AWS Security Bulletins
aws-security-bulletins · A · candidate
https://aws.amazon.com/security/security-bulletins/
Added 2026-11-03 (S1): AWS security bulletins with a dated RSS feed read direct; carried per-service fix status and interim measures for the Linux TCP use-after-free CVE-2026-98432 (Network Load Balancer, Global Accelerator, PrivateLink, EKS, Amazon Linux). A bulletin revised later does not move in the feed, so re-read the bulletin page for open items. Candidate: promote to active after 3 contributing runs.
Cited in 2 entries
Citation cadence
Citation days per ISO week (14 weeks of coverage span, total 2).
- CVE-2026-98432, Linux kernel IPv4 TCP: a use-after-free in connection setup, present since 4.4, has an Anthropic-built remote root exploit against MPTCP listeners that CloudLinux could not reproduce; Debian, CIQ and Amazon Linux kernels are fixed, Ubuntu's are in progress and Fortinet is investigating its products (CVSS 9.8)2026-10-31
- Amazon attributes the axios, debug and chalk npm compromises to a DPRK-linked cluster with medium confidence, and names a small 2025 package compromise as the rehearsal2026-07-30