Bartek Chojnacki

Powertools for AWS Lambda (Python) versions 3.6.0 through 3.34.0 contain CVE-2026-104002, a fail-open error in the data masking utility that could expose sensitive fields meant to be masked. This is a serious issue requiring immediate action—update to the patched version as soon as possible. If you're running affected versions, prioritize this security patch to prevent potential data exposure in your serverless applications.

AWS security-agent-mcp-server (versions 0.1.1–0.2.0) has a critical argument injection flaw in its diff scan feature. An attacker can craft malicious reference values to execute arbitrary file operations outside the workspace, bypassing security controls. If you're using affected versions, update immediately to patch this vulnerability.

Amazon Ion Python versions before 0.15.0 have a nasty recursion bug (CVE-2026-104020) that lets attackers crash your app with deeply nested Ion values. This denial-of-service vulnerability is marked Important, so you'll want to upgrade ASAP if you're using this library. Patch to version 0.15.0 or later to stay safe.

Amazon Aurora serverless now jumps up to 16 ACUs per second (scaling to 256 ACUs total) instead of smaller increments, making it perfect for bursty agentic AI applications. The upgrade is automatic on platform versions 3 and 4, with no config needed—just pay for what you actually use.

Aurora PostgreSQL now lets you query Apache Iceberg and Parquet files stored in S3 or AWS Glue Data Catalog without ETL pipelines or data duplication—your existing PostgreSQL apps and BI tools work unchanged. The feature uses DuckDB's query engine under the hood and is available in all AWS regions (including GovCloud) on PostgreSQL 17.11, 18.6 and higher at no extra cost.

Amazon Aurora and RDS now support R8a instances powered by 5th generation AMD EPYC processors, giving you up to 75 Gbps network bandwidth and 60 Gbps EBS bandwidth for demanding database workloads. These instances are rolling out across major regions including US, Canada, Asia Pacific, and Europe, supporting PostgreSQL, MySQL, and MariaDB engines.

AWS GluonTS versions before 0.17.0 have a critical vulnerability (CVE-2026-100308) that lets attackers execute arbitrary commands when deserializing untrusted model files. If you're using GluonTS and loading models from untrusted sources via Predictor.deserialize() or RepresentablePredictor.deserialize(), you need to upgrade immediately. This is a serious one—attackers could run OS commands with your process privileges. Update to version 0.17.0 or later ASAP.

AWS and OpenAI have jointly built Bedrock Managed Agents (BMA), now available in preview across three US regions (N. Virginia, Oregon, Ohio). You can now deploy OpenAI-powered agents natively in AWS with full IAM governance, durable sessions, tool integration via MCP servers, and human approval workflows—no extra charges during preview.

AWS is phasing out multiple services with different timelines—some moving to maintenance mode (no new customers after October 2026), while others like Amazon Managed Blockchain and DevOps Guru are heading toward full sunset by September 2027. If you're using Amazon Mechanical Turk, Amazon Managed Blockchain, Amazon DevOps Guru, AWS Backint Agent for SAP ASE, or AWS Infrastructure Composer, AWS has published migration guides and support resources to help you transition smoothly.