How 2 Missing Characters Nearly Compromised AWS

Wiz Research discovered a critical vulnerability named CodeBreach in AWS CodeBuild stemming from a two-character omission in a regex filter within the AWS JavaScript SDK; this flaw could have allowed attackers to infiltrate build environments, exfiltrate privileged credentials, and inject backdoors across AWS infrastructure. The issue was reported to AWS on August 25, 2025 and patched globally within 48 hours with no known exploitation; Wiz recommends safeguards such as requiring human approval for pull requests.