Hello, stay ahead with CISO Brief 🚀

🔍 Amazon EC2 now includes the AWS Systems Manager (SSM) Parameter Store names associated with public AMIs directly in the AMI metadata. When you describe a public AMI, the response shows the related public SSM parameter, enabling easier discovery and referencing. This feature simplifies using SSM parameter aliases that resolve to the latest AMI versions and is available in all AWS regions, including China and GovCloud, at no extra cost.

🔥 This week’s Threat Source highlights a record Microsoft Patch Tuesday that fixed 622 vulnerabilities, including two zero‑days being actively exploited. Cisco Talos discloses UAT‑11795, a Russian‑speaking group using trojanized installers to deliver the Python-based Starland RAT and an in-memory PowerShell implant called WLDR agent. The newsletter outlines detection guidance and emphasizes the operational stress on IT teams facing accelerated vulnerability discovery driven by frontier AI research.

🔔 Amazon S3 Event Notifications now include system-generated tags in events delivered to destinations such as Amazon EventBridge, Amazon SQS, Amazon SNS, and AWS Lambda. These tags are metadata labels applied to buckets by AWS services and can be used to filter events across thousands of buckets with a single EventBridge rule rather than listing each bucket individually. Enable S3 Event Notifications via the AWS Management Console, SDK, or CLI; tags already applied by services like AWS CloudFormation are automatically included in new notifications. This capability is available at no additional cost in all AWS Regions and requires no configuration changes.

🔒 Zoom disclosed and patched a critical vulnerability that could allow an unauthenticated attacker to perform an account takeover via network access, affecting several Windows clients and VDI branches. The company also fixed three privilege-escalation bugs across Zoom Workplace, Zoom Rooms, and related VDI plugins. Security experts warned the flaw is highly dangerous due to low complexity and no user interaction required, while praising Zoom for discovering and patching the issues.

🚀 Amazon EC2 High Memory U7in-24TB (u7in-24tb.224xlarge) instances are now available in the AWS Europe (Paris) region. These U7i instances belong to the 7th generation and are powered by custom 4th-generation Intel Xeon Scalable processors (Sapphire Rapids), offering 24 TiB DDR5 memory and 896 vCPUs. They deliver up to 100 Gbps Amazon EBS bandwidth, 200 Gbps network bandwidth, ENA Express, and up to 45% better price performance versus U-1 instances. Ideal for in-memory databases such as SAP HANA, Oracle, and SQL Server.

🔒 AI agents require managed identities and tightly scoped permissions to avoid uncontrolled access and privilege escalation. Treat each agent as a first-class principal with lifecycle-managed identities, explicit owners, and task-based RBAC. Implement controlled tool binding, just-in-time elevation for high-risk actions, and end-to-end audit logging to ensure accountability and rapid incident response. Regular reviews and revocation testing are essential.

🔎 Upgrading foundation models is slow and costly for engineering teams, often requiring months of manual testing and evaluation. Google Cloud Applied ML built an agentic workflow that reduces migration time from months to hours using the Gemini Enterprise Agent Platform and Google Antigravity. The blog outlines three lessons and practical steps—deploying Autoraters, building an agentic loop, and automating orchestration—to replace manual toil with intelligent automation.

🎬 As part of an internal generative media hackathon, Google tested whether teams of AI agents could collaboratively produce short films using Scion, an open-source agent orchestration testbed. Each crew had three role-specific agents (Idea Person, Technical Lead, Editor) plus coach and coordinator agents, following a seven-step filmmaking pipeline with verification gates. Agents called multiple Google AI models via a shared CLI toolkit genmedia (Gemini, Veo 3.1, Lyria 3, Gemini Flash TTS) to generate images, video, audio, and music, producing over 25 productions and about 44 minutes of final footage. Teams found that shared files provided resilience, specific prompts and style choices improved results, and coach-led gates helped ensure completed deliverables.

🛡️ Francis deSouza outlines how deep context gives defenders an AI-driven advantage by unifying enterprise telemetry, vulnerability management, and agentic automation. The post introduces Google AI Threat Defense, combining Gemini, Wiz, CodeMender, and Mandiant into a prepare–scan–remediate–monitor lifecycle. It emphasizes human oversight, Zero Trust for AI, and real-world impact such as Morgan Stanley’s rapid detection improvements.

🔗 This post introduces the %%bqsql IPython cell magic and the BigFrames library to bridge Python (pandas) and BigQuery SQL within notebooks. It explains setup steps for local or Colab environments, how to enable the BigQuery sandbox, and how to load the bigframes extension. The article walks through a USDA wheat data example showing chained workflows that alternate between Python and BigQuery SQL, plus tips for schema handling and visualization.

🛡️ This week’s roundup highlights a wave of opportunistic attacks where familiar software and weak defaults are abused to escalate damage quickly. Reports include malicious NuGet packages that deliver spyware via game cheats, trojanized installers distributing sophisticated RATs, and a fast-spreading Rust ransomware incident that encrypted a network within 24 hours. Additional items cover actively exploited CVEs added to CISA’s KEV, guidance for coordinated vulnerability disclosure, large-scale fraud and money‑laundering disruptions in Europe, evasive Windows bind-link techniques, fake GitHub repos spreading an infostealer, and misuse of Chrome Sync for covert surveillance.

🛡️ Two SafeBreach studies demonstrate how prompt-injection techniques can bypass layers of defenses around Google Gemini, using calendar invites or text messages as entry points. Attackers chain indirect injection, memory poisoning, delayed execution, and fake context alignment to get the assistant to perform unauthorized actions across devices. Even with Google fixes, the research highlights a persistent arms race between attackers and defenders that leaves users needing to restrict assistant access.

🔒 Palo Alto Networks has announced the general availability of Prisma AIRS AI Gateway, an AI control plane designed to provide unified governance, identity, and runtime controls for enterprise AI interactions. The gateway sits inline between agents, AI apps, and model providers to deliver observability, policy enforcement, credential scoping, and runtime inspection. Built from Portkey innovations, it targets scale and security gaps as AI usage and outbound data volumes surge across enterprises.

🤖 Today is AI Appreciation Day, and while AI has transformed coding, threat analysis, and productivity, Check Point’s AI Security Report 2026 warns that those same strengths empower attackers. Researchers observed AI running exploitation workflows autonomously, producing vast volumes of malware code and executing thousands of commands in real intrusions. Organizations are adopting many AI apps rapidly, often without governance, increasing high-risk prompts and exposure.

🛡️ Daniel Solove argues in the Wall Street Journal that individual control over personal data is insufficient to protect privacy in the AI era. He urges shifting regulatory focus to hold companies accountable—similar to food and drug oversight—through measures like data minimization, fiduciary duties, and liability for negligent design. Solove also recommends liability for harmful algorithms and multi-stakeholder review of technologies to ensure safer outcomes.

🛡️ This article from Mandiant Consulting outlines practical guidance for safely integrating AI agents into vulnerability discovery and remediation workflows. It emphasizes grounding AI adoption in established frameworks such as NIST RMF, OWASP for LLMs, and Google’s SAIF, and prescribes layered defenses including deterministic policy engines, sandboxed agent workloads, zero data retention agreements, and human-led red teaming. The post also stresses threat modeling, least-privileged machine identities, supply chain vigilance for agent skills, and runtime observability to prevent data exfiltration and prompt-injection risks.

🔒 A coalition of 43 state attorneys general reached an $18 million settlement with 23andMe (now Chrome Holding Co.) over a 2023 data breach that exposed genetic data of 6.9 million customers. Investigators found the company lacked basic protections against credential-stuffing attacks, including multifactor authentication, password blocklisting, and adequate monitoring. The settlement imposes new security requirements, governance measures, and preserves consumer deletion rights while following prior lawsuits and fines.

🔒 n8n's Enterprise token-exchange feature matched incoming JWTs to local users using only the sub claim and ignored the iss value, allowing a valid token from one issuer to authenticate as a user belonging to another issuer. The bug (CVE-2026-59208) was fixed on June 24 and credited to GitHub user bearsyankees. It only affects Enterprise instances with token exchange enabled and trusting multiple issuers; the recommended mitigations are upgrade to 2.27.4/2.28.1+ or restrict trusted issuers.