bartek@aws: ~/news
$ whoami
$ AWS Architect · DevOps · Cloud
Monday, November 2, 2026

Critical Template Injection in Virtual Engineering Workbench Publishing Component

Virtual Engineering Workbench (VEW) has a nasty template injection vulnerability (CVE-2026-119085) in its publishing component that lets authenticated attackers execute arbitrary code with Lambda IAM permissions. All versions before commit c146486 are affected—if you're running VEW, update immediately. This one's serious and requires action.

source: [aws/security-bulletin]