s2n-tls (AWS's open-source TLS/SSL library) has two security issues requiring immediate attention. CVE-2026-16317 lets attackers silently drop TLS 1.3 encrypted records without detection due to missing content_type validation. CVE-2026-16318 causes memory leaks in QUIC-enabled deployments during HelloRetryRequest handshakes. Update to v1.7.6 or later—all TLS 1.3 users are affected by the first flaw.
source: [aws/security-bulletin]
AWS smithy-rs has a nasty recursion vulnerability (CVE-2026-15957) in its JSON, CBOR, and XML deserializers that lets attackers crash your service with deeply nested payloads. If you're running aws-sdk-rust versions before release-2026-06-0, you need to patch immediately – this is a remote DoS that requires zero authentication. The fix is straightforward: upgrade your crates and you're golden.
source: [aws/security-bulletin]
AWS WAF now lets you squeeze more power from labels using dynamic label interpolation—think of it as conditional logic for your security rules. Learn how to combine metadata from Bot Control and ATP to build smarter, more granular traffic policies without drowning in complexity.
source: [aws/security-blog]
AWS rolled out a one-click Lambda setup prompt and made OpenAI's GPT-5.6 models available on Bedrock, making serverless development and AI integration smoother for developers. The team also connected with AWSKRUG, Korea's largest cloud community, to gather feedback on what developers actually need.
source: [aws/aws-blog]
AWS just dropped an AI-powered investigation agent for GuardDuty that automatically analyzes security findings across your environment—think of it as having a tireless security analyst on your team. As a cloud engineer, you should integrate this into your threat response workflow to slash investigation time and focus on actual remediation instead of manual log digging.
source: [aws/security-blog]
Learn how to govern Amazon Redshift data warehouses across AWS accounts using Amazon SageMaker Unified Studio with data mesh principles. This guide walks you through building a scalable architecture that keeps your data sharing secure, auditable, and operationally lean.
source: [aws/big-data-blog]
AWS HealthOmics MCP Server versions 0.0.35 and earlier have a path traversal flaw (CVE-2026-15415) in workflow linters that could let attackers write files outside intended directories. If you're running aws-healthomics-mcp-server, upgrade to version 0.0.36 or later immediately. This affects the workflow_files input processing, so action is required if you use this service.
source: [aws/security-bulletin]
AWS Athena's Synapse connector has a critical flaw (CVE-2026-12283) where specially crafted table names can leak unintended data when queried. If you're running versions v2022.20.1 through v2026.19.1, you need to update immediately—this affects anyone using Athena Query Federation with Azure Synapse. The vulnerability requires attacker access to your Synapse account, but the impact is serious enough that AWS flagged it as Important.
source: [aws/security-bulletin]
AWS is ditching the 75 GB code storage limit by letting you deploy Lambda functions directly from your own S3 buckets. This means better control over your deployment artifacts and fewer headaches explaining security policies to your team.
source: [aws/compute-blog]