AWS Security Digest #256 - TY Mythos
AWS inadvertently pushed a test IAM managed policy into production, a slip caught by IAM Trail. The incident coincides with the first Mythos‑reported vulnerability appearing in AWS security bulletin 2026‑015, highlighting AI‑driven code‑scanning efforts under Project Glasswing. Research disclosed critical flaws in the Bedrock AgentCore sandbox—allowing DNS exfiltration and “Agent God Mode” IAM escalation—and the notyet tool that leverages a four‑second IAM key‑revocation lag to spawn fresh identities. Amazon Linux 2023 also received updates addressing more than thirty high‑severity CVEs.
AWS Security Digest #250 - Objects
AWS’s me‑central‑1 availability zone suffered a fire caused by stray objects, knocking EC2 APIs offline for several hours. The digest also highlights a wave of new AWS security features, including EventBridge notifications for Network Firewall, persistent RAM share handling, an...
AWS Security Digest #248 - MCPs Denied
AWS introduced new IAM condition keys that specifically target requests routed through Managed Control Plane (MCP) servers, allowing administrators to deny actions taken via that path. The feature is designed to mitigate risks posed by AI agents that programmatically call...
