OpenSearch

And at the time this was happening, I was really struggling with a new technology.

I was once again bashing my head off of OpenSearch and Lucene and all of this, you know, architecture in the Elk stack.

And I was just bum fuzzled about you know what was going on and and and i thought oh god like maybe i'm not ever going to get this and of course no i mean like you know i i sort of bowled through it and and it started to make sense after a while but oh my god yeah like the self-doubt i'm like oh yeah and it's funny you know the the facing your dragons talk that you referenced in the beginning was exactly about this right it was it was that battle that you have with your own self-doubt you know One of the points I make in that talk is, you know, the more you do it, the more confidence you have that you're going to eventually get a solution, right? So you start with small challenges and you work your way up.

But yeah, I mean, that self-doubt never goes away.

When misconfigured, this is a terrific new opportunity for your data to get exfiltrated, so don't do that.

How to migrate from CloudSearch to OpenSearch Serverless.

Uh, note how it's not actually canceling CloudSearch, but the embedded video in the page prominently features a decades-old AWS logo.

Yeah, I'm serious.

This is the creation story of Neverblink AI.

Neverblink is a platform that is always vigilant and looking at your databases, mostly production databases, so transactional processing databases like Postgres and analytics databases or search engines like Elasticsearch, OpenSearch, Clickhouse.

It looks at those databases and makes sure they are reliable and highly performant at all times.

So we started building that out of the consulting company that we had, where we got called so many times to help with putting out fires of real estate listing company like Craigslist that suddenly had their search engine not responding.

They really get databases working hard.

And maybe even more importantly, it's not something you can plan for a lot of times because agentic workflows are non-deterministic.

So what we're doing now, we are taking the platform that we've built, we're taking the modus operandi that we have for how to manage and maintain databases at scale, and we apply what we did with Never Blink for OpenSearch and Elasticsearch for additional database technologies.

We just launched ClickHouse support.

14 items on the board today.

One, in the OpenSearch SQL plugin, an account with nothing but read access can run code on the server by handing the SQL endpoint a doctored pagination parameter.

upgrade the self-managed plugin to 2.19.6 or 3.7 the managed amazon service is fixed through the service software update two an attacker took over the internet path to soft oculus over the weekend and hosting companies that asked for a virtualizer update got the attacker's files instead it installed without complaint because the updater never checked for signatures Look for a systemd unit called java.jre.update. And if it's there, contact Virtualizer rather than deleting it and then update to 3.2.9.9. Three, a phone call is what got somebody into McKesson.

Voice phishing against employees produced Okta logins.

Then comes the Neptune Federated Query Connector, a Lambda function you adopted from a repo and now own forever like an incontinent chihuahua, whatever the word managed implied at adoption time.

Stored XSS via an imported OpenSearch dashboards template means the tool you installed to watch for attackers will cheerfully host one instead.

My favorite is the strands agent consent bypass where the human in the loop guard rail and an arbitrary Python REPL turns out to be a polite suggestion, which is awkward given the SDK already ships a supported environment variable for skipping it.

Capping the set, ZipSlip in the AWS DAC diagram tool resurrects a 2018 bug class in a 2026 utility that draws your architecture and, fed the wrong archive, redraws your file system too.

August has been a productive month for the AWS Security Bulletin RSS feed, which remains a security notification channel of record here in 2026, apparently.

The run opened with a resource exhaustion bug in an OpenSearch dashboards route, uh, that most operators didn't know existed, then moved on to a pair of CVEs in Ion Java, a serialization library that turns up in your dependency tree like an uninvited cousin because some SDK dragged it in on your behalf.

Memory amplification denial of service is the only AWS feature that scales your consumption without a pricing page.

Uh, next came the Athena ClickHouse Federated Connector, where the federation covers your queries and stops well short of your patching, leaving you to redeploy Lambda stacks in regions you'd forgotten you had.