AWS Security Digest

Issue #285

Monday · November 02, 2026

🥖 Palate Cleanser

Happy November friends,

A few of you have been politely nagging me about the results of the inaugural AWS Security Digest Top Research 2026. The top ten is set! It will be in next week's issue. We just need a little time to make it pretty and make a video explainer.

Last week was PHP2Shell. This week is Broccoli2shell, aka CVE-2026-111497, a remote code execution in Google's Brotli decoder that affects Node.js, Python, Bun, .NET, Java, Envoy and Istio. If you don't know what 'Brotli' is I don't blame you. It's one of those open source components you find out the whole internet relies on when it gets rekt. It is already being exploited. AWS published a bulletin on 28 October. Lambda base runtimes, CodeBuild curated images, App Runner's Node.js, and Elastic Beanstalk are patched. There's a good explainer here, and detection advice here.

Nine AI developer platforms disclosed security incidents in October, which Benjamin Read and Rami McCarthy are calling Black October. Fireworks AI, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode, Northflank and Andromeda. Two leaked enterprise keys got traced to ~800k and ~1.7M Bedrock calls between them, over $100k combined at retail Bedrock pricing. The malicious Claude Code extension that hit the Cursor marketplace for about half a day didn't even make the article.

Cloud Village uploaded another batch of DEF CON 34 talks on 28 October. The ones with an AWS angle:

A little self-promotion to finish. A while back I started working on hackaws.cloud. It's finally live and taking signups. You give it a foothold in one of your AWS accounts and it will try to get from that to organization admin. If you were on the waitlist you can run it on 3 AWS accounts for free. If you didn't make it on the waitlist but want the deal, email me and I'll hook you up.

Sponsor shoutout Plerion

WorkflowMax went from zero to 80,000 users in four months, and its AWS security kept up. Manual alert reviews dropped about 40% and audit prep time halved. Read the WorkflowMax story or get a free assessment.

📋 Chef's selections

IAM Roles Anywhere with post-quantum cryptography

by Paul Schwarzenberger

Follow-up to Paul's open-source post-quantum CA, now plugged into IAM Roles Anywhere so a workload outside AWS can authenticate with a post-quantum cert and get a session back. He walks the full flow, from the cert, through AWS's Roles Anywhere Credential Helper, to the CloudTrail event that confirms it worked. Along the way he found that the signing helper only accepts one of the three key formats the standard allows. He filed the GitHub issue which I think is like the French writing a complaint letter.

aws-auth ConfigMap Deprecated: What EKS Teams Need Now

by Keegan Justis

If you've ever granted an IAM role access to an EKS cluster, you probably edited the aws-auth ConfigMap in kube-system. AWS is deprecating it in favour of EKS Access Entries, which live behind the EKS API instead. The practical difference is that every grant and revoke now shows up in CloudTrail, so your audit trail stops ending at "someone edited the YAML". You also get managed access policies (AmazonEKSClusterAdminPolicy and friends), and real IaC support.

No quarantine for Bedrock Mantle

by Daniel Grzelak

I took some subtle shots at people writing about the AWS quarantine policy in issue 283 since it's been so overdone. Now you can take your shots at me. The current policy denies a list of Bedrock actions but wasn't updated for the newer bedrock-mantle:* prefix. This post is a short exploration of that and why it's bad.

🥗 AWS security blogs

🍛 Reddit threads on r/aws

🤖 Dessert

Every machine-tracked change this week. Nobody else assembles this.

🧁 IAM permission changes

🍪 API changes

🍹 IAM managed policy changes

☕ CloudFormation resource changes

📺 AWS security bulletins

🚬 Security documentation changes

🎮 Amazon Linux vulnerabilities

Get every AWS security change,
on a plate every Monday.

6,700+ engineers, builders and CISOs let us diff the AWS changelog every week.