Amazon Neptune has a critical vulnerability (CVE-2026-110812) in its Gremlin graph-import path. Authenticated users with query permissions could exploit unsafe deserialization to execute unintended code in the query engine. You need to upgrade to the patched engine version immediately if you're running Neptune 1.2.0.0 or later.
source: [aws/security-bulletin]
A critical issue (CVE-2026-99999) in the Linux kernel's virtio-net/TAP networking path affects KVM-based hypervisors running unpatched kernel versions 4.4–6.18. Privileged guest VM users could craft malicious packets to corrupt host kernel memory, potentially leaking sensitive data or causing denial of service. AWS-managed services like EC2, Lambda, and Fargate are safe—no action needed there. However, if you're self-managing VMs with virtio-net and KVM (including Firecracker), you'll want to patch your host kernel ASAP.
source: [aws/security-bulletin]
Amazon SageMaker Studio just dropped a game-changer for newcomers: sign up with your Google, GitHub, or Apple credentials and boom—you're inside a fully configured ML environment with zero AWS console headaches. No credit card needed (thanks to free tier credits), instant team collaboration, and you can start fine-tuning foundation models right away across all AWS Commercial Regions.
source: [aws/whats-new]
Amazon S3 Encryption Client for .NET has a nasty security flaw (CVE-2026-110310) that lets attackers downgrade your encryption padding to the vulnerable PKCS#1 v1.5 scheme. If someone can read your encrypted S3 objects, they could exploit a padding oracle attack to recover your RSA keys and decrypt everything. Action required: update immediately if you're running versions 2.1.0+, 3.0.0-3.2.1, or 4.0.0-4.0.2.
source: [aws/security-bulletin]
Amazon SageMaker Python SDK has a nasty bug (CVE-2026-110248) where failed Git clone operations expose repository credentials in plain text to CloudWatch Logs. If you're running SDK V2 before 2.257.3 or V3 before 3.10.0, update immediately—anyone with log access can grab your credentials. This one requires action.
source: [aws/security-bulletin]
AWS Lambda's recursive loop detection now automatically stops runaway loops between Lambda functions and EventBridge Custom event buses, protecting you from surprise bills and unexpected resource consumption. This safety net is enabled by default across all commercial AWS regions and requires zero configuration—unless you're intentionally using recursion, in which case you can disable it per function.
source: [aws/whats-new]
AWS just unlocked a neat trick: you can now serve Lambda Web Functions through CloudFront's worldwide edge locations, getting TLS termination, caching, and DDoS protection straight out of the box—no code changes needed. Origin Access Control locks things down so only CloudFront can reach your Lambda function, and you can layer AWS WAF on top for extra security.
source: [aws/whats-new]
AWS just dropped Lambda Web Functions, a serverless compute primitive that runs your HTTP framework natively with multi-concurrent execution and automatic global distribution. If you're tired of managing infrastructure for web apps, this delivers fast, consistent responses without the ops headache.
source: [aws/aws-blog]
AWS breaks down Prime Day 2026's jaw-dropping infrastructure metrics, including ElastiCache hitting 2.3 quadrillion daily requests, while introducing Claude Haiku 5.5 and Amazon Nova 2.5 Sonic for developers looking to scale AI workloads. Get the numbers that prove why cloud infrastructure matters when billions of shoppers hit at once.
source: [aws/aws-blog]