AWS jsii-diff, a CLI tool for comparing API differences between jsii assemblies, has a critical OS command injection flaw (CVE-2026-15895). Attackers can execute arbitrary shell commands through specially crafted command-line arguments. If you're running jsii-diff versions below 1.131.0, update immediately—this one's not optional, folks.
source: [aws/security-bulletin]
AWS flagged CVE-2026-15737 in bedrock-agentcore versions 1.4.8 and 1.5.0—unfiltered user prompts and agent responses get logged to CloudWatch, exposing them to anyone with read access. **Action required**: upgrade immediately if you're running affected versions. Local authenticated users could snoop on your sensitive AI interactions through OpenTelemetry span attributes.
source: [aws/security-bulletin]
Ready to simplify your search infrastructure? This guide walks you through migrating from Apache Solr to Amazon OpenSearch Serverless, highlighting the operational ease and built-in AI capabilities that'll make your data pipeline way less painful.
source: [aws/big-data-blog]
Strands Agents' elasticsearch_memory tool (versions < 0.7.0) has a nasty SSRF vulnerability that can leak your Elasticsearch API keys. The LLM can control connection parameters and trick the tool into sending credentials to attacker-controlled servers. If you're running affected versions, update immediately—this one requires action.
source: [aws/security-bulletin]
AWS dropped their monthly security roundup covering IAM best practices, threat intel, network hardening, and AI-powered security tools—basically everything you need to keep your cloud infrastructure locked down. Grab the code samples and workshop materials to level up your multi-account security posture without reinventing the wheel.
source: [aws/security-blog]
Amazon EMR now leverages Apache Celeborn to optimize remote shuffle operations across EKS and EC2 deployments, delivering better job reliability without breaking the bank. This deep dive shows how the service pipeline handles data shuffling more efficiently, giving you the performance gains and cost savings you've been waiting for.
source: [aws/big-data-blog]
AWS Load Balancer Controller versions 3.4.1+ have a rule priority ordering bug that lets namespace-scoped users intercept traffic across namespaces. When HTTPRoute and GRPCRoute share an ALB HTTPS listener with the same hostname, the controller prioritizes HTTPRoute rules first regardless of specificity—allowing attackers to create catch-all HTTPRoutes that hijack traffic meant for more-specific GRPCRoutes. If you're running affected versions with shared Gateways, you need to upgrade immediately to patch this.
source: [aws/security-bulletin]
AWS HealthLake MCP Server versions before 0.0.14 have a critical SSRF flaw (CVE-2026-15643) in pagination handling. Attackers can exploit unvalidated next_token parameters to redirect requests and steal AWS credentials. **Action required**: upgrade to version 0.0.14 or later immediately if you're running this service.
source: [aws/security-bulletin]
Security Hub now covers AI workloads and Microsoft Azure environments, giving cloud engineers a unified platform to manage security across multiple clouds without juggling separate tools. The update lets your team focus on actual threats instead of wasting time integrating disparate security solutions.
source: [aws/security-blog]