service
Amazon GuardDuty: security advisories, deprecations and releases
Threat detection for AWS accounts and workloads.
- Items, 90 days
- 7
- Critical
- 0
- Last critical
- none
- This week
- 0
Security 1
- HIGH ACT BY 1 JUL 2025 AWS Security Digest · 2 Oct 2026
AWS Security Digest #279 - Ranted
Covers AgentCore Runtime GA, root shell exposure in AgentCore harness, CodeConnections over-permissioning, and new sign-up sandbox blocking GuardDuty while allowing public buckets.
Releases 5
- INFO AWS What's New · 19 Oct 2026
Amazon GuardDuty adds optional threat detection rules for Runtime Monitoring
GuardDuty now offers more than 50 optional runtime rules for EC2, EKS and ECS that detect suspicious process, file and network activity across 13 MITRE ATT&CK tactics.
- HIGH AWS Security Blog · 13 Oct 2026
GuardDuty Extended Threat Detection adds five new indicators
GuardDuty Extended Threat Detection now correlates signals from Inspector, Macie, Security Hub, and Reachability Analyzer into single critical-severity attack-sequence findings for EC2, ECS, and EKS.
- INFO AWS What's New · 9 Oct 2026
Amazon GuardDuty RDS Protection adds data exfiltration and destruction detection
GuardDuty now detects data exfil and destruction attacks on Aurora PostgreSQL and RDS PostgreSQL using ML-based anomaly detection without agents or config changes.
- INFO ACT BY 31 OCT 2026 AWS What's New · 2 Oct 2026
Amazon GuardDuty now supports centralized management using AWS Organizations declarative policies
GuardDuty now lets a delegated administrator set a single organization policy that enables threat detection across every account and Region, preventing drift and blocking local overrides.
- INFO AWS What's New · 2 Oct 2026
GuardDuty Runtime Monitoring now included in AWS Security Hub Threat Analytics plan
AWS now bills GuardDuty Runtime Monitoring through Security Hub, removing separate GuardDuty charges for EC2, EKS, and Fargate.
News and tools 1
- HIGH AWS Security Blog · 2 Oct 2026
Cross-service correlation guide for multi-stage attacks
Layer business context, data classification, and change windows on top of GuardDuty Extended Threat Detection to spot multi-stage attacks.
Only hear about Amazon GuardDuty when it touches your stack
Tell Zero what you run. You get one email, and only on the days something above applies to you.