Rotate exposed secrets

Google fixed CVE-2026-12715 after an authenticated Firebase Studio user could potentially obtain signed URLs for another tenant's deployment source code.

Review pipeline identities

Google Cloud changed Cloud Build so GitLab Enterprise and Bitbucket Data Center connections validate Secret Manager access for the calling principal as well as the service agent.

Upgrade affected nodes

Google updated its guidance for CVE-2026-43284 and CVE-2026-43500, Linux kernel flaws that can enable privilege escalation on Container-Optimized OS and Ubuntu nodes.

Update plugins

AWS published fixes for CVE-2026-12957 and CVE-2026-12958 affecting Language Servers for AWS and Amazon Q Developer plugins.

Update container hosts

AWS issued guidance for five vulnerabilities in the containerd CRI plugin that may affect container platforms and host isolation.

Update Python SDK

AWS addressed CVE-2026-12530, improper neutralization of argument delimiters in the Bedrock AgentCore Python SDK install_packages function.

Track service updates

AWS updated its ongoing bulletin for the Copy.fail or DirtyFrag class of Linux kernel privilege-escalation issues, including CVE-2026-46300.

Update Kiro IDE

AWS fixed CVE-2026-11931, insecure file permissions on an authentication-token cache used by Kiro IDE.

Patch immediately

Cisco PSIRT reported limited exploitation of CVE-2026-20262, an arbitrary file-write vulnerability in Catalyst SD-WAN Manager, and urged customers to move to fixed releases.

Update dependencies

AWS published a fix for CVE-2026-12043, a heap double-free condition in the aws-c-http library used by AWS Common Runtime applications.

Update affected services

AWS addressed CVE-2026-10740, an excessive memory allocation issue in the s2n-quic implementation.

Update aws-cdk-lib

AWS fixed CVE-2026-11417, an operating-system command injection risk in aws-cdk-lib NodejsFunction bundling.

Upgrade affected versions

Fortinet published FG-IR-26-143 for CVE-2025-67862, a restricted CLI escape affecting supported FortiOS and FortiProxy branches.

Update affected meshes

CVE-2026-47774 allows an unauthenticated HTTP/2 client to drive excessive memory use in Envoy and potentially terminate the proxy process.

Update CLI

AWS addressed CVE-2026-11393, code injection caused by improper triple-quote escaping when AgentCore CLI imports a Bedrock agent.

Upgrade FortiSandbox

Fortinet disclosed CVE-2026-25089, a second-order operating-system command injection risk in FortiSandbox's start-VNC workflow.

Update immediately

Google's Chrome 149 stable-channel release included dozens of security fixes and identified CVE-2026-11645 as exploited in the wild.

Skills planning

ISACA analyzed how artificial intelligence is influencing the market value of security, audit, governance and risk certifications.

Review model sources

AWS security guidance highlights the need to update SageMaker SDK tooling and validate the origin and integrity of model artifacts before loading them into trusted environments.

Maintain rapid cadence

Google's Chrome 148 stable release delivered a large security-fix set, reinforcing the need for automatic deployment and restart compliance across browser fleets.