Bartek Chojnacki

CVE-2026-98432 is a nasty use-after-free bug in the Linux kernel's IPv4 TCP handshake that could lead to remote code execution on versions 4.4+. If you're running self-managed Amazon Linux 2 or 2023 instances, you'll need to update your kernel packages and reboot—no way around it. AWS is handling updates for managed services automatically, so those users can relax. Check the full bulletin for per-service details and patch availability.

Amazon Kinesis Producer Library for Java versions before 1.0.8 expose AWS credentials through debug logs and process arguments, allowing local users to steal credentials. Affected versions: com.amazonaws:amazon-kinesis-producer ≤ 0.15.12 and software.amazon.kinesis:amazon-kinesis-producer < 1.0.8. Action required: upgrade immediately if you're running these versions, especially if DEBUG logging is enabled.

AWS Nitro Enclaves SDK for C versions up to v0.4.5 have two nasty security issues. CVE-2026-119116 is a use-after-free bug in kmstool-enclave that lets local attackers execute arbitrary code inside the enclave via crafted vsock messages. CVE-2026-119148 is an input validation flaw allowing attackers to impersonate AWS KMS and inject fake key material. If you're running affected versions, update immediately—this one requires action.

FreeRTOS-Kernel versions 7.4.0 through 11.3.2 have a nasty type validation bug (CVE-2026-119086) in the xQueueSelectFromSet function. If you're running MPU-enabled builds with queue sets enabled, unprivileged tasks could exploit this to write memory in privileged context—yikes for security. Only affected if you use queue sets; standard builds are safe. Update immediately if you match these specs.

AWS Private CA Connector for Kubernetes has a nasty authorization bug (CVE-2026-119115) that lets authenticated users grab certificates from cluster-scoped issuers they shouldn't access. If you're running aws-privateca-issuer before v1.10.1 or the EKS add-on before v1.10.1-eksbuild.1, you need to patch ASAP—this is a real privilege escalation risk in your cert management.

Amazon RDS for Oracle and SQL Server now let you enable storage autoscaling on additional volumes—no more manual provisioning headaches. Set your max storage limit, and RDS automatically scales capacity as your database grows, available across all commercial AWS Regions and GovCloud.

AWS Step Functions workflows can now act as tools for AI agents through Amazon Bedrock AgentCore Gateway, letting your agents trigger multi-step business processes automatically. This means your customer support or operations agents can execute complex workflows—like refund eligibility checks, approvals, and credits—while maintaining consistent policy enforcement across every run.