Bartek Chojnacki

AWS SDK for C++ versions up to 1.11.861 contain two memory-safety bugs (CVE-2026-19642 and CVE-2026-19643) in the Base64 decoder that could crash your app or corrupt memory. CVE-2026-19642 causes out-of-bounds writes, while CVE-2026-19643 triggers out-of-bounds reads on certain platforms. Yes, you need to act—update your SDK immediately if you're using an affected version. Remote code execution hasn't been demonstrated, but the impact is real for any process decoding untrusted Base64 data.

OpenSearch Alerting Plugin has a nasty authorization flaw (CVE-2026-19311) that lets authenticated users with alerting_full_access role read, modify, or delete arbitrary index data through crafted monitor requests. Affected versions: 2.4.0–2.19.5 and 3.0.0–3.7.0 (self-managed), plus AWS OpenSearch Service domains on engines 2.4–3.5. Action required: upgrade to 2.19.6, 3.8.0, or service software R20260428-P3 immediately.

Amazon EKS now lets you tweak Kubernetes control plane parameters like scheduler strategies and autoscaling response times across all AWS regions. You can optimize pod placement—pack them tight with MostAllocated or spread them out with LeastAllocated—giving you real control over resource utilization and workload density.

Amazon Bedrock has extended IAM principal cost allocation to the bedrock-mantle endpoint, letting you tag and track inference expenses by users, roles, teams, and projects across all AWS regions. You can now analyze these costs in AWS Cost Explorer or CUR 2.0, making it way easier to attribute generative AI spending to the right teams.

AWS just dropped their Summer 2026 SOC 1 report, covering 185 services with a full 12-month audit period (July 2025–June 2026). If you're managing cloud infrastructure, grab this report to verify AWS's compliance controls and use it as your baseline for security governance decisions.

AWS just dropped an independent assessment report for Landing Zone Accelerator on AWS Artifact, proving it meets Germany's strict C5:2020 cloud security standards. If you're deploying infrastructure in Europe and need to tick compliance boxes without reinventing the wheel, this assessment gives you a solid foundation to build on.

AWS Identity and Access Management rolled out account access manager, letting admins assign IAM roles directly to workforce users through IAM Identity Center—no extra cost, available across all AWS Commercial Regions. This bridges the gap between centralized federation and granular IAM role flexibility, giving you the best of both worlds without the usual trade-offs.

Amazon EC2 just dropped application status checks, letting you monitor whether your apps are actually healthy without building custom solutions. The feature watches for common issues like stopped web servers or broken Docker daemons, works across all AWS regions, and Auto Scaling can automatically replace instances when apps go sideways.

Amazon OpenSearch Serverless just bumped its collection limit from 1,500 to 10,000 per collection group, letting you pack way more multi-tenant workloads into a single shared compute pool. This means better cost efficiency and resource utilization across all AWS Regions where nextgen OpenSearch Serverless is available—perfect for scaling those tenant-per-collection architectures without spinning up extra infrastructure.