AWS Security Hub just dropped native CSV and JSON export to S3, so you can skip building custom extraction pipelines for compliance reports and audit trails. Grab findings from any view—Threats, Vulnerabilities, Posture Management, you name it—and have them land in your S3 bucket on demand. This is live across all AWS regions where Security Hub operates.
source: [aws/whats-new]
AWS Amplify API Category has a nasty authorization flaw (CVE-2026-108096) in @aws-amplify/graphql-index-transformer that lets authenticated users read other users' data through crafted queries. You need to update immediately: @aws-amplify/graphql-index-transformer to 3.1.2+, @aws-amplify/graphql-api-construct to 1.21.4+, or @aws-amplify/data-construct to 1.17.4+. This is a serious data exposure risk—patch your AppSync APIs ASAP.
source: [aws/security-bulletin]
AWS Tools for PowerShell versions up to 5.0.305 have a security flaw (CVE-2026-107783) that exposes IAM user passwords in cleartext within log files and command output. Local attackers could potentially recover AWS Management Console credentials. Update to version 5.0.306 or later immediately—this one requires your action.
source: [aws/security-bulletin]
Amazon EC2's new C9g, C9gd, M9g, and M9gd instances powered by AWS Graviton5 processors are now live in Malaysia, Seoul, Singapore, and Spain. These chips deliver up to 25% better compute performance than Graviton4, with databases seeing 30% speedups and ML workloads hitting 35% faster execution—plus they're the first to feature the Nitro Isolation Engine for mathematically proven workload isolation.
source: [aws/whats-new]
aws-cdk-lib versions before 2.267.0 have a nasty vulnerability (CVE-2026-107608) where Docker files can sneak symlinked files into the asset bundling output without them being part of the original input. This could let attackers inject unwanted files into your cloud infrastructure deployments. If you're using AWS CDK with Docker files, update to 2.267.0 or later immediately—this one requires your attention.
source: [aws/security-bulletin]
Amazon Agent Plugins for AWS databases-on-aws plugin (versions before 1.7.1) has a command injection vulnerability (CVE-2026-107322) that could let attackers execute OS commands through crafted database inputs. User action required: upgrade to version 1.7.1 or later immediately. The vulnerability only triggers if an agent invokes the local helper with malicious input, running commands with helper process permissions.
source: [aws/security-bulletin]
AWS Toolkit for Visual Studio Code versions below 4.10.0 have a security flaw where CodeCatalyst bearer tokens are cached with world-readable permissions and not deleted after sessions end. Local attackers could steal these tokens to gain unauthorized access. If you're using this extension, upgrade to version 4.10.0 or later immediately—this one's worth your attention.
source: [aws/security-bulletin]