Skip to main content
All updates

AWS AMI 2026-10-26

The EC2 scope AMIs null-runtime-94 (x86) and null-runtime-arm-24 (arm64) stop trusting the compromised eMudhra intermediate CA.

Action required

Every container baked into the previous AMIs trusted the compromised eMudhra chain. Move your EC2 scopes to the new AMIs and redeploy them.

Highlights​

  • eMudhra CA compromise. Every image baked into the AMI now carries a CA bundle that rejects the compromised chain:
    • nginx (np-nginx 2.0.3)
    • the nullplatform agent, updated from 0.11.0 to 0.14.2
    • the Prometheus exporter, now on Node.js 24
  • Smaller attack surface. The AMI no longer keeps the aws-for-fluent-bit image it only needed at build time, which shipped an unpatched CA bundle.

GPU AMIs were not rebuilt in this release.

Upgrade​

The AMIs are shared with your AWS account. Find them by name (null-runtime-94 and null-runtime-arm-24), set their IDs in ami.id of your EC2 provider, and redeploy your scopes. Each scope keeps running the previous AMI until it's redeployed. To track that rollout, see AMI drift detection.