AWS
CompanySecurity timeline
- Advisory or policy news by The Register (all)Amazon memo on AI use in engineering draws scepticism over mixed messages and token-usage metrics
- Vulnerability reported by AWS Security BulletinsFreeRTOS-Kernel queue-set flaw lets unprivileged tasks trigger privileged out-of-bounds write (CVE-2026-119086)
- Vulnerability reported by NCSC (UK)Critical PHP flaws CVE-2026-109618 and CVE-2026-109619 now exploited in the wild
Recent news
Amazon memo on AI use in engineering draws scepticism over mixed messages and token-usage metrics
An Amazon memo by a Distinguished Engineer says engineers who find AI does not help their work should document it as a finding, not a failing. The columnist argues the memo contradicts itself on input metrics and warns that token-usage targets, like Amazon's shut-down KiroRank leaderboard, can be gamed, while AWS earns revenue from token billing.
FreeRTOS-Kernel queue-set flaw lets unprivileged tasks trigger privileged out-of-bounds write (CVE-2026-119086)
AWS has disclosed CVE-2026-119086, a missing type validation issue in xQueueSelectFromSet in FreeRTOS-Kernel. On MPU-enabled builds with queue sets enabled, an unprivileged task can make the kernel write beyond the intended destination while running in a privileged context, affecting the integrity of privileged execution. Builds without queue sets are not affected.
Critical PHP flaws CVE-2026-109618 and CVE-2026-109619 now exploited in the wild
Two memory-corruption flaws in PHP, CVE-2026-109618 (out-of-memory handling) and CVE-2026-109619 (use-after-free in global state), allow unauthenticated remote code execution via crafted HTTP requests, with the risk greatest for Apache modphp. CISA added both to its Known Exploited Vulnerabilities catalogue on 26 October 2026, and AWS advises upgrading rather than relying on configuration changes alone.