A few weeks ago I presented to a small group of commercial and technology leaders from Brazilian agribusiness at the AWS office in São Paulo. My talk ran through where generative AI fits across the different stages of an agribusiness operation, and the point I kept returning to is that the markets we call traditional are exactly the ones where keeping up with this technology decides who ends up ahead of the curve. Nobody there was arguing about whether AI belongs in agriculture. The questions were about delivery: who receives the output, in which language, on which device, often while driving between farms. That is why a launch I might otherwise have filed under routine leads my list this week. The Amazon Polly Generative engine upgrade added 14 new voices, two of them in Brazilian Portuguese. When your user has both hands on a steering wheel, the interface is a voice.

Presenting “GenAI no Agronegócio Brasileiro” at the AWS office in São Paulo.

The rest of the week had a sharper edge. The biggest launch is a security service built on the premise that the gap between a vulnerability being disclosed and a vulnerability being exploited has effectively closed, and AWS published the honeypot evidence for exactly that in the same week. Now, let’s get into this week’s AWS news…

AWS Continuum for code vulnerabilities is now generally available
AWS Continuum reframes vulnerability management as an end-to-end job rather than a scanner that hands you a list. It builds a context graph from your repositories and your AWS environment, assigns each finding an evidence level, and reproduces exploitable findings in an isolated sandbox with proof-of-concept code so you see the issue rather than a severity label. It ranks issues by how close the attack path runs to business-critical systems, then opens the fix as a pull request. The control boundary matters: every remediation currently requires human approval, so you review and merge the pull request, with autonomous classes of fix gated behind confidence thresholds for the future.

The “why now” came from AWS’s own honeypots in the same week. Amazon Threat Intelligence found a PHP2Shell exploitation attempt in MadPot telemetry dated October 17, four days before CVE-2026-109618 and CVE-2026-109619 were publicly disclosed, and on disclosure day proof-of-concept exploits were circulating around 02:00 UTC, roughly twelve hours before the embargo was due to lift at 14:00 UTC. The practical reading is direct: a patch window measured in days assumes a delay that no longer exists, and an investigation should start from the earliest known exploitation rather than from the disclosure date. AWS also published the AWS WAF mitigations for the same CVEs. Continuum is available in US East (N. Virginia) and US West (Oregon).

Introducing Amazon ECS Gateway
Amazon ECS Gateway splits the work of exposing a service between the people who own the network and the people who own the application. Platform teams define one gateway with the organization’s subnets, security groups, TLS certificates, listener settings, and AWS WAF web ACLs. Application teams opt in by adding a gateway connector to the service definition, and ECS gives them an ACM certificate, a unique DNS hostname, listener rules, a target group, and a security group that admits traffic only from the Application Load Balancer.

The numbers make the economics clear: up to 25 services share a single ALB, ECS provisions the first ALB on first connect and removes ALBs when they are no longer needed, and a gateway can associate with up to 10,000 clusters, with five gateways per cluster. You can adopt it incrementally with UpdateService while your existing load balancer stays in place. Amazon ECS Gateway is available in all commercial Regions where Amazon ECS is available, at no additional charge.

Last week’s launches
Here are some launches that caught my attention this week.

Amazon Polly delivers a major upgrade to its Generative engine – The Generative engine now runs a larger, more expressive catalog: 57 generative voices across 11 languages and 25 locales, with 14 new voices across 9 locales and Hindi and Finnish generally available for the first time. Two of the new voices are Brazilian Portuguese, Leo and Carolina. It is a drop-in upgrade, so the voice names, the same SynthesizeSpeech call, and the price all stay the same while the output gets more natural.

AWS announces TorchNeuron: native PyTorch support for AWS Trainium (public beta) – TorchNeuron is an open source PyTorch backend that lets you run your model on Trainium by switching to .to(‘neuron’), a configuration change instead of a rewrite, with eager execution and torch.compile intact. It integrates with the Neuron Kernel Interface for custom operators, and it works on Trainium2 and Trainium3 instances. If you want the bigger picture on why hardware choice should not lock in your software, the AWS Insights piece on that theme is a good companion read, and the release lands alongside AWS Neuron 2.33.

New ways to customize models with Amazon SageMaker AI, without managing GPUs – Training sessions are now generally available, giving you control of the post-training loop, including custom loss functions and reward signals, while SageMaker AI handles GPU allocation, distributed execution, fault recovery, and checkpoint storage. You pay for the tokens SageMaker AI processes, and the meter stops while your reward function scores a batch. There is a full technical walkthrough, the training session APIs, and new support for Muse Glimmer, Qwen 3.8, and Ministral 3.

Structured outputs for Claude models available on Amazon Bedrock – You can now get schema-compliant JSON back from any Anthropic Claude model on Amazon Bedrock, across both the bedrock-runtime and bedrock-mantle endpoints, without custom parsing, retry logic, or post-processing. That makes jobs like pulling every required field from a financial report, parsing clinical notes, or routing support tickets by intent far more reliable to automate.

Amazon ElastiCache Serverless for Valkey now supports online migration with zero downtime – You can migrate self-managed Valkey or Redis OSS on Amazon EC2 into ElastiCache Serverless with zero downtime, meaning zero errors returned to the client during the move, measured the way the ElastiCache SLA measures availability. You prepare the migration, start the data sync, then choose a manual or automatic cutover, with no third-party replication tools. It is available in all commercial Regions, the China Regions, and the AWS GovCloud (US) Regions.

Other AWS news
Here are some additional projects and posts that you might find interesting.

Discover tools at runtime with AWS Agent Registry – AWS Agent Registry is a managed catalog for MCP servers, agents, and agent skills, so an orchestrator can search approved capabilities at runtime instead of compiling every tool in at build time. This walkthrough shows the discover, instantiate, and execute loop in a working sample, with search results that return connection metadata but never invocation credentials.

Tokenomics for coding agents: benchmark cost and quality on your own code – Coding assistants replay a growing transcript on every turn, so their cost math is nothing like ordinary inference. This post gives you open source tooling to measure model, harness, and hosting choices on your own repositories and build a cost-and-quality frontier you own, with sample results where routing came out 44.7 percent cheaper for 4.8 percent lower mean quality.

How U.S. Bank migrated 119 TB from Oracle Exadata to Amazon RDS for Oracle – U.S. Bank moved four Oracle Exadata databases totaling about 119 TB to Amazon RDS for Oracle using a config-driven pipeline built on Oracle XTTS, AWS DataSync, and Amazon EFS. The initial baseline copy finished in about 7 days with zero data loss and cutovers averaging roughly four hours per database, over a bandwidth-capped Direct Connect link.

Upcoming AWS events
Mark your calendars for these upcoming events.

AWS re:Invent – AWS re:Invent runs November 30 to December 4 in Las Vegas, with more than 2,200 sessions. The session catalog is live and reserved seating is open, so now is the time to build your schedule.

AWS Community Days – AWS Community Day Brasil Norte takes place in Belém on October 31, closing out the 2026 Brazilian community season. Check the hub for events near you.

That’s all for this week. Check back next Monday for another Weekly Roundup!

– Daniel

This post is part of our Weekly Roundup series. Check back each week for a quick roundup of interesting news and announcements from AWS!

Nothing last week added a new kind of compute. What it did instead was shorten the distance between the code you already have and that code being live. AWS Lambda learned to run a plain HTTP server with no adapter in front of it, and Amazon S3 became something you can provision from inside the tool you were already using, without opening the AWS Management Console. Different services, same direction.

The counterweight arrived on Thursday. As it gets easier to put things into production, it matters more that you can say what those things are allowed to do, and this week’s most interesting read is about exactly that. Now, let’s get into this week’s AWS news…

Headlines
AWS Lambda Web Functions is a new form factor that runs a standard HTTP web application on Lambda without rewriting it into an event handler. You take a port-listening server built with Express, Hono, Fastify, or Next.js, run aws lambda-web deploy, and get back a live HTTPS URL in under a minute. No adapters, no infrastructure to set up first, no framework lock-in. Lambda now has three form factors on the same Firecracker isolation, which compose inside one application: Event Functions (the model you already know) for async work, Web Functions for the user-facing layer, and MicroVMs for stateful sandboxes running untrusted code.

Two details make this more than repackaging. Each execution environment handles up to 128 concurrent requests, so a burst of traffic shares warm environments instead of mapping one request to one environment, and billing meters the CPU time your code actually uses rather than wall-clock time. For server-side rendering, API backends, and inference endpoints streaming tokens, where most of the elapsed time is spent waiting, that changes the arithmetic. Adding --regions to the same deploy command replicates your code and configures latency-based routing behind a single global URL, and you can split traffic across revisions by weight for a canary rollout. It’s available in five Regions, running Node.js 24 on Arm64 with VPC connectivity. The AWS Compute Blog has a longer walkthrough, and Amazon CloudFront can now use a Web Function endpoint as an origin with origin access control.

The week’s other headline isn’t a launch. Trust in Depth: giving agents more autonomy without losing control makes an argument I keep running into in practice: putting a person in the loop for every agent action works at small scale and then quietly stops working, because people asked to check everything stop catching what matters. The alternative is four questions answered at four moments, which AWS calls scope, know, bound, and observe. The part worth sitting with is that an agent’s limits belong outside its own reasoning, in Amazon Bedrock AgentCore policies enforced at the gateway, because an agent cannot turn off a control it does not run. AWS has run automated reasoning in production for more than a decade, including AWS Identity and Access Management at more than 2.1 billion requests per second, and the case here is for pointing it at the rules you write for agents.

Last week’s launches
Here are some launches and updates from this past week that caught my attention:

• Amazon S3 is now available on the Vercel Marketplace and v0 by Vercel – You can now provision S3 general purpose buckets, S3 Tables, and S3 Vectors from the Vercel dashboard, or by describing what you want to build in v0. It joins existing integrations for Amazon Aurora, Amazon DynamoDB, and Amazon OpenSearch Serverless, so the whole stack sits in one AWS account with one bill. The authentication detail is the good part: a short-lived OIDC token is exchanged at runtime with AWS Security Token Service for credentials scoped to that resource, so no static keys are stored anywhere.
• Amazon EC2 T8i instances are now available in South America (São Paulo) – The newest burstable generation reached the São Paulo Region, which matters for the unglamorous half of a workload: login gateways, small databases, CI/CD runners, low-traffic sites. Amazon EC2 T8i delivers up to 30 percent better price performance than T3, with up to 70 percent higher compute performance and 2.4 times the Amazon EBS bandwidth. It keeps the same CPU credit system as T3, so moving over is a size change rather than a redesign, and t8i.micro and t8i.small are available under the AWS Free Tier.
• Reflection Beam, an open-weight model for agentic coding, is now on AWS – You can now deploy Beam, Reflection AI’s open-weight model for agentic coding and long-horizon tasks, from Amazon SageMaker JumpStart. It’s a sparse mixture-of-experts model with 501 billion total and 23 billion active parameters, released on Hugging Face under Apache 2.0, and Reflection reports an effective context length of 1 million tokens. Start with a JumpStart real-time endpoint, or use SageMaker HyperPod Inference with SGLang or vLLM when you need Kubernetes-native control. It was also ported and optimized for AWS Trainium3, and launches in N. Virginia and Ohio.
• AWS Lambda Durable Execution SDK for Go is now generally available – You can now write multi-step Go workflows that checkpoint their own progress and pause for up to a year while waiting on an external event, without building progress tracking yourself. That covers deployment rollouts with approval gates and pipelines that call a model and then stop for human review. It behaves like ordinary Go tooling: go get to add it, deploy a single static binary on the provided.al2023 runtime, and test a full workflow locally with the durabletest package, no network access or credentials required.
• Amazon CloudWatch announces log routing and chained log parsers – You can now define routes in an Amazon CloudWatch pipeline that send each event to a different log group based on conditions evaluated against processed fields, so severity, source, or event type can each land somewhere with its own retention and access controls. Chained parsers handle the other half: parsers run in sequence, with later ones consuming fields that earlier ones produced, so you can parse a JSON envelope first and then run a Grok parser over a field it extracted.

For a full list of AWS announcements, be sure to keep an eye on the What’s New with AWS page.

Other AWS news
Here are some additional posts and resources that you might find interesting:

• AWS Security Agent exploited 33 of 37 new real-world CVEs – The team pointed their autonomous penetration-testing agent, now part of AWS Continuum, at 37 recently disclosed CVEs packaged as live containerized targets, starting from nothing but an endpoint URL and a one-line hint. It captured 35 flags, and after auditing every win against the challenge’s canonical proof of concept, 33 of 37 (89.2 percent) held up as genuine end-to-end exploitation. The two misses are what make the post worth your time: in both, the agent found and exploited the bug, then took the target down before it could read the flag. A capable autonomous attacker is also a destructive one.
• Your serverless attendee’s guide to AWS re:Invent 2026 – A curated path through a very large catalog, worth having before the good sessions fill up.
• How Dynata scaled AI across the development lifecycle with AI-DLC and Kiro IDE – What changes when agentic coding stops being an individual habit and becomes how a team works.

Upcoming AWS events
Check your calendar and sign up for upcoming AWS events:

• AWS re:Invent – re:Invent returns to Las Vegas from November 30 to December 4, with more than 2,200 sessions. The event catalog is live and reserved seating is open, so register and claim your spots before they fill up.
• AWS Community Days – Community-led conferences planned and delivered by community leaders. Here in Brazil, the 2026 season closes with AWS Community Day Brasil Norte in Belém on October 31, the final stop in a year that covered every region of the country for the first time.

Join the AWS Builder Center to connect with builders, share solutions, and access content that supports your development. Browse here for upcoming AWS-led in-person and virtual events and developer-focused events.

That’s all for this week. Check back next Monday for another Weekly Roundup!

— Daniel Abib

This post is part of our Weekly Roundup series. Check back each week for a quick roundup of interesting news and announcements from AWS!