Today, Amazon Quick offers new capabilities that make it easier to organize your work, govern it across an organization, and trust the answers it produces. These capabilities build on Amazon Quick across desktop and mobile, bringing enterprise-grade management, richer collaboration, and always-on intelligence to teams wherever they work.  Your agents no longer stop when you step away. Scheduled tasks and monitoring agents run in the cloud and deliver results to your feed even when your laptop is closed. A sharper activity feed adds top-level filters, an improved catch-up view, a daily briefing that refreshes three times a day, and search across up to seven days of feed data, so you see what needs you first. Administrators gain mobile device management support, custom per-user permissions, and Microsoft Purview data loss prevention integration. Teams can share files and publish agents and skills for others to discover and install, and browse a catalog of official skills. Quick spaces and Quick apps now run natively on the desktop, any indexed local folder can become a searchable space, and inline citations let you verify every answer against its source. Additionally, every Quick subscriber now gets more agent hours each month — Professional grows from 4 to 8 and Enterprise from 8 to 18 — combined into a single, simpler allotment.  New users can create an account for free and start using Quick in minutes.Or to learn more,  visit the Amazon Quick product page.

Today, Amazon Quick offers new capabilities that make it easier to organize your work, govern it across an organization, and trust the answers it produces. These capabilities build on Amazon Quick across desktop and mobile, bringing enterprise-grade management, richer collaboration, and always-on intelligence to teams wherever they work.  Your agents no longer stop when you step away. Scheduled tasks and monitoring agents run in the cloud and deliver results to your feed even when your laptop is closed. A sharper activity feed adds top-level filters, an improved catch-up view, a daily briefing that refreshes three times a day, and search across up to seven days of feed data, so you see what needs you first. Administrators gain mobile device management support, custom per-user permissions, and Microsoft Purview data loss prevention integration. Teams can share files and publish agents and skills for others to discover and install, and browse a catalog of official skills. Quick spaces and Quick apps now run natively on the desktop, any indexed local folder can become a searchable space, and inline citations let you verify every answer against its source. Additionally, every Quick subscriber now gets more agent hours each month — Professional grows from 4 to 8 and Enterprise from 8 to 18 — combined into a single, simpler allotment.  New users can https://aws.amazon.com/quick/download/ and start using Quick in minutes.Or to learn more,  visit the https://aws.com/quick

AWS announces the CheckIngestedDocumentAcl and GetIngestedDocumentAcl APIs for Amazon Bedrock Managed Knowledge Base, giving customers a self-service way to debug document access issues and audit document-level permissions. When a user doesn't see an expected document in retrieval results for ACL-enabled data sources, it can be difficult to determine whether the cause is an access control misconfiguration or something else entirely. These new APIs and the accompanying console experience close that gap, enabling you to quickly diagnose and resolve permission issues without opening a support case. CheckIngestedDocumentAcl lets you verify whether a specific user has access to a given ingested document, while GetIngestedDocumentAcl returns the full ACL attached to a document so you can audit exactly what permissions are configured and catch misconfigurations. The console also introduces a new Document Access Control section on the data source details page, where you can check access by entering a document ID and user email or retrieve a document's full ACL by document ID. Together, these capabilities give administrators the visibility they need to manage access control at scale across enterprise knowledge bases. To learn more, see CheckIngestedDocumentAcl and GetIngestedDocumentAcl in the Amazon Bedrock API Reference. For more information about Amazon Bedrock Managed Knowledge Base, visit the Amazon Bedrock Knowledge Bases product page.

AWS announces the CheckIngestedDocumentAcl and GetIngestedDocumentAcl APIs for Amazon Bedrock Managed Knowledge Base, giving customers a self-service way to debug document access issues and audit document-level permissions. When a user doesn't see an expected document in retrieval results for ACL-enabled data sources, it can be difficult to determine whether the cause is an access control misconfiguration or something else entirely. These new APIs and the accompanying console experience close that gap, enabling you to quickly diagnose and resolve permission issues without opening a support case. CheckIngestedDocumentAcl lets you verify whether a specific user has access to a given ingested document, while GetIngestedDocumentAcl returns the full ACL attached to a document so you can audit exactly what permissions are configured and catch misconfigurations. The console also introduces a new Document Access Control section on the data source details page, where you can check access by entering a document ID and user email or retrieve a document's full ACL by document ID. Together, these capabilities give administrators the visibility they need to manage access control at scale across enterprise knowledge bases. To learn more, see https://docs.aws.amazon.com/bedrock/latest/APIReference/API_agent-runtime_CheckIngestedDocumentAcl.html and https://docs.aws.amazon.com/bedrock/latest/APIReference/API_agent-runtime_GetIngestedDocumentAcl.html in the Amazon Bedrock API Reference. For more information about Amazon Bedrock Managed Knowledge Base, visit the https://aws.amazon.com/bedrock/knowledge-bases/.

    AWS Console-to-Code adds 26 services and cross-region recording​ 0 views Eyal Estrin unread, 7:24 AM (10 minutes ago)    to https://aws.amazon.com/about-aws/whats-new/2026/08/console-to-code-adds-26-services/ https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/console-to-code.html Eyal Estrin Author | Cloud Architect | AWS • Azure • GCP Insights Social: @eyalestrin Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com Reply all Reply to author Forward

17 comments ### Transcript: - Have you heard the exciting news yet? Amazon Q has its own extension in the Visual Studio Code Marketplace. Whether you're tackling a new code base, debugging, or just speeding up your daily tasks, Amazon Q Developer is here to boost your productivity with features like

Unexpected AWS charges are usually traceable to forgotten resources, but AWS FinOps Agent, Amazon Q and AWS Support can help when the source of the billing anomaly is not obvious.

Researchers at Wiz disclosed a high-severity flaw in the Amazon Q Developer extension for Visual Studio Code that could let attackers steal developers’ cloud credentials by tricking them into opening a malicious repository. AWS has patched the issue as CVE-2026-12957, along with a related symbolic link flaw CVE-2026-12958, and released fixes...

A high-severity vulnerability in the Amazon Q Developer Extension for Visual Studio Code (VS Code), Amazon’s AI-powered coding assistant. Tracked as CVE-2026-12957 and CVE-2026-12958 and disclosed by Wiz Research, the flaws allowed attackers to achieve arbitrary code execution and cloud credential theft simply by having a developer open a malicious repository. The root cause was Amazon Q’s automatic loading of MCP (Model Context Protocol) server configurations from .amazonq/mcp.json workspace files without user consent or workspace trust verification. Combined with full environment inheritance by spawned processes, this created a dangerous attack chain. Amazon Q Vulnerability When a developer opened a compromised repository with Amazon Q active, the extension silently executed commands defined in the malicious config. Since spawned processes inherited the developer’s full environment, attackers gained immediate access to: AWS credentials ( AWS_ACCESS_KEY_ID , AWS_SECRET_ACCESS_KEY , AWS_SESSION_TOKEN ) Cloud CLI authentication tokens API keys and secrets SSH agent sockets A minimal proof-of-concept showed that a single malicious .amazonq/mcp.json file could exfiltrate active AWS session credentials to an attacker-controlled server — no clicks, no prompts, no warning. Two CVEs were assigned as part of this disclosure: CVE-2026-12957 — Improper trust boundary enforcement; MCP configs auto-executed without consent CVE-2026-12958 — Missing symlink validation allowing path traversal outside workspace boundaries The following product versions are affected: Product Affected Version Language Servers for AWS < 1.69.0 Amazon Q Developer for VS Code < 2.20 Amazon Q Developer for JetBrains < 4.3 Amazon Q Developer for Eclipse < 2.7.4 AWS Toolkit with Amazon Q for Visual Studio < 1.94.0.0 Attack Scenarios Beyond opportunistic exploitation, researchers highlighted several targeted attack vectors: Malicious pull requests to popular open-source repositories Typosquatted packages embedding hidden .amazonq/ configurations Fake job interview coding tests — a known tactic used by DPRK-linked threat actors — where candidates are asked to clone and run attacker-controlled repositories Amazon has patched both vulnerabilities in Language Servers for AWS version 1.69.0. The language server updates automatically for most users; reloading the IDE triggers the update. No action is required for users already on patched versions. Developers should take these precautions regardless: Update all Amazon Q Developer plugins to their latest versions immediately Treat unfamiliar or unverified repositories as untrusted Inspect .amazonq/ directories in cloned repositories for unexpected MCP configurations Carefully review Amazon Q’s new “Untrusted MCP Server” consent prompts before approving execution This vulnerability reflects a broader pattern across AI coding tools. Check Point Research independently identified CVE-2025-59536 and CVE-2026-21852 in Claude Code, and OX Security discovered CVE-2026-30615 in Windsurf — all rooted in the same auto-execution risk. MCP auto-execution without consent is now recognized as a systemic industry risk requiring coordinated attention. The vulnerability was discovered by Maor Dokhanian of Wiz Research and disclosed responsibly to Amazon on April 20, 2026. Amazon deployed the initial fix on May 12, 2026, with full public disclosure on June 26, 2026, under Security Bulletin 2026-047-AWS . What Features Should AI SOC Have? – Download Free 2026 AI SOC Features Checklist The post Amazon Q Vulnerability Let Attackers Execute Code and Access Sensitive Cloud Environments appeared first on Cyber Security News .

YouTube video by Pages&Beyong

ASKUL transitions to AWS when upgrading to SAP S/4HANA, migrating one of Japan’s largest collections of data and creating a platform for innovation with AI and data

Learn how Availity is driving generative AI innovation while increasing efficiency and security through the support of AWS experts.

Learn how Availity accelerates data analysis and operational efficiency using Amazon Q generative AI assistance.

Amazon endurece sus controles tras varias caídas internas y comerciales ligadas al código asistido por IA y reordena su cadena de revisión. Amazon ha decidido endurecer los controles sobre el software...

A thorough review of Amazon Q Developer - AWS's AI coding assistant with deep cloud integration, agent mode, and a generous free tier, tested against the competition.

    Amazon announces generative AI-based artifacts in Amazon Q Developer for visualizing resource and cost data 0 views Eyal Estrin unread, 2:51 AM (1 hour ago)    to https://aws.amazon.com/about-aws/whats-new/2026/02/generative-ai-based-Amazon-Q-artifacts/ https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/chat-artifacts.html Eyal Estrin Author | Cloud Architect | AWS • Azure • GCP Insights Social: @eyalestrin Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com Reply all Reply to author Forward

Webinar Wednesday, March 18, 2026 | 11am PT / 2pm ET Register Now Rapid adoption of Amazon Q Developer is driving unprecedented developer velocity, but organizations must address scalability and…