OpenSearch SQL Plugin versions 2.13–3.6 have a nasty security gap: the Flint extension doesn't properly validate async queries, letting users slip past the SQL grammar deny list through direct queries. If you're running affected versions, you need to update to 3.7 or 2.19.6 ASAP. AWS managed OpenSearch users get automatic fixes via service updates.
source: [aws/security-bulletin]
OpenSearch Security Analytics Plugin has a critical input validation flaw (CVE-2026-18952) that lets authenticated users perform server-side request forgery and read local files. If you're running plugin version 2.15.0 or later, you need to upgrade to 3.5.0 or newer. AWS managed domains are mostly safe since the vulnerable feature isn't enabled by default, but self-managed instances require immediate patching.
source: [aws/security-bulletin]
AWS Certificate Manager is killing email validation for public certificates by September 2027, so you'll need to migrate to DNS validation before the deadline. This move follows the CA/B Forum's industry push to ditch email-based domain validation, making DNS the standard way to prove you own your domain.
source: [aws/security-blog]
AWS SDK for C++ versions up to 1.11.861 contain two memory-safety bugs (CVE-2026-19642 and CVE-2026-19643) in the Base64 decoder that could crash your app or corrupt memory. CVE-2026-19642 causes out-of-bounds writes, while CVE-2026-19643 triggers out-of-bounds reads on certain platforms. Yes, you need to act—update your SDK immediately if you're using an affected version. Remote code execution hasn't been demonstrated, but the impact is real for any process decoding untrusted Base64 data.
source: [aws/security-bulletin]
OpenSearch Alerting Plugin has a nasty authorization flaw (CVE-2026-19311) that lets authenticated users with alerting_full_access role read, modify, or delete arbitrary index data through crafted monitor requests. Affected versions: 2.4.0–2.19.5 and 3.0.0–3.7.0 (self-managed), plus AWS OpenSearch Service domains on engines 2.4–3.5. Action required: upgrade to 2.19.6, 3.8.0, or service software R20260428-P3 immediately.
source: [aws/security-bulletin]
Amazon EKS now lets you tweak Kubernetes control plane parameters like scheduler strategies and autoscaling response times across all AWS regions. You can optimize pod placement—pack them tight with MostAllocated or spread them out with LeastAllocated—giving you real control over resource utilization and workload density.
source: [aws/whats-new]
Amazon Bedrock has extended IAM principal cost allocation to the bedrock-mantle endpoint, letting you tag and track inference expenses by users, roles, teams, and projects across all AWS regions. You can now analyze these costs in AWS Cost Explorer or CUR 2.0, making it way easier to attribute generative AI spending to the right teams.
source: [aws/whats-new]
AWS just dropped their Summer 2026 SOC 1 report, covering 185 services with a full 12-month audit period (July 2025–June 2026). If you're managing cloud infrastructure, grab this report to verify AWS's compliance controls and use it as your baseline for security governance decisions.
source: [aws/security-blog]
AWS just dropped an independent assessment report for Landing Zone Accelerator on AWS Artifact, proving it meets Germany's strict C5:2020 cloud security standards. If you're deploying infrastructure in Europe and need to tick compliance boxes without reinventing the wheel, this assessment gives you a solid foundation to build on.
source: [aws/security-blog]