---
title: AWS AMI 2026-10-26
date: 2026-10-26T00:00:00.000Z
slug: ami-2026-10-26
tags:
  - release
  - ami
description: >-
  New EC2 scope AMIs (null-runtime-94 and null-runtime-arm-24) that stop
  trusting the compromised eMudhra intermediate CA.
canonical: 'https://docs.nullplatform.com/changelog/ami-2026-10-26'
---
The EC2 scope AMIs `null-runtime-94` (x86) and `null-runtime-arm-24` (arm64) stop trusting the compromised eMudhra intermediate CA.

:::warning Action required
Every container baked into the previous AMIs trusted the compromised eMudhra chain. Move your EC2 scopes to the new AMIs and redeploy them.
:::

## Highlights

- **eMudhra CA compromise.** Every image baked into the AMI now carries a CA bundle that rejects the compromised chain:
  - nginx (`np-nginx` 2.0.3)
  - the nullplatform agent, updated from 0.11.0 to 0.14.2
  - the Prometheus exporter, now on Node.js 24
- **Smaller attack surface.** The AMI no longer keeps the `aws-for-fluent-bit` image it only needed at build time, which shipped an unpatched CA bundle.

GPU AMIs were not rebuilt in this release.

## Upgrade

The AMIs are shared with your AWS account. Find them by name (`null-runtime-94` and `null-runtime-arm-24`), set their IDs in `ami.id` of your [EC2 provider](/docs/providers/supported-integrations/compute-management/ec2-configuration), and redeploy your scopes. Each scope keeps running the previous AMI until it's redeployed. To track that rollout, see [AMI drift detection](/docs/tutorials/ami-drift).