AWS Temporary Elevated Access Management (TEAM) has a privilege escalation bug (CVE-2026-86830) that lets authenticated users grab unintended elevated access to managed AWS accounts. If you're running TEAM below version 1.5.1, you need to patch immediately. This is a legit security concern that requires your attention.
source: [aws/security-bulletin]
AWS now distributes root user sign-in traffic across US East (N. Virginia), US East (Ohio), and US West (Oregon), automatically routing your requests without any action needed on your end. This multi-region setup cuts dependency on a single region and keeps your account accessible even during regional hiccups—just remember to update your CloudTrail monitoring to track sign-ins across all three regions.
source: [aws/whats-new]
AWS dropped some serious heat this week with OpenAI GPT-6 Astra now available on Amazon Bedrock, giving developers access to cutting-edge AI capabilities. You're also getting Amazon Quick desktop in GA and Kiro for students, so whether you're building AI apps or need better productivity tools, there's something here for your workflow.
source: [aws/aws-blog]
AWS Elemental MediaLive just rolled out Video Aligned Locking, letting you sync video pipelines without needing timecode from your source—a game-changer for digital streaming workflows. The feature uses visual signatures to nail frame-accurate input switching across standard and cross-region channels, supporting HLS, MediaPackage, CMAF Ingest, UDP, and SRT outputs.
source: [aws/whats-new]
Kiro IDE versions below 0.8.135 have a security issue (CVE-2026-89332) where AI agents can modify workspace settings to exfiltrate sensitive data. A malicious repo could redirect the Powers registry URL to an external endpoint, sending your workspace info there—even before you approve the change. Update to version 0.8.135 or later immediately to stay safe.
source: [aws/security-bulletin]
AWS SDK for Go v2 versions before 2026-03-23 have a critical flaw in the EventStream header decoder. An attacker can crash your application by sending a malformed response with an invalid header type byte. If you're running an older version, update immediately to patch this DoS vulnerability.
source: [aws/security-bulletin]
AWS Advanced JDBC Wrapper versions 3.3.0–4.2.0 contain a critical XXE flaw in RemoteQueryCachePlugin that could leak database and IAM credentials. If you're using this library with shared caching enabled, update immediately—attackers with cache write access can inject malicious XML to exploit XML parsers. This one's serious: patch your Aurora, RDS MySQL, and RDS MariaDB connections ASAP.
source: [aws/security-bulletin]