate in under 72 hours with AI-assisted workflows. Wiz finds the same symlink trust flaw in six AI coding assistants. On defense: Security Hub gains internet-facing network scanning and AWS Config adds 191 managed rules.
In this issue1critical3high2medium1info
Highlights
3 items
$ tail -f /var/log/aws-security.log
critical/Threat Intel/
Sygnia: Lone Actor Compromises a Global AWS Estate in About 72 Hours
Sygnia disclosed on July 8 an investigation into a financially motivated attack in which a single threat actor went from initial access to broad compromise of a global enterprise's AWS environment in under 72 hours.
Entry was an exposed AWS access key in a vulnerable internet-facing application. From there the actor pivoted across AWS resources, GitHub and Bitbucket repositories, CI/CD pipelines, runtime services, and data stores. Confirmed observations include attacker scripts with characteristics consistent with AI generation, several hundred unique SQL queries across dozens of databases, and, in one observed second, use of four different access keys belonging to four separate accounts. The agentic-AI conclusion is Sygnia's assessment, not direct proof.
Instead of encrypting, the actor demonstrated control through reversible disruption: disabling S3 access, scaling ECS services to zero, blocking network ACLs, and purging message queues to pressure extortion negotiations.
IAMS3ECSRDS
high/Feature Launch/
Security Hub Adds Network Scanning: Verified Reachability, Not Config Guesswork
AWS Security Hub now offers Network Scanning, announced July 8: active probing from the internet to determine actual reachability of public IPs, virtual machines, and load balancers across AWS and Azure environments.
Each reachable port generates a finding, correlated through Security Hub Exposures. Included with Security Hub Essentials at no additional cost, on by default for new customers and opt-in for existing ones.
Verified-reachability data eliminates the false positives of configuration-only exposure analysis and catches multicloud perimeter drift.
Security Hub
high/Threat Intel/
Wiz "GhostApproval": Symlink Trust Flaw Found in Six AI Coding Assistants
Wiz published research on July 8 showing variants of the same trust-boundary flaw in six AI coding assistants: Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. Symlinks trick the assistant into reading or writing files outside the workspace, up to remote code execution in the worst cases.
Amazon Q's variant (CVE-2026-12958, rated High) was a pre-authorization write: the AWS Language Server modified files before the user could approve, and in Wiz's testing the agent identified the symlink in its reasoning but wrote anyway. AWS remediated in Language Server 1.69.0, which auto-updates. Cursor's variant was Critical (CVE-2026-50549, fixed in v3.0); Augment and Windsurf had acknowledged the reports but had not provided fix updates at publication.
Agentic developer tooling on AWS-credentialed workstations is now a recurring attack surface. Treat assistant updates like security patches, because they are.
IAM
CVEs & Vulnerabilities
2 items
$ cat /var/reports/CVE_REPORT.txt
medium/CVE/
CVE-2026-14471: SQL Injection in mcp-gateway-registry
AWS bulletin 2026-052-AWS covers an authenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-registry.
A user can supply a crafted table_name value to execute arbitrary SQL against the metrics database, potentially reading API keys and modifying stored data.
Update to 1.0.13.
Affected
mcp-gateway-registry 1.0.3 - 1.0.12
Fixed In
mcp-gateway-registry 1.0.13
high/CVE/
CVE-2026-14904: Symlink Flaw in Research and Engineering Studio Exposed Other Users' SSH Keys
AWS bulletin 2026-053-AWS covers an improper link resolution issue in the Auth.GetUserPrivateKey API of AWS Research and Engineering Studio.
An authenticated user could replace their ~/.ssh/id_rsa with a symlink to any file on the cluster-manager EC2 instance. Because cluster-manager runs as root, this exposed other users' SSH private keys and application configuration secrets. Amazon assigns it CVSS 4.0 7.1.
Upgrade to RES 2026.06; patch scripts for the three most recent major versions are on the RES GitHub wiki.
AWS Config Adds 191 Managed Rules, Heavy on AI Services
AWS Config added 191 managed rules on July 9, spanning Bedrock, SageMaker, ECS, EKS, RDS, Redshift, S3, CloudTrail, and more than 30 other services.
The rules evaluate encryption, logging, public access prevention, network security, and data protection configurations. Compliance teams can now codify Bedrock and SageMaker guardrails without writing custom Lambda rules.
ConfigBedrockSageMaker
info/Compliance/
AWS Designated a Critical Third Party to the UK Financial Sector
AWS announced on July 10 its designation as a critical third party to the UK financial sector, bringing it under the direct oversight regime UK regulators created for providers whose failure could threaten financial stability.
UK financial institutions should expect this designation to surface in supervisory conversations about cloud concentration risk.
Key Takeaway
1 item
$ cat WEEKLY_SUMMARY.md
The Sygnia case is the week's real lesson: one exposed access key plus AI-compressed tempo equals a full estate compromise before your weekly triage meeting even convenes. Kill long-lived access keys, alert on impossible credential use across accounts, and turn on Security Hub Network Scanning so you see your perimeter the way attackers do.
These weekly digests are a starting point. Contact us for tailored threat briefings, security assessments, and architectural guidance for your AWS environment.
