Bartek Chojnacki

AWS Cloud Development Kit's @aws-cdk/aws-redshift-alpha module has a critical SQL injection vulnerability (CVE-2026-115418) affecting versions below 2.274.0-alpha.0. Attackers who can control construct properties like usernames, comments, or passwords could execute arbitrary SQL with superuser privileges, potentially granting unauthorized cluster access. If you're using this module, update immediately—this one requires your action.

AWS just dropped GPT-6.1 Terra on Amazon Bedrock, and it's a solid middle-ground pick for everyday AI work—50% cheaper token pricing than GPT-6.1 Sol, 3x faster than its bigger siblings, and handles up to 1 million input tokens with both text and images. You can spin it up through Bedrock APIs or wire it into ChatGPT Work and Codex for drafting, code analysis, and building autonomous agents across your business systems.

AWS Key Management Service just dropped support for ML-KEM, NIST's post-quantum cryptography standard that protects your key exchanges from future quantum threats. You can now use all three ML-KEM variants (512, 768, 1024) across virtually all AWS regions to establish shared secrets the quantum-safe way, with private keys locked down in FIPS 140-3 Level 3 HSMs.

AWS is pulling three eMudhra intermediate CA roots from its trust bundles due to CVE-2026-111943—a key-generation vulnerability that exposed private keys to recovery attacks. If you're running CloudFront custom origins or ALB with OIDC/JWT auth, check whether your certs chain to AAA Certificate Services, emSign Root TLS CA - G3, or emSign ECC Root CA - G3. Action required: reissue certificates from a different CA before AWS enforces the removal to avoid man-in-the-middle risks on soft-fail TLS clients.

Amazon Web Services Multi Model Server (MMS) has reached end-of-life, but two serious vulnerabilities (CVE-2026-115812 and CVE-2026-115813) affect all versions up to 1.1.11. The first flaw lets attackers execute code by crafting malicious model archives, while the second enables unauthorized network requests through the management interface. If you're still running MMS, you need to migrate away immediately—no patches are coming since the project is archived.

AWS MCP Server's run_script tool has a validation bypass (CVE-2026-115845) that could let authenticated users execute arbitrary code in their isolated session. The Python code validator has an incomplete blocklist, creating a security gap. You should review your MCP Server usage and apply fixes when AWS releases them—this one needs your attention.

AWS Bedrock's Web Search now lets you filter results by specific domains (up to 100 allowed or blocked) and set user location parameters for geographically relevant answers. These new controls are live across US East (N. Virginia), US East (Ohio), US West (Oregon), and AWS GovCloud (US-West), giving you finer-grained grounding for your AI models.