Update Kiro IDE

AWS fixed CVE-2026-11931, insecure file permissions on an authentication-token cache used by Kiro IDE.

Update dependencies

AWS published a fix for CVE-2026-12043, a heap double-free condition in the aws-c-http library used by AWS Common Runtime applications.

Update affected services

AWS addressed CVE-2026-10740, an excessive memory allocation issue in the s2n-quic implementation.

Update aws-cdk-lib

AWS fixed CVE-2026-11417, an operating-system command injection risk in aws-cdk-lib NodejsFunction bundling.

Upgrade affected versions

Fortinet published FG-IR-26-143 for CVE-2025-67862, a restricted CLI escape affecting supported FortiOS and FortiProxy branches.

Update affected meshes

CVE-2026-47774 allows an unauthenticated HTTP/2 client to drive excessive memory use in Envoy and potentially terminate the proxy process.

Upgrade FortiSandbox

Fortinet disclosed CVE-2026-25089, a second-order operating-system command injection risk in FortiSandbox's start-VNC workflow.

Maintain rapid cadence

Google's Chrome 148 stable release delivered a large security-fix set, reinforcing the need for automatic deployment and restart compliance across browser fleets.

Assess CAPWAP exposure

Fortinet published FG-IR-26-123 for CVE-2025-53844, an out-of-bounds vulnerability in CAPWAP processing across affected products.

Validate policies

Google Cloud disclosed CVE-2026-2264 in Apigee, where an unvalidated IntegrationRegion value could support server-side request forgery and service-account token exfiltration.

Patch container hosts

Google Cloud warned that CVE-2026-46300, known as Fragnesia, can let an unprivileged local attacker escalate to root on a Linux container host.

Confirm platform mitigation

Google Cloud reported infrastructure mitigations for CVE-2025-54518, an AMD Zen 2 micro-operation cache issue that could affect security boundaries or data access under specific conditions.

Review host firmware

Google Cloud described AMD firmware flaws that could allow a malicious hypervisor to execute code on the AMD Secure Processor and undermine SEV-SNP guest confidentiality and integrity.

Patch immediately

Fortinet rated CVE-2026-39813 critical after a path-traversal flaw in the FortiSandbox JRPC API could let an unauthenticated attacker bypass authentication and escalate privileges.

Update service version

Fortinet updated FG-IR-26-096 for CVE-2026-25836, an authenticated command injection in the vmimages update feature of FortiSandbox Cloud and PaaS.