AWS News - 2026-10-22

Amazon Cognito multi-Region replication (MRR) now supports AWS GovCloud (US) Regions, extending the resilience benefits of MRR to more workloads. MRR lets you synchronize user and machine identity data, including credentials, user pool configurations, and federation setups, to a secondary user pool in a standby Region you designate, in near real-time. With user data in the standby Region, you can redirect traffic and keep authentication available if there is a disruption in your primary Region.

Previously, MRR was available in 16 commercial Regions. You can now also use MRR to replicate between additional AWS Regions, helping you meet resilience, data residency, and compliance requirements in the Regions that best align with your business needs.

MRR is available as an add-on for user pools in the Essentials or Plus feature tiers, and requires a multi-Region AWS KMS customer managed key (CMK). For the full list of AWS Regions where Amazon Cognito is available, see AWS Capabilities by Region. To get started, visit the developer guide for instructions and the pricing page for pricing details.

Today, AWS announced the expansion of 10 Gbps and 100 Gbps dedicated connections with MACsec encryption capabilities at the existing AWS Direct Connect location in the Equinix MA3 data center near Manchester, England. You can now establish private, direct network access to all public AWS Regions (except those in China), AWS GovCloud Regions, and AWS Local Zones from this location. This is the third AWS Direct Connect location in England to provide 100 Gbps connections with MACsec encryption capabilities.

The Direct Connect service enables you to establish a private, physical network connection between AWS and your data center, office, or colocation environment. These private connections can provide a more consistent network experience than those made over the public internet.

For more information on the over 150 Direct Connect locations worldwide, visit the locations section of the Direct Connect product detail pages. Or, visit our getting started page to learn more about how to purchase and deploy Direct Connect.

AWS is expanding programmatic service reference information to help you automate IAM policy management and keep your policies aligned with the latest service updates. The service reference now includes all aws:-prefixed global condition keys in a single machine-readable file, a ServiceName field mapping service identifiers to human-readable names, and an IsDataPlane property identifying which actions are data plane operations.

You can automate retrieval of this information to eliminate manual effort, and incorporate it directly into your existing policy management tools and processes. This feature is available at no additional cost. To get started, refer to the documentation on programmatic service reference information.

Migration assessments in AWS Transform now evaluate on-premises storage for migration to AWS. Instead of manually analyzing thousands of volumes across protocols, capacity, and performance, you upload a storage inventory and AWS Transform does the mapping for you. It matches each workload to the best-fit service, sizes the recommendation, and projects costs to produce a total cost of ownership business case. Bring NAS shares, SAN LUNs, direct-attached disks, or backup repositories via a NetApp Digital Advisor export, RVTools file, or other inventory. AWS Transform routes workloads across Amazon S3, Amazon EBS, Amazon EFS, and Amazon FSx (NetApp ONTAP, Windows File Server, OpenZFS, Lustre). Run what-if scenarios to compare deployment options such as Single-AZ vs. Multi-AZ or cost-optimized vs. performance-optimized, then ask follow-up questions about any result in chat.

Storage migration assessments are available in all AWS Regions where AWS Transform is available. To learn more, see the AWS Transform User Guide.

Amazon Quick is now available in the AWS Asia Pacific (Singapore) region (ap-southeast-1). This launch allows customers in Singapore to access the full power of Amazon Quick while meeting local requirements for data sovereignty.

Amazon Quick provides business users an agentic teammate that quickly answers questions at work and turns those answers into actions. With Amazon Quick, every user is empowered to make better decisions faster and take actions without switching applications using AI they can trust. Today’s launch allows customers to take advantage of Amazon Quick’s capabilities including AI-powered chat, Research, Spaces, and QuickSight dashboards — with their data stored and processed locally within the AWS Singapore region. 

For a full list of AWS regions where Amazon Quick is available, visit the Quick regional availability page. To learn more, visit the Amazon Quick documentation or product detail page.

AWS Lambda MicroVMs is now available in 4 additional AWS Regions: Asia Pacific (Hong Kong), Asia Pacific (Malaysia), Asia Pacific (Thailand), and Europe (Spain). With this launch, you can use Lambda MicroVMs in a total of 14 AWS Regions.

Lambda MicroVMs is a serverless compute primitive that provides VM-level isolation, near-instant launch and resume speeds, and state preservation for executing user or AI generated code.  Developers can use Lambda MicroVMs to give each user or job their own isolated compute environment without managing virtualization infrastructure or choosing between isolation, speed, and state retention. MicroVMs enable secure, stateful, and responsive code execution for applications including AI coding assistants, interactive development environments, and vulnerability scanners.

With today's launch, developers can run Lambda MicroVMs closer to their end-users in 4 additional Regions, helping meet latency and data residency requirements. To get started, create a MicroVM image from your Dockerfile, then launch MicroVMs from that image. Give each user or job their own MicroVM with a dedicated HTTPS URL that supports popular connectivity protocols such as HTTP/2, gRPC, and WebSockets. You can use MicroVMs through the AWS Lambda console, AWS CloudFormation, AWS Cloud Development Kit, or with your preferred Agentic development tools using the Agent Toolkit for AWS.

To learn more, visit the AWS Lambda MicroVMs developer guide. For information on pricing, see Lambda MicroVMs pricing. Visit the AWS Capabilities by Region page for the latest region availability.

Amazon Bedrock AgentCore Gateway now supports the Amazon Bedrock InvokeModel and InvokeModelWithResponseStream APIs on its inference endpoint, along with model fallback routing for inference traffic. With InvokeModel support, you can point your existing Amazon Bedrock SDK integration at the gateway and reach any model provider through one governed endpoint, without rewriting client code for each provider. With model fallback, the gateway automatically routes a request to an alternative model or provider when the primary destination is throttled, out of capacity, or unreachable, so your agents stay available without each client implementing its own retry logic.

For fallback routing, you define an ordered chain of alternative destinations in a gateway rule, along with the conditions that trigger a switch, such as throttling, server errors, or response timeouts. A built-in circuit breaker skips destinations that are currently failing, so requests reach a healthy destination faster and you avoid added latency for failed attempts. Fallback routing happens behind the scenes, which means you send one request and receive one response, regardless of the internal trial and error on a given request.

These features are available in all AWS Regions where Amazon Bedrock AgentCore Gateway is available (except those in China). To learn more, see the Amazon Bedrock AgentCore Gateway User Guide.

AWS launches AWS Interconnect - last mile preview with Megaport, a fully managed connectivity offering that allows customers to connect their branch offices, data centers, and remote locations to AWS with just a few clicks, eliminating the friction and complexity of network setup. As a milestone collaboration between AWS and Megaport, AWS Interconnect - last mile combines AWS cloud innovation with Megaport operating one of the world's largest Software Defined Networks (SDN), with 1,200+ enabled data centers across 31 countries.

Through the AWS Management Console, customers can now instantly establish private, high-speed connections to AWS by simply choosing their preferred AWS Region, bandwidth speed, Direct Connect Gateway ID and partner subscriber ID. Once initiated, AWS generates an activation key to complete connectivity provisioning with Megaport. The launch simplifies the connectivity experience by pre-provisioning capacity and automating complex network configuration including BGP peering, VLAN configuration, and ASN assignment. At GA, customers will also be able to dynamically scale bandwidth from 1 Gbps to 100 Gbps through the AWS Console. The service is designed for high availability, with zero down-time maintenance, backed by a 99.99% SLA. 

AWS Interconnect - last mile is available in the San Jose (us-west-1) and N. Virginia (us-east-1) metros through Megaport. You can create a preview Interconnect using the AWS Management Console, Command Line Interface (CLI), or API. Partners can also easily adopt via a published open API package on GitHub. For more information, see the AWS Interconnect - last mile documentation and pricing pages.

この記事では、AWS Security Incident Response を有効にして概念実証 (POC) を実施し、セキュリティ運用を迅速に強化する方法を説明します。まず、Amazon GuardDuty の検出結果と、AWS Security Hub でサードパーティ製ツールから取り込む一部の検出結果を自動でトリアージする仕組みを紹介します。次に、成功基準の設定、委任管理者やエスカレーションなどの構成の定義、デプロイの準備、コンソールでの有効化手順を順に解説します。さらに、初日からリアクティブ機能を活用し、疑わしいアクティビティがある場合は AWS がサポートするケースを作成して、AWS の専門家の支援を受けながら価値を最大化する方法も紹介します。

AWS Security Incident Response がインシデント対応ライフサイクルのあらゆる段階をどのように加速するのかを、ランサムウェアの可能性がある不審なアクティビティへの対応シナリオを通じて紹介します。Amazon GuardDuty や AWS Security Hub と統合した自動トリアージ、AWS Systems Manager による自動封じ込め、AWS Security Incident Response Engineering (SIRE) チームへのエスカレーション、インシデントケース ID を使ったタグ付けなど、検出から解決までの流れを解説します。あわせて、アラート疲れを軽減し、対応時間を短縮する方法も説明します。

ランサムウェアなどのサイバーセキュリティインシデントや自然災害に備え、公共部門の組織が AWS でワークロードを復旧できるよう準備するためのプロアクティブな戦略を紹介します。NIST CSF 2.0 や AWS Well-Architected フレームワークを踏まえ、マルチアカウント戦略と、Infrastructure as Code (IaC) によるインフラストラクチャ構築の自動化を解説します。さらに、AZ ID やマルチリージョンを活用した復旧用アカウントの準備、AWS Backup によるバックアップ、復旧用アカウントでの自動テストについても説明します。

AWS は、お客様のワークロードを対象としたネットワークスキャンのガイドラインを導入します。ネットワークスキャンは正当なセキュリティ目的にも、脅威アクターによる偵察にも使われ、両者を見分けるのは困難です。本記事では、セキュリティデータに利害を持つさまざまな関係者を整理します。そのうえで、ガイドラインに準拠したスキャナーが従うべき 4 つの原則 (観察のみ、識別可能、協調的、機密保持) と、準拠によって得られるメリットを紹介します。

Amazon Threat Intelligence は、MadPot のテレメトリから、CVE-2026-109618 と CVE-2026-109619 が公開される 4 日前の 2026 年 10 月 17 日に、PHP2Shell の悪用の試みを特定しました。本記事では、エンバーゴの限界を解説します。また、AI を活用した分析によって、パッチのリリースからエクスプロイト作成までの時間が短くなっている現状も取り上げます。さらに、時間単位でのパッチ適用やシグネチャに依存しない検出など、セキュリティリーダーが見直すべき前提を説明します。併せて、直ちに実施すべき推奨対策と侵害指標 (IOC) も紹介します。

PHP2Shell (CVE-2026-109618 および CVE-2026-109619) は、PHP コアランタイムに存在する認証不要の RCE 脆弱性です。完全な修正は PHP のアップグレードのみですが、本記事ではパッチ適用期間中に AWS WAF で露出を低減する方法を紹介します。セッションアップロード進捗フィールドや multipart リクエストのブロック、本文サイズの上限設定、レートベースのルールについて、AWS WAFv2 の JSON ルール例と Count モードから Block への段階的なデプロイ手順を解説します。また、AWS WAF による保護の限界と、補完するサーバー側の緩和策についても説明します。

Amazon EKS Auto Mode では、ノードに障害が起きても、誰かがノート PC を開くより先に、そのノードが自動的に検出され、ドレインされ、置き換えられます。この記事では、ノードモニタリングエージェントと Karpenter がデフォルトで連携して検出と置き換えのサイクルをどのように回すか、特定の障害がなぜノードの置き換えをトリガーするのか、そして SSH を使わずにノードの診断情報を収集する方法を説明します。

2026 年 10 月 13 日週に起きたことは、新しい種類のコンピュートを追加したわけではありません。代わり […]

プラットフォームチームが Amazon Elastic Container Service (Amazon E […]

Using temporary credentials is a security best practice to reduce the risk from credentials getting compromised. With AWS IAM Roles Anywhere, now your workloads outside of Amazon Web Services (AWS) will be able to access AWS resources by obtaining temporary security credentials in AWS Identity and Access Management (IAM). IAM Roles Anywhere relies on public […]

Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address […]

On October 21, 2026, the PHP project released emergency fixes for two critical remote code execution (RCE) vulnerabilities in the PHP core runtime, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively named PHP2Shell. Both are rated 9.2 (Critical) under CVSS v4.0, and both allow an unauthenticated attacker to run code on a vulnerable server. The fixed […]

Bulletin ID: 2026-142-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/21/2026 12:30 PM PDT

Description:

The Amazon SageMaker Python SDK is an open-source library for training and deploying machine learning models on Amazon SageMaker. We identified CVE-2026-112408, an issue in the default_bucket() function. The SDK uses a predictably named Amazon S3 bucket and does not check that the caller's AWS account owns it. A remote actor who creates that bucket first could achieve code execution in a remote SageMaker execution environment and obtain IAM credentials.

Impacted versions:
- V2: < 2.257.3
- V3: >= 3.0.0 and < 3.10.0

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Read the article

Bulletin ID: 2026-143-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/21/2026 14:30 PM PDT

Summary:

Two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) allow an unauthenticated remote actor to execute code, access process-accessible data, or cause denial of service on affected PHP workers. Customers running affected PHP versions (8.2–8.5 below the fixed releases, and end-of-life 5.4–8.1) should upgrade immediately to a patched release (8.5.12, 8.4.27, 8.3.36, or 8.2.35); configuration changes alone are not complete mitigations. AWS has identified a limited set of services that run affected PHP versions and is actively deploying mitigations and updates. Review the full bulletin for per-service status, mitigation guidance, and AWS WAF compensating controls.

Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Read this article

Learn how to combine deterministic orchestration with bounded agentic reasoning using AWS Step Functions and the Amazon Bedrock AgentCore harness. This medical coding workflow escalates cheapest-first: a safety block-list, then exact matching, then an AI agent only for terms that need judgment, keeping every routing decision auditable.

U.S. Hunger, a nonprofit addressing food insecurity, uses Amazon Quick to connect organizational data with leadership decisions. Leaders explore applicant data directly, share KPI definitions and financial context in Quick Spaces, and investigate policy questions with Quick Research.

Train Qwen3 on AWS Trainium with torchtitan three ways on a single trn2.48xlarge: the Hugging Face Transformers v5 modeling backend, torchtitan's native Qwen3, and NKI mixture-of-experts kernels. The same torchrun launcher and config structure work unchanged across all three paths, including loading and saving published Hugging Face safetensors.

The Adaptive Agentic Intelligence Framework (AAIF), built with Strands Agents, handles routine tasks locally with small language models and routes complex requests to cloud models through Amazon Bedrock. This post walks through building AAIF with local SLMs through Ollama and Amazon Bedrock, using an Internet of Things monitoring scenario.

Many teams build a multi-agent AI prototype in days but hit a wall in production. This post defines five production challenges (orchestration, per-agent model selection, reliable operation, secure code execution, and monitoring) and shows how Deep Insight, an open source multi-agent system on AWS, solves each.

Learn how to connect on-premises data sources to Amazon Quick privately with AWS PrivateLink, keeping analytics traffic off the public internet. This walkthrough covers VPC endpoints for user and API access, VPC connections for data sources, DNS and endpoint policies, identity federation, and enforcing VPC-endpoint-only access for compliance.