Bartek Chojnacki

AWS mcp-gateway-registry versions 1.0.3 through 1.0.12 have a nasty authenticated SQL injection vulnerability (CVE-2026-14471) in the metrics-service retention policy subsystem. An authenticated attacker can craft malicious table_name values to execute arbitrary SQL queries, potentially exposing API keys and modifying database contents. Action required: upgrade to a patched version immediately if you're running affected versions.

Amazon EC2 Instance Store and EBS now offer detailed performance statistics for Windows instances, letting you monitor latency, throughput, and IOPS in real-time. Spot bottlenecks faster and optimize your storage setup without the guesswork.

AWS rolled out Claude Sonnet 5 and Amazon WorkSpaces for AI agents, giving developers and startups fresh tools to build intelligent applications. The roundup covers these flagship releases plus service availability updates that matter for your infrastructure planning.

AWS CloudFormation's new express mode lets you deploy cloud infrastructure faster by streamlining the provisioning process, whether you're using JSON, YAML templates, CDK, or SAM. This means less waiting around and more time actually building stuff—perfect if you're juggling multiple stacks or running deployments through CI/CD pipelines.

AWS CLI versions 1.44.77 and earlier (v1) or 2.34.28 and earlier (v2) have a nasty security flaw on Unix-like systems. The tool was writing credential and config files with world-readable permissions, letting other local users snag your AWS credentials. If you're running an affected version, you need to update immediately—this one requires action.

AWS CDK (aws-cdk-lib) versions before 2.260.0 have a nasty OS command injection flaw in NodejsFunction Docker bundling. If someone controls your package.json dependency versions, they can execute arbitrary commands on your build machine through shell metacharacters. Action required: upgrade to 2.260.0+ if you use Docker-based bundling with nodeModules.

AWS Advanced JDBC Wrapper versions 3.3.0 through 4.0.0 have a nasty deserialization flaw (CVE-2026-14265) in RemoteQueryCachePlugin. If you've got this plugin enabled, an attacker with cache write access can inject malicious Java objects that execute arbitrary code on your app server. Update immediately if you're running affected versions—this one requires action.