> and in none of the mentions is AWS vulnerable. Yep, that's because most bugs are found in legacy devices that are never found in production. The big exceptio

> and in none of the mentions is AWS vulnerable. Yep, that's because most bugs are found in legacy devices that are never found in production. The big exception was a buffer overflow in the floppy device emulation (the "VENOM" vulnerability). A lot of AWS security bulletins say "AWS customers' data and instances are not affected by these issues". I read it as "we knew about it a couple weeks in advance and have done a rolling upgrade". :)