Cyber Attacks
AWS publishes guide for ML-DSA quantum-resistant signing in software supply chains
Amazon Web Services released a two-part series detailing how to build and enforce post-quantum signing pipelines using NIST-standardized algorithms.
AWS
Everything Threat Times has reported about AWS: 50 stories, newest first. Part of our Vulnerabilities coverage.
AI
AWS launches Strands Box sandbox to restrict AI agent actions
The open-source tool uses policy checks and OS isolation to prevent coding agents from executing destructive commands or leaking credentials.
Tech News
Amazon in Talks to Acquire AI Startup Decart for Up to $7 Billion
Reports indicate Amazon is negotiating a potential $7 billion acquisition of AI infrastructure developer Decart, aiming to bolster its cloud computing capabilities.
Cloud Security
Researchers highlight persistent AWS AgentCore security flaws in default configurations
Palo Alto Networks and Zenity Labs report that AWS AgentCore default settings allow credential exfiltration via prompt injection, illustrating broader AI agent risks.
Cyber Attacks
Yandex Says Drone Attack on Sasovo Data Center May Be Unrecoverable
Russian tech giant Yandex warns that its ru-central1-b cloud zone may not be restorable in the near future after a drone strike halted operations.
AI
Cloudflare and AWS launch specialized decision models for AI agents
New tools from Cloudflare and AWS aim to handle routine AI agent decisions locally, potentially lowering costs but increasing architectural complexity.
AI
Hyperscalers distribute AI training across regions to manage power and compute limits
Major cloud providers are linking datacenters over long distances to coordinate thousands of GPUs for large-scale model training.
Cloud Security
Zenity Labs Research Shows Single Prompt Can Hijack AWS AI Agents
New findings indicate a single prompt could compromise Amazon Bedrock AgentCore, exposing credentials and private data within the same account and region.
Cyber Attacks
Researchers Detail AgentCorruption Attack Chain in AWS Bedrock AgentCore
A new attack chain dubbed AgentCorruption allows attackers to hijack AI agents via a single prompt, leading to credential theft and lateral movement within AWS accounts.
Cloud Security
AWS Plans 36-Building, 1,100-Acre Data Center Campus in Pennsylvania
Amazon Web Services is constructing a massive facility in Homer City, backed by 4.5GW of natural gas generation and creating up to 2,000 jobs.
Cloud Security
AWS AgentCore security flaws expose credentials via metadata and weak VM isolation
Analysis reveals that AWS AgentCore’s security model is undermined by metadata token transmission, weak virtual machine isolation, and overly expansive permissions.
Vulnerabilities
AWS Advises on CVE-2026-5190: Stack Buffer Overflow in C Event Stream Decoder
Amazon Web Services has issued a security bulletin regarding a stack buffer overflow vulnerability in its C Event Stream Streaming Decoder.
Vulnerabilities
AWS patches two vulnerabilities in Ops Wheel affecting cloud infrastructure
Amazon Web Services released security bulletins for CVE-2026-6911 and CVE-2026-6912, addressing issues in its Ops Wheel service.
Vulnerabilities
AWS Discloses Out-of-Bounds Write Vulnerability in Firecracker virtio-pci Transport
AWS has published a security bulletin detailing CVE-2026-5747, an out-of-bounds write flaw in the Firecracker microvm manager’s virtio-pci transport component.
Vulnerabilities
AWS Alerts Users to Critical Sandbox Bypass in QnABot Service
A new advisory from Amazon Web Services details a high-severity vulnerability allowing arbitrary code execution through a sandbox escape.
Vulnerabilities
AWS Advisories on CVE-2026-7461 OS Command Injection in ECS Agent
Amazon Web Services disclosed a command injection flaw in the ECS Agent that affects users with FSx Windows File Server volumes.
Vulnerabilities
AWS Advises of Remote Code Execution Flaw in Amazon Redshift JDBC Driver
A vulnerability in the Amazon Redshift JDBC driver allows remote code execution through unsafe class loading, posing risks to connected applications.
Vulnerabilities
AWS Issues Advisory for Kiro CLI Authorization Bypass Vulnerability
A new security bulletin highlights an authorization bypass flaw in the Kiro CLI, allowing unauthorized tool execution via piped standard input.
Vulnerabilities
AWS Issues Security Bulletins for CVE-2026-11400 and CVE-2026-11401
Amazon Web Services has published advisory details for two new vulnerabilities, identified as CVE-2026-11400 and CVE-2026-11401, requiring immediate attention.
Vulnerabilities
AWS WAF Vulnerabilities Allow HTTP/2 Multi-Frame Request Bypass
AWS issued a security bulletin for two CVEs in WAF that could let attackers bypass inspection rules via HTTP/2 multi-frame requests.
Vulnerabilities
AWS Encryption SDK for Python Vulnerability Allows Policy Bypass via Shared Key Cache
A flaw in the AWS Encryption SDK for Python allows attackers to bypass key commitment policies by exploiting a shared key cache mechanism.
Vulnerabilities
AWS patches mount option injection flaw in EFS CSI Driver
Amazon Web Services released a security bulletin for CVE-2026-6437, addressing a vulnerability in the EFS CSI Driver that could allow unauthorized file system access.
Vulnerabilities
AWS Issues Security Bulletin for Research and Engineering Studio Issues
Amazon Web Services has published a security bulletin addressing issues within its Research and Engineering Studio service.
Vulnerabilities
AWS Issues Security Bulletin for Amazon Athena ODBC Driver Vulnerabilities
Amazon Web Services has released a security bulletin addressing issues within the Amazon Athena ODBC Driver, urging users to review their configurations.