Amazon
CompanySecurity timeline
- Advisory or policy news by The Register (all)Amazon memo on AI use in engineering draws scepticism over mixed messages and token-usage metrics
- Vulnerability reported by AWS Security BulletinsFreeRTOS-Kernel queue-set flaw lets unprivileged tasks trigger privileged out-of-bounds write (CVE-2026-119086)
Recent news
Amazon memo on AI use in engineering draws scepticism over mixed messages and token-usage metrics
An Amazon memo by a Distinguished Engineer says engineers who find AI does not help their work should document it as a finding, not a failing. The columnist argues the memo contradicts itself on input metrics and warns that token-usage targets, like Amazon's shut-down KiroRank leaderboard, can be gamed, while AWS earns revenue from token billing.
FreeRTOS-Kernel queue-set flaw lets unprivileged tasks trigger privileged out-of-bounds write (CVE-2026-119086)
AWS has disclosed CVE-2026-119086, a missing type validation issue in xQueueSelectFromSet in FreeRTOS-Kernel. On MPU-enabled builds with queue sets enabled, an unprivileged task can make the kernel write beyond the intended destination while running in a privileged context, affecting the integrity of privileged execution. Builds without queue sets are not affected.
Criminals exploit ebook downloads with malware, fake search pages and phishing
Kaspersky describes how attackers target ebook readers through pirate sites that deliver malware disguised as books, including a miner and infostealers hidden in fake PDFs. Search spam pages, fake Goodreads and Orell Füssli adverts, and clones of pirate libraries such as Z-Library are used to harvest card details and credentials. The article also notes a 2024 Z-Library clone leak of about 10 million user records and a 2025 Kindle vulnerability that could allow account hijacking.
Cheap Android car head unit found loaded with bloatware and spyware-like apps
A Civic owner bought a low-cost aftermarket Android head unit from Amazon and used Claude to analyse its firmware, as might be done with a smart TV. The unit shipped with a voice assistant using WebView that reportedly consumed about a third of processing power while idle, Baidu location services, a call recorder, a DAB radio client and Adobe Acrobat. Schneier notes that this illustrates the insecurity of IoT software and that AI is lowering the barrier to reverse engineering.