AWS
Security incidents tagged AWS. Newest first.
4 AWS incidents in the last 12 months
- Incidents
- 6
- Live
- 3
- Patched
- 6
- Days without an incident
- 2
- Longest quiet run: 499 days (Oct 11–Feb 20)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
- LivePatchedPatch now
AWS Babelfish for Aurora PostgreSQL TDS parser issues (CVE-2026-119923, CVE-2026-119924)
On Nov 6 2026 AWS published Important bulletin 2026-166-AWS for two memory-safety issues in the Babelfish TDS protocol layer used by Babelfish for Aurora PostgreSQL (SQL Server wire protocol). CVE-2026-119923: a memory-safety issue in the TDS connection-handshake handling could allow a remote, unauthenticated actor to affect the confidentiality, integrity, and availability of the database process. CVE-2026-119924: a memory-safety issue in the TDS remote-procedure-call request handling could allow a remote, authenticated actor to read adjacent process memory or cause a denial of service. AWS addressed the issues in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1, and lists patched Aurora PostgreSQL versions with Babelfish enabled. Workaround until upgraded: restrict network access to the TDS port (default 1433) to trusted sources using VPC security groups.
Babelfish for Aurora PostgreSQL / Babelfish for PostgreSQL extensionSince Nov 6, 2026
- LivePatchedPatch now
AWS Trusted Remote Execution (REX) setup-guide example SSM documents allow OS command injection (CVE-2026-122193)
On Nov 6 2026 AWS published Important bulletin 2026-173-AWS for CVE-2026-122193 (GHSA-95g5-m242-wvhr): an OS command injection issue in an example from the Trusted Remote Execution (REX) set-up documentation. The example script creates AWS Systems Manager documents Rex-RO and Rex-RW for running scripts on managed instances; due to how that example handled input parameters (including scriptArgs), a user permitted to invoke the SSM document could supply crafted input that runs unintended OS commands on the managed instance outside the REX sandbox. This is not a flaw in a shipped REX artifact — only operators who created those SSM documents by following the guide are affected. AWS removed the example from the guide. Mitigation: delete any Rex-RO / Rex-RW SSM documents created from the example in each account and Region where it was run. No workaround other than deleting the documents.
AWS Trusted Remote Execution (REX) set-up guide example SSM documents (Rex-RO / Rex-RW)Since Nov 6, 2026
- LivePatchedPatch now
Linux kernel CVE-2026-98432: TCP use-after-free rated 9.8, Anthropic says its AI built a remote root exploit
CVE-2026-98432 is a race-condition use-after-free in the Linux kernel's IPv4 TCP handshake code (ireq_opt/inet_opt freed without an RCU grace period), fixed upstream on Oct 15 and rated 9.8 by the kernel CNA. On Oct 28 Anthropic said an unreleased Claude model turned the bug into a zero-click remote root exploit against servers running a multipath TCP listener (about 48 minutes to defeat KASLR, five more to get a shell). The exploit was built in a lab and is not known to be used in attacks. Update to a fixed stable kernel.
Linux kernel (IPv4 TCP)Since Oct 15, 2026
Show 3 older incidents3 older incidents
February 2026 1
PatchedLexisNexis breach (FulcrumSec claims React2Shell path)Breaches
LexisNexis Legal & Professional (legacy systems / React frontend claim)
In March 2026 LexisNexis confirmed a breach of legacy servers exposing customer business contact and related data. Threat actor FulcrumSec claimed access via an unpatched React frontend “React2Shell” (CVE-2025-55182) into AWS infrastructure. LexisNexis said the matter was contained and mostly deprecated pre-2020 data.
Open incident →CVE-2025-55182
February 2025 1
- ClosedCriticalNo fix neededBreaches
Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea)
North Korean TraderTraitor/Lazarus hackers compromised a Safe{Wallet} developer's Mac, took over AWS session tokens and injected JavaScript into Safe's S3-hosted frontend. Bybit's signers approved what looked like a routine transfer but was a malicious transaction. It is the largest crypto theft on record; the FBI attributed it to North Korea.
Bybit cold wallet / Safe{Wallet} web UIClosed Mar 6, 2025
August 2023 1
- ClosedPatchedPatch now
HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)
Attackers abused HTTP/2 stream cancellation (open a request, reset it right away, repeat) to make servers do work at enormous rates. Peaks hit 398M req/s at Google, 201M at Cloudflare and 155M at AWS. Almost every HTTP/2 server and proxy needed a fix, including Node.js, Go, Java servers, .NET/IIS and nginx.
HTTP/2 protocol implementations (servers, proxies, CDNs)Closed Oct 10, 2023