Machine-filtered, human-readable judgment for DevOps and Platform leaders.
Update the AWS SDK for Go v2 to version 2026-03-23 or above to address the security vulnerability CVE-2026-89090 and prevent potential denial of service attacks.
Update projen to version 0.101.37 or later to address CVE-2026-89065, and to version 0.103.0 or later to address CVE-2026-89066, ensuring to re-synthesize your project to regenerate.projen/tasks.json with the corrected task definitions to mitigate security risks and maintain project integrity.
Update the AWS Advanced JDBC Wrapper to version 4.3.0 to address the XXE vulnerability (CVE-2026-18061) and ensure the security of your applications connecting to Amazon Aurora, RDS MySQL, and RDS MariaDB.
Update Kiro IDE to version 0.8.135 or greater to address CVE-2026-89332, a critical security vulnerability that could lead to sensitive workspace data exfiltration.
Update Deep Java Library to version 0.37.0 or later to address CVE-2026-85228 and prevent potential security exploits.
Update SSM Agent to version 3.3.4851.0 across all managed nodes to address the server-side request forgery issue (CVE-2026-89049) and restrict use of the AWS-StartPortForwardingSessionToRemoteHost document until the upgrade is complete.
Update your OpenSearch Dashboards to version 3.8.0 or later, and apply the latest service software updates for Amazon OpenSearch Service to address the security vulnerability CVE-2026-75897 and prevent denial of service attacks.
Update the amazon-ssm-agent to version 3.3.4515.0 or later to address the path traversal vulnerability (CVE-2026-81849) and prevent potential arbitrary code execution.
Update the awslabs postgres-mcp-server to version 1.1.7 and configure it to run with minimal-privilege Postgres roles to address the security vulnerability identified as CVE-2026-85787.
Update OpenSearch SQL Plugin to versions 3.7 or 2.19.6 for open-source deployments and apply the latest service software update for Amazon OpenSearch Service to resolve the async query validation bypass vulnerability (CVE-2026-18428).
Update Kiro IDE to version 1.0.228 and Kiro CLI to version 2.10.0 to address security vulnerabilities CVE-2026-18656 and CVE-2026-18657, ensuring no workarounds are available and immediate action is required to prevent potential code execution from untrusted directories.
Update Athena Federated Query to version v2026.30.1 to address the security vulnerability CVE-2026-77810, ensuring that existing deployments are secure and compliant.
Update the log4j-cve-2021-44228-hotpatch package to version 1.3-9.amzn2 to address the OS command injection vulnerability (CVE-2026-85656) and ensure system security.
Update FreeRTOS-Kernel to version V11.3.1 to patch critical security vulnerabilities (CVE-2026-77234, CVE-2026-77235, CVE-2026-77236, CVE-2026-77237) and ensure system security and stability.
Update ion-java to version 1.12.0, configure a limited maximum buffer size, and disable automatic GZIP decompression for untrusted input to address critical security vulnerabilities (CVE-2026-75935 and CVE-2026-75936).
Update AWS CLI to versions 1.45.28 or 2.35.3 to resolve the security vulnerability CVE-2026-18654 and ensure secure SSH connections to EMR clusters.
Update the Amazon Bedrock AgentCore harness to the latest version to incorporate the server-side input validation that prevents bypassing security controls.
Update OpenSearch SQL Plugin to versions 2.19.6 or 3.7 for open-source deployments and apply the latest service software update for Amazon OpenSearch Service to address the security vulnerability CVE-2026-83497.
Update the AWS FPGA Development Kit to version 2.3.4 to address the security vulnerability CVE-2026-85028 and remove or comment out lines referencing /tmp/sdk_root_env.exp in sdk_setup.sh and install_fpga_mgmt_tools.sh as a temporary workaround.
Update OpenSearch Dashboards to versions 3.4 or 2.19.6 to address the stored cross-site scripting vulnerability (CVE-2026-77811) and ensure all domains are running the latest service software version to maintain security compliance.
Update awslabs.aws-transform-mcp-server to version 0.1.5 to address the security vulnerability CVE-2026-18953 and prevent arbitrary file writes outside the intended directory.
Update the @amazon-codecatalyst/blueprints.blueprint npm package to version 0.3.156 or later to address the OS command injection vulnerability (CVE-2026-85012) and ensure the security of your projects.
Update OpenSearch Dashboards to version 3.8.0 or later, and apply the latest service software update for AWS Managed OpenSearch Dashboards to address the CVE-2026-18420 vulnerability.
Update applications using Amazon Ion-C to version 1.1.6 to incorporate the fix for uncontrolled recursion, which sets a default recursion depth limit and raises IERR_STACK_OVERFLOW when exceeded.
Update Amazon DocumentDB MCP Server to version 1.0.12 to address the incorrect authorization issue (CVE-2026-18954) and configure the server with read-only database credentials as a workaround.
Update Amazon EFS CSI Driver to version v3.4.1 to address CVE-2026-85781, ensuring the driver verifies EFS access point ownership before deletion operations.
Update Amazon SageMaker Python SDK to version 3.11.0 or 2.256.0 to address the security vulnerability (CVE-2026-83551) and ensure the integrity of serialized function payloads by replacing symmetric HMAC signing with asymmetric ECDSA signing.
Update the DynamoDB MCP server to version 2.1.6 to address the code injection vulnerability (CVE-2026-85654) and ensure the security of generated CDK applications.
Update existing Amazon RDS for Oracle instances to the new engine versions 19.0.0.0.ru-2026-07.spb-1.r1 or 26.0.0.0.ru-2026-07.spb-1.r1 by selecting the 'Supplemental Patch Bundle Engine Versions' checkbox in the AWS Console to incorporate additional patches for Oracle Spatial, Data Pump, and GoldenGate.
Update your Amazon S3 File Gateway configurations to use FIPS interface VPC endpoints for Storage Gateway and Amazon S3, ensuring your gateway is running software version 2.1.10 or later to enable FIPS-compliant private connectivity.
Update your Redshift clusters to RG instances in the Europe (Zurich) Region using Snapshot & Restore, Elastic Resize, or Classic Resize to leverage improved performance and cost savings, ensuring minimal disruption to existing workloads.
Update your messaging infrastructure to RabbitMQ 4.3 on Amazon MQ to benefit from new features like quorum queue enhancements, native delayed retries, and improved memory management, while planning for the deprecation of transient non-exclusive queues and Global QoS.
Update existing feature engineering pipelines to utilize the UpdateRecord API for partial feature updates, reducing the need for full-record writes and minimizing the risk of lost updates in multi-pipeline architectures.
Update your Amazon RDS for MariaDB deployments to the latest minor versions (10.6.28, 10.11.19, 11.4.13, 11.8.9, and 12.3.3) to incorporate security fixes, bug patches, and new features introduced by the MariaDB community.
Update AWS Elemental MediaLive configurations to integrate with AWS Elemental Inference for real-time metadata generation, ensuring ad markers are correctly embedded and retrieved for contextual ad decision-making.
Configure Yield Optimization via the MediaTailor API or Console to automatically fill ad breaks with Amazon Ads demand, requiring no additional infrastructure or client-side changes, and monitor performance using MediaTailor metrics in Amazon CloudWatch.
Update your .NET migration process to include AWS Transform's unit test generation feature, which can be enabled at the start or after transformation, to ensure comprehensive test coverage and reduce manual testing efforts.
Configure the new capacity limits for different types of Tasks and Emails in Amazon Connect Customer to align with your contact center's operational needs and improve agent performance.
As more organizations move to remote and distributed work, builders and development teams face growing challenges in sharing files securely. Without a central file system, these teams deal with version control problems, unclear access permissions, and security risks from scattered storage locations. Central IT becomes a bottleneck when handling every permission change, yet granting full [โฆ]
Enterprises that use Amazon API Gateway often want to bring their own client certificate for backend mutual TLS (mTLS) authentication. With API Gateway, you can now use a third-party or AWS Private CA-issued client certificate for the outbound mTLS handshake. In this post, you build a REST API with an outbound mTLS connection to an Amazon ECS backend.
Benchmark two 30B Mixture-of-Experts models, Qwen3-Coder-30B and NVIDIA Nemotron-3-Nano-30B, across G5, G6, G6e, and G7 GPU instances on Amazon SageMaker AI. Compare throughput, latency, and cost-per-token, and see how G7's NVIDIA Blackwell GPUs deliver measurable price-performance gains for real-time LLM inference.
Pathway's Baby Dragon Hatchling (BDH) is a brain-inspired, post-transformer architecture that reasons in latent space instead of emitting chain-of-thought tokens. See how Pathway develops and scales BDH on Amazon SageMaker HyperPod, and how BDH-CQ set a new cost-efficiency mark on the ARC-AGI-1 benchmark.
AI assistants can stand up an app or website that runs on AWS in minutes. Getting to a production-ready version you would put in front of real customers is still the hard part. Security, observability, type-safety, and resilience are non-negotiable for production. An assistant rarely gets all of that right in one pass, and hardening [โฆ]
GPT-6 Astra from OpenAI is now generally available on Amazon Bedrock. It brings deeper reasoning and sharper judgment to your most demanding tasks, running on the Amazon Bedrock inference engine built for high performance, security, and scale.
Update Amazon EFS CSI Driver to version v3.4.1 to address CVE-2026-85781 and ensure the --delete-access-point-root-dir option is disabled or restricted to trusted administrators.
Update the awslabs postgres-mcp-server to version 1.1.7 and configure it to run with minimal-privilege Postgres roles to address the security vulnerability identified as CVE-2026-85787.
Update the awslabs.dynamodb-mcp-server to version 2.1.6 to address the code injection vulnerability (CVE-2026-85654) and ensure the security of the CDK generator.
Update ion-java to version 1.12.1 to address the incomplete fix for CVE-2026-85786 and protect against potential denial of service attacks.
Update the AWS FPGA Development Kit to version 2.3.4 to address the security vulnerability (CVE-2026-85028) and prevent local users from executing arbitrary code with elevated privileges.
Update the @amazon-codecatalyst/blueprints.blueprint npm package to version 0.3.156 or later to address the OS command injection vulnerability (CVE-2026-85012) and ensure your projects are secure.
Update Amazon Ion-C to version 1.1.6 to address the uncontrolled recursion vulnerability (CVE-2026-84851) and prevent potential application crashes due to stack overflow, ensuring system reliability and security.
Update Amazon SageMaker Python SDK to version 3.11.0 (v3) or 2.256.0 (v2) to address the HMAC key storage vulnerability and ensure secure pipeline execution.
Update your Aurora MySQL clusters to version 8.4.8 or higher to leverage multi-source and delayed replication features, which will simplify data consolidation and provide safeguards against human error and logical data corruption.
Update your deployment pipelines to include Amazon Linux 2027 Preview AMIs, available in all commercial regions, to experiment with new features and provide feedback to the Amazon Linux team.
Update your Aurora MySQL databases to version 8.4.8 to leverage new security features like PQ-TLS, transaction timeout, and replication enhancements, ensuring better data protection and operational stability.
Update your Amazon MWAA environments to Apache Airflow 3.3.1 to take advantage of new capabilities such as stateful tasks, multi-language support, and improved stability and security features.
Update your Amazon RDS Custom for SQL Server instances to the latest CU and GDR versions to apply critical security patches (CVE-2026-47295, CVE-2026-47296, CVE-2026-54118, CVE-2026-55002) and improve database performance and stability.
Update your Redshift clusters to utilize single-node rg.large instances for smaller, non-high availability workloads, ensuring you are on P204 or later patch versions to leverage the new capability.
Configure existing ECS Managed Daemons as non-critical to ensure application tasks continue running even when daemons fail, using AWS Console, CLI, CloudFormation, or AWS SDKs.
Update your deployment strategy to include second-generation Outposts racks in AWS GovCloud (US) Regions, ensuring your hybrid cloud architecture aligns with the new regional support for consistent API and tool usage.
Update your application development process to leverage Amazon Quick for building custom applications using natural language, reducing development time and minimizing toil.
Enabling single sign-on for AWS Transform with Okta Workforce Identity ensures that the dozens, sometimes hundreds, of people involved in enterprise migration programs all work inside a single platform. That platform is governed by the same access controls and security policies that your organization already enforces, making it essential for running migrations at scale. AWS [โฆ]
Introduction Continuous improvement depends on experimentation. Teams know that the fastest path to better outcomes is to test changes against real user behavior, measure results, and iterate. In practice, sustaining that cycle is slow and costly because the overhead compounds with each attempt. Three barriers slow teams down: 1. Planning cost โ Turning a proposed [โฆ]
Deploy a customer-operated LiteLLM gateway on Amazon ECS with AWS Fargate, connect it to an OpenAI model on Amazon Bedrock, and configure Codex to route requests through the gateway's Responses API with scoped identities, budgets, rate limits, and telemetry. We also compare direct IAM Identity Center access and a managed Portkey deployment.
Over 230 million Americans identify as gamers. Yet most will never buy a $500 console or a $1,500 PC, not because they don't want to play, but because the cost of entry keeps climbing: hundreds (sometimes thousands) in hardware, hundreds of gigabytes in downloads, and frustrating maintenance just to keep things running.
After talking with enterprise security leaders over the past year, one thing has become clear: the rise of autonomous AI agents is the most significant shift in security posture since the move to cloud. Organizations across every industry are adopting AI agents that authenticate on behalf of users, execute multistep workflows, and make decisions across [โฆ]
Enabling single sign-on for AWS Transform with Entra ID ensures that the dozens, sometimes hundreds, of people involved in enterprise migration programs, from application owners and infrastructure engineers to business analysts and program managers, all work inside a single platform. That platform is governed by the same access controls and security policies your organization already [โฆ]
When a firewall or security appliance behind your Gateway Load Balancer (GWLB) fails, what happens to the TCP connections flowing through it, and how long do those traffic interruptions last? Until today, they could hang while TCP retry mechanisms and exponential backoff ran their course, sometimes for minutes. For mission-critical applications, every second of interruption [โฆ]
t54 built x402-secure, a trust layer on Amazon Bedrock AgentCore payments that scores every endpoint before an autonomous agent pays it. See how session budgets, credential isolation, and a deterministic trust gate have governed more than 20 million agent-initiated transactions with no human in the loop.
Amazon Quick proof-of-concept projects often stall when security teams review the production plan. This post walks through designing dashboards, Spaces, knowledge bases, agents, and Flows with security controls that hold as you scale: dataset shaping, agent isolation, document classification, and approval gates.