Bartek Chojnacki

AWS GluonTS versions before 0.17.0 have a critical vulnerability (CVE-2026-100308) that lets attackers execute arbitrary commands when deserializing untrusted model files. If you're using GluonTS and loading models from untrusted sources via Predictor.deserialize() or RepresentablePredictor.deserialize(), you need to upgrade immediately. This is a serious one—attackers could run OS commands with your process privileges. Update to version 0.17.0 or later ASAP.

AWS and OpenAI have jointly built Bedrock Managed Agents (BMA), now available in preview across three US regions (N. Virginia, Oregon, Ohio). You can now deploy OpenAI-powered agents natively in AWS with full IAM governance, durable sessions, tool integration via MCP servers, and human approval workflows—no extra charges during preview.

AWS is phasing out multiple services with different timelines—some moving to maintenance mode (no new customers after October 2026), while others like Amazon Managed Blockchain and DevOps Guru are heading toward full sunset by September 2027. If you're using Amazon Mechanical Turk, Amazon Managed Blockchain, Amazon DevOps Guru, AWS Backint Agent for SAP ASE, or AWS Infrastructure Composer, AWS has published migration guides and support resources to help you transition smoothly.

AWS dropped multiple frontier models on Amazon Bedrock this week, including OpenAI's GPT-6 Sol and Luna plus Anthropic's Claude Opus 5.5, giving you serious flexibility to pick the right model for your use case, budget, and latency needs. The real win here is choice—you're no longer locked into one option, so you can optimize for what actually matters for your workload.

Amazon DocumentDB now supports five new MongoDB aggregation stages ($setWindowFields, $bucketAuto, $facet, $graphLookup, and correlated $lookup) plus enhanced change streams with large event splitting in version 8.0.2, rolling out across all regions. You also get retryable writes for better resilience and query performance boosts including index-only scans—making it smoother to migrate your MongoDB workloads without touching your app code.

AWS is running a live drill on October 24, 2026, to prove their European Sovereign Cloud can operate completely independently from the global AWS network backbone—no EU border crossings needed. If you're deploying sensitive workloads in Europe, this shows you can actually achieve true data residency without hidden dependencies on external infrastructure.

AWS IAM outbound identity federation now supports VPC endpoints for OIDC discovery, meaning you can fetch verification keys and metadata without exposing traffic to the public internet. This is perfect if your workloads live in locked-down VPCs and need to verify short-lived JWTs from external services while keeping everything within AWS's private network.

Amazon Transcribe now lets you encrypt custom vocabularies, vocabulary filters, and language models with your own AWS KMS keys instead of AWS-managed ones. You get full control over permissions, audit trails via CloudTrail, and the ability to revoke access whenever you want—available across all AWS regions where Transcribe operates.

AWS Elastic Disaster Recovery now supports arm64-based Graviton servers, automatically detecting and recovering them onto Graviton instances without extra configuration. This capability rolls out across all AWS Regions where DRS is available at no additional cost, giving your price-performance workloads the same disaster recovery coverage as x86 environments.