AWS Launches Continuum in 2 US Regions as Exploits Hit 4 Days Before CVE Disclosure
Updated
Updated · AWS Blog · Oct 26
AWS Launches Continuum in 2 US Regions as Exploits Hit 4 Days Before CVE Disclosure
2 articles · Updated · AWS Blog · Oct 26
Summary
AWS made Continuum for code vulnerabilities generally available in US East and US West, positioning it as an end-to-end remediation service rather than a scanner that only lists flaws.
October 17 honeypot data drove the launch: Amazon Threat Intelligence saw a PHP2Shell exploitation attempt four days before CVE-2026-109618 and CVE-2026-109619 were publicly disclosed, with proof-of-concept exploits circulating about 12 hours before embargo lift.
Continuum builds a context graph across repositories and AWS environments, reproduces exploitable findings in an isolated sandbox with proof-of-concept code, ranks issues by attack path to critical systems, and opens fixes as pull requests.
Human approval remains mandatory for every remediation, while AWS says future autonomous fixes would be gated by confidence thresholds; the company also published AWS WAF mitigations for the two CVEs.
The release reflects AWS's broader view that patch windows measured in days no longer hold, and that investigations should start from the earliest known exploitation rather than the public disclosure date.