About this episode

The episode discusses recent security vulnerabilities in AWS and package management systems, highlighting the importance of execution boundaries in modern software development.

This week on Ship It Weekly : Amazon Q Developer and the AWS language servers had a pair of trust-boundary CVEs, JFrog found hijacked npm and Go packages using hidden VS Code tasks to run malware when a workspace opens, AWS WAF had HTTP/2 request-body inspection issues, and AWS introduced Lambda MicroVMs for running user-generated and AI-generated code in isolated sandboxes. The bigger theme: execution is the boundary now. The repo, the IDE, the AI assistant, the WAF, and the sandbox all sit at the point where something gets to run, inspect, block, or decide. Before execution, trust is a policy. After execution, trust is a blast radius. In the lightning round, Brian covers GitHub’s record advisory volume, Git 2.55, Valkey 9.1 on Amazon ElastiCache, and a quick Fable 5 callback now that Anthropic’s Fable 5 is back online. Links AWS security bulletin: Amazon Q / AWS language server CVEs https://aws.amazon.com/security/security-bulletins/2026-047-aws/ JFrog: Hijacked npm packages using VS Code tasks https://research.jfrog.com/post/hijacked-npm-vscode-tasks-blockchain/ AWS security bulletin: AWS WAF HTTP/2 inspection issues…

Topics covered

• security vulnerabilities
• package management
• cloud computing
• DevOps
• isolated environments
• execution boundaries

Keywords

• CVE
• AWS WAF
• Lambda MicroVMs
• hijacked packages
• execution boundary
• trust policy
• malware

Mentioned in this episode

Organizations: Amazon Q, AWS, JFrog, GitHub, Anthropic

Products: npm, Go, VS Code, Git, Valkey, Fable 5

More episodes of Ship It Weekly - DevOps, SRE, Platform and Cloud Engineering News

• Ship It Conversations: Mat Ryer of Grafana Labs on AI Observability, Agents, Evals, and Operating AI in Production · July 19, 2026 · 45 min
• GitHub API Enumeration, Grok Build CLI Data Exposure, AWS Security Hub Network Scanning, AI-Powered Patch Pressure, and Why Visibility Is Not Ownership · July 17, 2026 · 19 min
• EKS Rollbacks, GitHub Actions Supply Chain Attacks, AI Agentjacking, CloudWatch Log Alarms, and Why Safety Nets Don’t Replace Ownership · July 10, 2026 · 19 min
• Ship It Conversations: Evan Phoenix of Miren on Deployment Pain, Terraform, Waypoint, and Better Defaults for Small Teams · July 6, 2026 · 42 min
• Ship It Conversations: Kat Traxler of Vectra AI on AI Security, the Zero-Day Clock, IAM, and Cloud Risk · June 28, 2026 · 43 min
• containerd CRI Vulnerabilities, Datadog PostgreSQL HA on Kubernetes, AWS DevOps Agent with Datadog MCP Server, EKS Control Plane Egress, and Why Users Feel the Wait · June 25, 2026 · 19 min

Explore listener stats, chart rankings, contacts and more on the Ship It Weekly - DevOps, SRE, Platform and Cloud Engineering News podcast page.