Bartek Chojnacki

CVE-2026-111497 is a nasty remote code execution and memory disclosure bug in the native Brotli decompression library that could let attackers execute code or leak process memory. AWS Lambda, Amplify, App Runner, CloudWatch Synthetics, CodeBuild, Elastic Beanstalk, and Elemental MediaLive are all affected—some require your action. Check AWS's security bulletin for service-specific mitigation steps.

Strands Agents Tools versions 0.1.0 through 0.8.5 have a nasty vulnerability (CVE-2026-115415) where crafted prompts can trick the LLM into disabling environment variable masking. This means your cloud credentials and API keys could leak in cleartext—yikes! If you're running affected versions, update to 0.8.6 or later immediately. User action required.

AWS SDK for pandas (awswrangler) versions below 3.16.1 have a security issue where unverified S3 bucket ownership could let attackers access your Athena query results and mess with the data. If you're using awswrangler, upgrade to 3.16.1 or later ASAP—this one needs your attention.

AWS API MCP Server versions 1.3.0 through 1.5.x have a critical OAuth validation flaw (CVE-2026-115413). The server skips checking the token's audience claim, letting attackers bypass authentication. If you're running the affected versions with OAuth enabled, upgrade to 1.6.0+ immediately—this one needs your attention.

Amazon Aurora serverless now supports up to 384 Aurora Capacity Units (ACUs) for PostgreSQL-Compatible Edition—a 50% bump that lets your database scale to 768 GiB of memory. This is perfect for AI agents and bursty workloads since Aurora still scales down to zero when idle, so you pay only for what you actually use.

Amazon SageMaker AI MLflow Apps now runs MLflow 3.16, giving you a redesigned trace explorer with customizable columns and faster metric charts for large experiment histories. The upgrade rolls out automatically to all existing apps across all AWS Regions, making debugging generative AI workflows and agents way smoother.

AWS Cloud Development Kit's @aws-cdk/aws-redshift-alpha module has a critical SQL injection vulnerability (CVE-2026-115418) affecting versions below 2.274.0-alpha.0. Attackers who can control construct properties like usernames, comments, or passwords could execute arbitrary SQL with superuser privileges, potentially granting unauthorized cluster access. If you're using this module, update immediately—this one requires your action.

AWS just dropped GPT-6.1 Terra on Amazon Bedrock, and it's a solid middle-ground pick for everyday AI work—50% cheaper token pricing than GPT-6.1 Sol, 3x faster than its bigger siblings, and handles up to 1 million input tokens with both text and images. You can spin it up through Bedrock APIs or wire it into ChatGPT Work and Codex for drafting, code analysis, and building autonomous agents across your business systems.

AWS Key Management Service just dropped support for ML-KEM, NIST's post-quantum cryptography standard that protects your key exchanges from future quantum threats. You can now use all three ML-KEM variants (512, 768, 1024) across virtually all AWS regions to establish shared secrets the quantum-safe way, with private keys locked down in FIPS 140-3 Level 3 HSMs.