Bartek Chojnacki

AWS SAM CLI versions 1.63.0 through 1.166.1 have a nasty OS command injection flaw in the Terraform hook that could let attackers execute arbitrary commands during builds. The vulnerability lurks in how the tool handles Terraform resource addresses without properly escaping shell metacharacters. If you're using sam build --hook-name terraform, you need to update immediately—especially if untrusted folks can modify your Terraform configs. This is a serious one that demands your attention.

Amazon Athena engine version 3 has a nasty authorization bug (CVE-2026-115416) that could let authenticated users peek at AWS account IDs and SQL query metadata from other accounts. The good news? Your actual query results and S3 data stay safe. If you're running Athena engine v3, check AWS's security bulletin for patches—action required here.

aws-c-mqtt versions 0.9.1 through 0.16.2 contain a memory allocation flaw (CVE-2026-115417) in the MQTT 3.1.1 adapter that could let remote attackers trigger denial of service. If you're using AWS IoT Device SDK for C++ v2 or AWS Common Runtime with affected versions, you need to upgrade immediately to patch this vulnerability.

Amazon SageMaker Python SDK has a critical flaw (CVE-2026-112408) in the default_bucket() function that skips ownership verification. An attacker could pre-create the predictably named S3 bucket and gain code execution plus IAM credentials in your SageMaker environment. Update immediately: SDK V2 to 2.257.3+ or V3 to 3.10.0+. User action required.

Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP web runtimes let attackers execute code remotely without authentication. If you're running PHP 8.2–8.5 or legacy versions 5.4–8.1, you need to upgrade immediately to patched releases (8.5.12, 8.4.27, 8.3.36, or 8.2.35)—config tweaks won't cut it. AWS is actively rolling out mitigations across affected services, but don't wait.

AWS Transform just got smarter—it can now analyze your on-premises storage (NAS, SAN, direct-attached disks) and automatically recommend the best AWS destination: S3, EBS, EFS, or FSx. Upload your inventory, run what-if scenarios to compare Single-AZ vs. Multi-AZ or cost vs. performance trade-offs, and get a total cost of ownership business case without the manual grunt work.

AWS CICD-toolchain-for-serverless-applications versions 1.0.7–1.0.10 have a critical privilege escalation flaw (CVE-2026-112407). Authenticated users with repository push access can exploit incorrect IAM policies to access resources beyond their application stack. Update to version 1.0.11 or later immediately—this one requires your action.

Amazon ECS Gateway is here to save you from networking headaches—this new managed ingress solution automatically handles all the infrastructure setup for your containerized workloads, right in your own AWS account. DevOps teams and container enthusiasts can now focus on what matters instead of wrestling with load balancers and routing configs.

Amazon Bedrock has rolled out structured outputs for all Anthropic Claude models, letting you get schema-compliant JSON responses without messy parsing or retry logic. This capability works across both bedrock-runtime and bedrock-mantle endpoints, making it super handy for automating tasks like extracting financial data, parsing clinical notes into EHRs, or routing support tickets with consistent, validated results.