Critical AWS Vulnerabilities Allow S3 Attack Bonanza

Aqua Security researchers disclosed six critical AWS vulnerabilities, including 'Bucket Monopoly' (predictable public AWS account IDs and S3 bucket naming) and 'Shadow Resources' (resource squatting across regions), which could enable remote code execution, data exfiltration, denial-of-service, or account takeover across services such as CloudFormation, CodeStar, EMR, Glue, SageMaker and Service Catalog; AWS issued mitigations between March and June, but open-source projects using predictable bucket names may remain at risk.