Hello, stay ahead with CISO Brief 🚀

Every day the cybersecurity world moves fast — new incidents, evolving AI risks, changing regulations, and critical vendor updates. We cut through the noise to deliver only what matters most for your business and security strategy.

CISO Brief brings you a daily digest of high-signal news: major breaches, hyperscaler security releases, AI and compliance shifts, and the latest threat intelligence — all in one concise update.

Built for CISOs, CTOs, and architects, our goal is to save you time, reduce distraction, and keep you always on pulse with the risks and opportunities that shape tomorrow.

👉 Join our Telegram channel for your daily update — stay informed, stay ready.

Cybersecurity News Digest — Daily Briefings

Latest News

all posts →

October 28, 2026

Amazon RDS for Oracle: September 2026 MRP Update

🔔 Amazon RDS for Oracle now supports the September 2026 Monthly Recommended Patch (MRP) for Oracle Database versions 19c and 26ai. The MRP builds on the July 2026 Release Update and includes the Oracle September Critical Security Patch Update (CSPU) plus additional fixes. The release also updates the Oracle time zone file (DST version 46) to reflect recent daylight saving and permanent offset changes in regions such as British Columbia, Alberta, Morocco, and Western Sahara. Upgrade options include creating new instances or applying engine versions 19.0.0.0.ru-2026-07.mrp-2026-09.r2 or 26.0.0.0.ru-2026-07.mrp-2026-09.r2 via the Console, SDK, or CLI.

AWS RDS Patch Release Oracle

October 28, 2026

Amazon Bedrock AgentCore CLI 1.0 Released

🚀 AWS announces general availability of Amazon Bedrock AgentCore CLI version 1.0 (@aws/agentcore 1.0.0). The CLI is rebuilt for faster startup and a consistent command structure, enabling developers to create, develop, deploy, and operate AI agents and resources directly from the terminal. Version 1.0 supports working with project workflows or directly with harnesses, runtimes, memory, identity, gateways, and payments, and adds interactive shells, resource pickers, and searchable menus. Existing projects can be migrated with agentcore migrate and the CLI is available via npm with source on GitHub.

AWS Bedrock Agents Agentic AI Product Launch

October 28, 2026

AWS Lambda adds Seekable OCI (SOCI) support

🧩 AWS Lambda now supports Seekable OCI (SOCI) for lazy loading Event Functions packaged as OCI images on Lambda Managed Instances. With SOCI, Lambda streams only the files needed during each stage of startup rather than downloading the entire image, reducing container startup times by up to 70% for large images. To use it, create a SOCI index for your image, push it to Amazon ECR, reference the SOCI-indexed tag when updating your function, and Lambda will auto-enable lazy loading. The feature is available in all commercial AWS Regions where Lambda Managed Instances is offered and integrates with agent tools via the Lambda Managed Instances skill.

AWS Lambda Product Update

October 28, 2026

Amazon OpenSearch Serverless adds time series collections

📈 Amazon OpenSearch Serverless now supports time series collections to ingest, store, and analyze logs, metrics, traces, and events without cluster management. Collections automatically absorb ingest spikes, keep recent data fast to query, and make long-term history searchable at low cost. A new warm storage tier reduces costs for infrequently accessed data while maintaining up to 100 TB of hot storage per collection, and built-in alerting and anomaly detection are available.

AWS Log Management

October 28, 2026

Amazon Quick introduces Smart Approvals for agentic actions

🔒 Amazon Quick adds smart approvals, a review layer that reduces approval fatigue by auto-approving routine agentic actions while routing consequential ones to users. The feature evaluates actions against the user's request using a classifier and only applies where a user's setting is set to “ask” each time. Administrators control access and users may opt out; AWS CloudTrail logs reviews and setting changes. Smart approvals is available in Regions supporting Amazon Quick agentic capabilities.

AWS Agentic AI AI Governance

October 28, 2026

Amazon EKS Dashboard adds CA rotation visibility

🔒 The Amazon EKS Dashboard now provides consolidated visibility into certificate authority (CA) rotation across clusters, showing which CAs are approaching expiration and upcoming automated rotation events. This fleet-wide view aggregates data across AWS Regions and accounts via AWS Organizations and is accessed from the US East (us-east-1) dashboard at no additional cost. Platform teams can prioritize CA rotation actions centrally without inspecting clusters individually, and CA rotation support is available across all commercial AWS Regions.

AWS AWS EKS Certificate Management

October 28, 2026

Retail Cyber Threats and Peak Season Risks 2026

🔒 This Unit 42 blog examines the primary cyber threats retail organizations face heading into the 2026 peak shopping season, reviewing past incidents and evolving attack techniques. It highlights ransomware, data theft and extortion, DDoS, digital skimming, credential stuffing, and gift-card fraud, and explains how adversaries are leveraging AI to accelerate attacks. The post outlines mitigation strategies such as zero trust, WAAP, DLP, ASM, and automated containment to reduce MTTD and MTTR.

Unit 42 Ransomware DDoS Web Skimming

October 28, 2026

AWS Lambda Durable Execution Telemetry Exporter

🛰️ AWS Lambda has released the Durable Execution Telemetry Exporter plugin to capture and export step-by-step histories of durable function executions. The plugin records execution status, timing, inputs/outputs, and errors, and can redact sensitive fields and apply sampling to control volume. It supports 13 built-in destinations including CloudWatch Logs, S3 for Amazon Athena, DynamoDB, Aurora, and OpenSearch Service, and is available for TypeScript, Python, Java, and Go. A companion Model Context Protocol (MCP) server enables AI agents to query exported telemetry with natural language.

AWS AWS Lambda MCP

October 28, 2026

ECS Managed Instances adds cross-instance consolidation

🔔 Amazon Elastic Container Service (Amazon ECS) Managed Instances now supports two optimization features: cross-instance consolidation and Spot consolidation. Cross-instance consolidation repacks tasks across multiple underutilized instances to increase utilization and lower costs, while Spot consolidation extends the approach to Spot capacity after confirming replacement capacity. These capabilities run automatically at no extra cost across all AWS Regions and apply to existing and new ECS Managed Instances capacity providers.

AWS Container Security Infrastructure Security

October 28, 2026

Amazon EKS Auto Mode adds Gateway API support

🛠️ Amazon EKS Auto Mode now supports the Kubernetes Gateway API, enabling a standard, portable way to define traffic routing to applications. Customers can use Gateway and HTTPRoute resources while EKS Auto Mode provisions and manages underlying AWS infrastructure automatically. Features include HTTP and gRPC routing, cross-namespace traffic, weighted splitting, header-based rules, and automatic TLS via AWS Certificate Manager. Existing Ingress resources continue to operate alongside Gateway API resources.

AWS EKS Kubernetes

October 28, 2026

Google opens one‑tap installs to registered app stores

🛡️ Google will permit approved third‑party Android app stores to perform one‑tap installs and background updates on devices running Android 17 QPR2 or later in supported countries, starting December 1. To qualify, stores must pass identity verification, submit their entire catalog and every new app/update to Google for malware scanning, and pay a $10,000 annual fee. Stores must still obtain explicit user consent for installs, show visible notifications for large downloads or background installs, and remain liable for their catalogs. The program excludes the US and allows IT admins to block registered stores on managed devices.

Google Mobile Security Product Launch

October 28, 2026

Logic-only Edge chain lets web pages escape sandbox

🛡️ A DEVCORE researcher demonstrated that a chain of logic flaws — with no memory corruption — could let a malicious web page run code outside Microsoft Edge's sandbox. Orange Tsai published the full method on October 28 after the chain earned $175,000 at Pwn2Own Berlin; Microsoft had patched the issues the day after the contest. The exploit produces a universal cross-site scripting primitive and escalates to code execution by abusing Edge features and Windows protocol handling, but the fixes shipped in May and up-to-date browsers are protected.

Microsoft Sandbox Escape Research

October 28, 2026

AI-Linked PHP2Shell Attack Roots 25 Firewalls

🛡️ Cybersecurity researchers disclosed an AI-assisted campaign observed on October 25, 2026, that combined PHP2Shell (CVE-2026-109618, CVE-2026-109619) and a Linux kernel LPE Fragnesia (CVE-2026-46300) to gain root on 25 servers, including three tied to a U.S. government-affiliated environment. The attacker targeted specific firewall management interfaces running PHP 8.0.30, used custom exploit toolchains, and deployed web shells to establish persistence and tunnel into internal networks. Artifacts indicate the operation leveraged AI tooling such as Anthropic's Claude Code, FOFA API keys, and LLM-backed offensive tools to automate reconnaissance, exploitation, and credential harvesting.

Anthropic Web Shell Privilege Escalation Active Exploitation

October 28, 2026

AlloyDB Omni Web UI Brings Cluster Observability

🛠️ The AlloyDB Omni Web UI is now generally available for Red Hat and container deployments, offering a read-only, production-ready console for cluster visibility. It exposes hardware telemetry, query performance, columnar engine diagnostics, and parameter auditing so administrators can troubleshoot without leaving local or enterprise environments. The interface supports profile management, integrates with Prometheus for system metrics, and surfaces AI and ecosystem shortcuts while operating strictly in read-only mode.

Google Cloud SQL Cloud Security

October 28, 2026

Using VPC Flow Logs to Troubleshoot GKE Workloads

📘 VPC Flow Logs in Google Cloud annotates sampled network flows with GKE metadata so ephemeral pod IPs are attributed to workloads, namespaces, and services. This gives workload-level L3/L4 visibility without extra agents and complements in-cluster observability. Flow Analyzer in Network Intelligence Center and upgraded Observability Analytics buckets let you query, group, and visualize traffic by cluster, namespace, workload, pod, service, and zone. The post includes walkthroughs using Online Boutique to illustrate common troubleshooting cases.

Google Google Kubernetes Engine Network Security

October 28, 2026

How Google Ships Agent Skills Like Products

🛠️ This post describes how Google’s Agent Skills repository evolved operational controls and automated gates to treat skills as living products. It explains six CI/CD gates — structural conformance, linters, semantic versioning, evaluation suite checks, link validation, and an AI review agent — and why each is necessary at scale. The article contrasts small-scale authoring with repository-level governance and describes concrete rules for metadata, scripts, and evaluation.

Google CI/CD Security Agentic AI DevSecOps

October 28, 2026

GKE Dataplane V2 for high-density agentic AI

🔒 This post explains how GKE Dataplane V2 uses eBPF-powered identity mapping, label filtering, and metadata migration to support sub-second provisioning and extreme pod density for agentic AI workloads. It highlights Agent Sandbox and Agent Substrate on GKE as solutions for secure, lightweight isolation and state rehydration at large scale. The article outlines techniques to avoid the 65,536 identity limit and to maintain low-latency startup for thousands of sandboxes.

Google Google Kubernetes Engine Agentic AI Container Security

October 28, 2026

CISO responsibilities in the agentic AI era

🔒 October is Cybersecurity Awareness Month and CISOs face rapid change as AI agents proliferate across enterprises. Organizations must balance enabling innovation with controlling unmanaged risk by assigning governed identities to agents, protecting accessed data, and implementing deep observability. Defenders must integrate signals across identity, endpoints, apps, and cloud, use threat intelligence and partners, and employ agentic defenses to act at AI speeds.

Agentic AI Agent Security Identity Security AI Governance