Bartek Chojnacki

AWS FPGA Development Kit versions before 2.3.4 have a nasty privilege escalation bug (CVE-2026-85028). Local attackers can drop malicious code in a world-writable temp directory and gain root access when the installer runs. If you're using aws-fpga, update to 2.3.4 or later immediately—this one requires action.

Amazon CodeCatalyst blueprints SDK versions before 0.3.156 contain a command injection vulnerability (CVE-2026-85012) in the resynthesis framework. An attacker with repository commit access could inject shell metacharacters into the .ownership-file to execute arbitrary commands. Good news: no user action needed—AWS applies server-side validation that blocks this attack on the service side, even for older blueprint versions.

Amazon EC2 M9g and M9gd instances, built on the new AWS Graviton5 processors, just landed in Ireland, Singapore, Sydney, and Tokyo. These beasts deliver up to 25% better performance than Graviton4 predecessors and feature the Nitro Isolation Engine with mathematically proven security—perfect for memory-intensive workloads like databases and analytics.

Amazon Ion-C before version 1.1.6 has a nasty uncontrolled recursion bug (CVE-2026-84851) that lets attackers crash your app with specially crafted Ion data. If you're using ion-c in your stack, you need to update immediately—this is a denial-of-service vulnerability affecting all versions below 1.1.6. Remote attackers can exploit this without authentication, so don't sleep on this one.

AWS just dropped updated guidance on migrating your identity source to IAM Identity Center, including solid strategies for moving from Active Directory and automating permission sets. If you're managing user access across multiple AWS accounts, this post walks you through the practical steps to avoid the usual migration headaches.

AWS Lambda just expanded SnapStart support to container image functions, slashing startup times from seconds down to sub-second latency—perfect for ML inference and interactive APIs. The feature is now available across all commercial AWS regions except New Zealand and Taipei, letting you optimize performance without extra provisioning or complex tweaks.

Amazon SageMaker Python SDK has a serious security flaw where HMAC signing keys are stored in cleartext in pipeline definitions. Attackers with account access can extract these keys via DescribePipeline API and execute arbitrary code in other users' pipelines. Update immediately: SDK v3 to v3.11.0+ or v2 to v2.256.0+. Action required for all users running affected versions.

Anthropic's Claude Fable 5.1 is now generally available on AWS through Amazon Bedrock and Claude Platform, bringing frontier-level AI to your coding, research, and enterprise workflows. This beast handles multi-hour sessions across entire codebases, admits when it's stuck instead of faking success, and won't ghost you with confident wrong answers—plus Enterprise Frontier Safeguards let you keep your data in your own cloud.

Amazon Quick is now generally available, letting you create custom business applications just by describing what you need in plain English—no coding required. The tool connects to your existing systems like Salesforce, Jira, and Microsoft 365, building live apps with real-time data that you can share instantly across your organization.