---
title: AWS AMI 2026-04-01
date: 2026-04-01T00:00:00.000Z
slug: ami-2026-04-01
tags:
  - release
  - ami
description: >-
  New EC2 scope AMIs (null-runtime-83 and null-runtime-arm-14) that patch snapd
  and the Prometheus exporter, and remove the SSM agent on first boot.
canonical: 'https://docs.nullplatform.com/changelog/ami-2026-04-01'
---
The EC2 scope AMIs `null-runtime-83` (x86) and `null-runtime-arm-14` (arm64) patch snapd and the Prometheus exporter, and remove the vulnerable SSM agent from running instances.

:::warning Action required
Instances launched from these AMIs remove snapd and the snap-based SSM agent on first boot, so **SSM Session Manager access to the instance is no longer available**. If you rely on it, stay on the previous AMIs and move straight to [AWS AMI 2026-06-18](/changelog/ami-2026-06-18), which brings SSM access back.
:::

## Fixes

- **snapd.** Upgraded to the patched version for CVE-2026-3888 (local privilege escalation).
- **SSM agent.** The snap-based SSM agent embeds a Go runtime affected by CVE-2025-68121 (critical) and several high Go standard library CVEs. Instances now remove snapd and that agent the first time they boot.
- **Prometheus exporter.** Rebuilt on an updated Node.js 20 Alpine base image, which fixes vulnerabilities in its bundled npm dependencies (cross-spawn, glob, minimatch, path-to-regexp and tar).

## Upgrade

The AMIs are shared with your AWS account. Find them by name (`null-runtime-83` and `null-runtime-arm-14`), set their IDs in `ami.id` of your [EC2 provider](/docs/providers/supported-integrations/compute-management/ec2-configuration), and redeploy your scopes. Each scope keeps running the previous AMI until it's redeployed. To track that rollout, see [AMI drift detection](/docs/tutorials/ami-drift).