Skip to main content
All updates

AWS AMI 2026-04-01

The EC2 scope AMIs null-runtime-83 (x86) and null-runtime-arm-14 (arm64) patch snapd and the Prometheus exporter, and remove the vulnerable SSM agent from running instances.

Action required

Instances launched from these AMIs remove snapd and the snap-based SSM agent on first boot, so SSM Session Manager access to the instance is no longer available. If you rely on it, stay on the previous AMIs and move straight to AWS AMI 2026-06-18, which brings SSM access back.

Fixes​

  • snapd. Upgraded to the patched version for CVE-2026-3888 (local privilege escalation).
  • SSM agent. The snap-based SSM agent embeds a Go runtime affected by CVE-2025-68121 (critical) and several high Go standard library CVEs. Instances now remove snapd and that agent the first time they boot.
  • Prometheus exporter. Rebuilt on an updated Node.js 20 Alpine base image, which fixes vulnerabilities in its bundled npm dependencies (cross-spawn, glob, minimatch, path-to-regexp and tar).

Upgrade​

The AMIs are shared with your AWS account. Find them by name (null-runtime-83 and null-runtime-arm-14), set their IDs in ami.id of your EC2 provider, and redeploy your scopes. Each scope keeps running the previous AMI until it's redeployed. To track that rollout, see AMI drift detection.