# Amazon Q CVEs, Hijacked npm and Go Packages, AWS WAF HTTP/2 Issues, Lambda MicroVMs, and Why Execution Is the Boundary Now

Page: https://stenobird.com/podcast/ship-it-weekly-devops-sre-platform-and-cloud-engineering-news-7591275/amazon-q-cves-hijacked-npm-and-go-packages-aws-waf-http-2-issues-lambda-microvms-and-why-execution-is-the-boundary-now
Text version: https://stenobird.com/podcast/ship-it-weekly-devops-sre-platform-and-cloud-engineering-news-7591275/amazon-q-cves-hijacked-npm-and-go-packages-aws-waf-http-2-issues-lambda-microvms-and-why-execution-is-the-boundary-now.md
Podcast: [Ship It Weekly - DevOps, SRE, Platform and Cloud Engineering News](https://stenobird.com/podcast/ship-it-weekly-devops-sre-platform-and-cloud-engineering-news-7591275)
Published: 2026-07-03T01:00:02+00:00
Episode link: https://rss.com/podcasts/ship-it-weekly/2960832
Audio file: https://content.rss.com/episodes/356364/2960832/ship-it-weekly/2026_07_02_23_29_05_26976129-6540-4d57-b3c9-f4cebc9be169.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/ship-it-weekly-devops-sre-platform-and-cloud-engineering-news-7591275/episodes/amazon-q-cves-hijacked-npm-and-go-packages-aws-waf-http-2-issues-lambda-microvms-and-why-execution-is-the-boundary-now
Duration seconds: 1086

## Resource

This week on Ship It Weekly : Amazon Q Developer and the AWS language servers had a pair of trust-boundary CVEs, JFrog found hijacked npm and Go packages using hidden VS Code tasks to run malware when a workspace opens, AWS WAF had HTTP/2 request-body inspection issues, and AWS introduced Lambda MicroVMs for running user-generated and AI-generated code in isolated sandboxes. The bigger theme: execution is the boundary now. The repo, the IDE, the AI assistant, the WAF, and the sandbox all sit at the point where something gets to run, inspect, block, or decide. Before execution, trust is a policy. After execution, trust is a blast radius. In the lightning round, Brian covers GitHub’s record advisory volume, Git 2.55, Valkey 9.1 on Amazon ElastiCache, and a quick Fable 5 callback now that Anthropic’s Fable 5 is back online. Links AWS security bulletin: Amazon Q / AWS language server CVEs https://aws.amazon.com/security/security-bulletins/2026-047-aws/ JFrog: Hijacked npm packages using VS Code tasks https://research.jfrog.com/post/hijacked-npm-vscode-tasks-blockchain/ AWS security bulletin: AWS WAF HTTP/2 inspection issues https://aws.amazon.com/security/security-bulletins/2026-048-aws/ AWS Lambda MicroVMs https://aws.amazon.com/blogs/aws/run-isolated-sandboxes-with-full-lifecycle-control-aws-lambda-introduces-microvms/ GitHub Advisory Database record volume https://github.blog/security/supply-chain-security/inside-the-advisory-database-and-what-happens-when-vulnerability-volume-breaks-records/ Git 2.55 highlights https://github.blog/open-source/git/highlights-from-git-2-55/ Amazon ElastiCache Valkey 9.1 https://aws.amazon.com/blogs/database/announcing-valkey-9-1-for-amazon-elasticache/ Claude Fable 5 and Mythos 5 model docs https://platform.claude.com/docs/en/about-claud…

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/ship-it-weekly-devops-sre-platform-and-cloud-engineering-news-7591275/episodes/amazon-q-cves-hijacked-npm-and-go-packages-aws-waf-http-2-issues-lambda-microvms-and-why-execution-is-the-boundary-now/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/ship-it-weekly-devops-sre-platform-and-cloud-engineering-news-7591275/amazon-q-cves-hijacked-npm-and-go-packages-aws-waf-http-2-issues-lambda-microvms-and-why-execution-is-the-boundary-now.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.