On October 21, 2026, PHP maintainers pushed out urgent patches for two critical flaws, nicknamed PHP2Shell together, that let an attacker run code on a server without logging in. Both carry a CVSS v4.0 score of 9.2 and sit in how PHP processes multipart file-upload requests before application code even runs. Patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and AWS has since published AWS WAFv2 rule templates plus host-level settings that shrink the attack surface for teams that need time to roll out the upgrade. AWS is clear that the firewall rules only help at the edge — they cannot fully close one of the two bugs, so patching remains mandatory.
Amazon's MadPot honeypot network recorded an exploitation attempt against what is now tracked as CVE-2026-109618 and CVE-2026-109619 — nicknamed PHP2Shell — on October 17, 2026, four days before the vendor publicly disclosed the flaw. The request came from a commercial anonymization network, suggesting a threat actor had working exploit code ahead of the official embargo lift. When the embargo ended on October 21 at 1400 UTC, AWS says proof-of-concept code and real attack traffic hit its sensors within hours, from several distinct sets of infrastructure. AWS argues this points to a structural shift: AI-assisted analysis is making it faster to turn a patch or advisory into a working exploit, shrinking the old assumption that most attacks follow a public PoC.
AI research company i14 partnered with AWS to port its Laplace 3B model, a 24-layer architecture built on Gated Linear Attention (GLA) instead of standard transformer attention, onto AWS Trainium2 using native PyTorch (TorchNeuron Native). Rather than a KV cache that expands with every token, the model keeps a constant 29.5 MB recurrent state per sequence. On a single trn2.48xlarge instance, the team reached about 120,000 training tokens per second and served 11,544 output tokens per second across 1,280 simultaneous sequences through an unmodified vLLM engine.
CISA has confirmed real-world exploitation of six vulnerabilities and placed them on its Known Exploited Vulnerabilities Catalog. Four of the six hit Plex Media Server, covering two SSRF bugs, a URI-scheme handling flaw and a file-path control issue; the remaining two are an OS command injection in EG Secure Solutions SiteGuard Server Edition and an uncontrolled search path flaw in Siemens Software Center. Because the flaws are already being exploited, Binding Operational Directive 26-04 forces federal civilian agencies to fast-track fixes on any exposed system that could hand attackers full control, and to check for prior compromise first.
A joint advisory from the FBI, CISA, USSS and European law-enforcement agencies details the SafePay ransomware group, active since August 2024 and responsible for at least 600 attacks across North America, South America, Europe and Australia. SafePay gains access via stolen/brute-forced credentials, phishing, and exploitation of known VPN and edge-device vulnerabilities, then uses legitimate admin tools to move laterally, disable defenses, exfiltrate data and encrypt files with a ChaCha20/RSA hybrid scheme before demanding ransom.
AWS introduced Agent Registry, a managed catalog service for Model Context Protocol (MCP) servers, agents, and agent skills. Instead of hardcoding every tool into an orchestrator, agents can now search an approved, versioned catalog at runtime and build a client from the returned descriptor. A reference sample demonstrates a Discover → Instantiate → Execute loop using Amazon Bedrock AgentCore Gateway and AgentCore runtime, with Anthropic Claude Sonnet as the foundation model.
AWS and Keyfactor published a reference design that fixes a known weak point in Model Context Protocol (MCP) deployments: MCP has no built-in way to authenticate which agent is actually making a request. The architecture adds three trust layers — user-to-system, agent-to-agent, and agent-to-tool-server — built on signed request envelopes, delegation assertions signed by the user, RFC 8693 audience-restricted tokens, and live OCSP revocation checks. A working example runs on Amazon Bedrock and the AWS Strands Agents SDK with Keyfactor EJBCA issuing and validating the X.509 certificates, and the full code is on GitHub.
AWS has rolled out structured outputs across every Anthropic Claude model hosted on Amazon Bedrock, reaching both the standard runtime endpoint and the newer Mantle endpoint built for agentic workloads. Instead of hoping the model returns valid JSON, developers can now lock responses to an exact schema through constrained decoding, which blocks the model from generating tokens that would break the format. A companion feature, strict tool use, applies the same guarantee to function-calling arguments so agent workflows don't fail on malformed inputs.
AWS and Deepgram jointly rebuilt the Nova-3 speech-to-text model to run natively on Trainium2 chips instead of standard GPU-based PyTorch setups, targeting large offline transcription jobs. The work involved rewriting bottleneck layers as custom kernels and replacing Deepgram's Python serving layer with a Rust runtime calling Trainium directly. The result: a single trn2.3xlarge instance running eight parallel model copies delivers 11-70% more transcribed audio per dollar than Deepgram's prior infrastructure, with similar savings potentially available to customers self-hosting on SageMaker.
AWS released a push-based NIXL connector for vLLM that changes how key-value (KV) cache data moves between prefill and decode instances in disaggregated LLM serving. Instead of the decode instance pulling KV blocks after prefill finishes, the decode instance registers its target memory in advance and the prefill instance writes the KV data directly once ready, moving coordination work off the critical path. Benchmarked on a 1-prefill/1-decode Qwen3-32B deployment using EC2 P5en instances with EFA, push mode delivered up to 3x better time-to-first-token (TTFT) and up to 30% better time-per-output-token (TPOT) than the default pull mode, especially under high request rates.
AWS tested its AWS Security Agent (now part of AWS Continuum) against a freshly built benchmark of 37 real, recently disclosed CVEs, each run as a live containerized target with a hidden flag. Starting from a low-privilege endpoint with only a one-line hint and no proof-of-concept, the agent, running on Claude Opus 5, captured 33 of 37 flags through genuine end-to-end exploitation after an integrity audit, with 2 captures reclassified as unintended-path solves and 2 genuine misses where the agent broke the target before extracting the flag. AWS built this benchmark to avoid the contamination problem of public CVE suites, which models may have memorized from training data.
AWS published a governance framework called Trust in Depth, designed to let AI agents operate with more autonomy while staying within enforceable limits. It combines scoping agent permissions before deployment, giving each agent a verifiable identity, enforcing boundaries at runtime via policy gateways, and observing agent behavior afterward. The framework leans on automated reasoning (mathematical proof) for rules that can be precisely defined, and human judgment for ambiguous cases, using AWS tools like Bedrock AgentCore, Guardrails, Kiro, Strands, Agent Registry and CloudWatch Omni.