Bartek Chojnacki

aws-smithy-json has a nasty uncontrolled recursion bug in its unknown-key skip path that lets unauthenticated attackers crash smithy-rs generated servers with a denial of service attack. This affects all servers built with the vulnerable library. You should patch immediately—no user interaction needed to trigger the exploit. Check AWS Security Bulletin for detailed mitigation steps and patched versions.

OpenSearch Dashboards TSVB Plugin has a nasty remote code execution flaw (CVE-2026-18420) via prototype pollution. This is a serious one—you'll want to patch ASAP if you're running this. Check AWS Security Bulletin 2026-068 for the full details and fix.

Strands Agents http_request tool has a critical authorization flaw affecting versions below 0.8.2. An attacker can inject prompts to redirect requests through a malicious proxy, exposing credentials in cleartext despite hostname allowlists. Update immediately to 0.8.2 or later—this requires your action.

Great news for developers! Amazon Bedrock is cutting prices for OpenAI's GPT-5.6 models starting July 30, 2026. GPT-5.6 Luna gets an 80% discount, perfect for high-volume content processing and automation, while GPT-5.6 Terra drops 20% for balanced production workloads. Best part: pricing updates automatically with zero effort needed.

Amazon MSK Express brokers can now deliver Apache Kafka data straight to S3 buckets with zero manual connector management. This fully managed feature automatically scales to 10 GB/s throughput, handles retries and backpressure on its own, and cuts costs by up to 60% compared to self-managed solutions. Perfect for log archival, compliance, and ML training pipelines.

AWS has upgraded IAM Policy Simulator with a major refresh—it's now built right into the IAM console instead of running separately. The tool can now test service control policies (SCPs) and lets you simulate "what if" scenarios by excluding specific policies. You'll get better insights into cross-account permissions and how conditions like regions and tags affect access decisions.

Amazon Threat Intelligence uncovered a DPRK-linked threat actor compromising popular Node Package Manager libraries used globally. Cloud engineers should audit their npm dependencies immediately and implement strict supply chain verification to block malicious package installations.

AWS now lets you use Instance Refresh directly in CloudFormation templates. When you update properties requiring instance replacement, CloudFormation automatically handles the refresh with zero-downtime deployments. You get features like launch-before-terminate, alarm monitoring, and controlled rollouts—all while keeping your scaling policies and health checks active.

Amazon Redshift Data API now features long polling to cut API calls, session management for tracking active queries, and flexible batch execution with AUTO_COMMIT mode. Each SQL statement in a batch runs independently, so one failure won't roll back everything—perfect for ETL pipelines. You can also reuse parameters across statements, making queries cleaner and more efficient.