Hello, stay ahead with CISO Brief 🚀

🔥 Amazon EC2 R8gd instances are now available in the AWS European Sovereign Cloud (Germany). These instances feature up to 11.4 TB of local NVMe SSD, are powered by AWS Graviton4 processors for up to 30% better performance versus Graviton3, and are built on the AWS Nitro System. They include up to 50 Gbps network bandwidth, up to 40 Gbps EBS bandwidth, configurable bandwidth weighting, and EFA support on the largest sizes.

🚀 Amazon EC2 R8g instances are now available in the AWS European Sovereign Cloud (Germany), powered by AWS Graviton4 processors. These instances deliver up to 30% better performance than Graviton3-based instances and are optimized for memory-intensive workloads such as databases, in-memory caches, and real-time analytics. Built on the AWS Nitro System, R8g instances offer enhanced performance and security with larger sizes, higher vCPU and memory configurations, and increased networking and EBS bandwidth.

🔒 Cybersecurity researchers disclosed an active credential-theft campaign that used compromised maintainer GitHub accounts to inject malicious GitHub Actions workflows into more than 340 repositories. The malicious workflows, masquerading as Security Audit or GitHub Actions Security, exfiltrate repository secrets and credentials to a hard-coded IP address and scan the working tree and git history for API keys and tokens. The activity, attributed to the GhostAction campaign, has affected hundreds of users and led to thousands of secrets being harvested since late August 2026. Developers are urged to search for the offending workflow files, assume compromise, revoke affected credentials, and remove the injected workflows across branches and forks.

🎯 Cloudflare announced Clef-omni, an extension of its open-weight Clef decision models that natively accepts audio, video, image, and text inputs in a single API call. They also reduced Clef-flash pricing and improved serving speeds. The company published weights on Hugging Face, updated developer docs, and shared benchmark and latency figures showing strong performance and low latency across modalities.

🔎 The FBI announced on October 9 that it arrested another suspected ShinyHunters co-conspirator, a Canadian citizen taken into custody in Pennsylvania. The agency has not released the suspect's name or filed public charges, and details come from media reports citing unnamed sources. The arrest follows earlier detentions in the Netherlands and Jordan as investigators continue to probe the breach of the FBI jobs portal.

🛠️ Amazon Bedrock now supports the reasoning.summary parameter for OpenAI models via the Responses API, enabling requesters to receive a human-readable summary of a model’s reasoning alongside its answer. This helps developers understand the model’s approach to complex tasks like coding, analysis, and multi-step problem solving. The summary appears in the summary array of the reasoning output item and is available for all OpenAI models on Bedrock across AWS Regions that support OpenAI GPT models.

🔒 Threat actors are exploiting two unpatched AhsayCBS vulnerabilities to deploy webshells and cryptocurrency miners. The activity, observed on October 7, targeted at least five organizations and chained CVE-2026-105133 (authentication bypass) with CVE-2026-105134 (OS command injection). Researchers at Huntress report that the flaws persist in Ahsay 10.3.4 despite fixes in 10.3.2. Huntress recommends restricting management interface access and investigating potential compromise.

🆕 Two new Anthropic models, Claude Opus 5.5 and Claude Sonnet 5.5, are now available in the Kiro IDE and CLI for AWS GovCloud (US) Regions. Opus 5.5 offers higher capability for long-running agentic coding with ~40% fewer tool calls and roughly half the tokens versus Opus 5, available with a 1M context window and 2.0x credit multiplier. Sonnet 5.5 is faster—>30% throughput improvement—with improved clarity and a 1.3x credit multiplier. Update your IDE/CLI to access the new models and consult GovCloud documentation or your AWS account team for details.

🔍 The FBI announced the arrest of another suspected member of the ShinyHunters extortion group tied to last month's breach of FBI systems, Director Kash Patel said. While authorities have not named the suspect or detailed charges, reports indicate a Canadian citizen was detained in Pennsylvania and is considered a primary co-conspirator. The arrest follows earlier detentions and international cooperation as investigators work to dismantle the group and recover evidence.

🔍 Amazon Connect Customer now offers automated checks that analyze performance evaluation forms against best practices to improve AI-driven scoring. Managers can run a one-click check during form setup to identify questions lacking necessary context and receive suggestions to make them more specific. The feature helps ensure fair, accurate scoring of human and AI agents while reducing time spent refining forms, and is available in multiple AWS Regions.

🟦 Amazon S3 Vectors metadata pre-filtering is now available in the AWS GovCloud (US-East) and AWS GovCloud (US-West) Regions. Pre-filtering evaluates metadata filters before running similarity search, returning up to 5x more matching vectors for selective filters. S3 Vectors also introduces a $startsWith prefix operator for filtering values like paths and URLs. New vector buckets in GovCloud use pre-filtering by default; existing indexes can be updated in place via the UpdateIndexMode API.

🔒 AWS Lambda now supports OAuth authentication for self-managed Apache Kafka event source mappings (ESM), including both customer-run clusters and managed services like Confluent Cloud, Aiven, and Redpanda. This enables Lambda Kafka consumers to authenticate through enterprise identity providers such as Amazon Cognito or Okta, aligning Kafka ESM authentication with organizational identity and access policies. The feature is available in all commercial AWS Regions where self-managed Kafka ESM is provided and can be configured via the Console, API, CLI, CloudFormation, or SAM.

📣 iVerify and Censys researchers detailed a new P7 variant of the DarkSword iOS exploit kit that reduces on-device footprint, adds on-device keychain and crypto-wallet theft, and implements two-way C2 communication. The toolkit, which chains multiple iOS vulnerabilities to escape the browser sandbox and inject into SpringBoard, has been used in campaigns since late 2025 against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine. P7 extracts keychain data to JSON prior to exfiltration, polls for commands frequently, and supports numerous remote actions including file exfiltration, command execution, and wallet extraction. Analysts also linked open directories and C2 infrastructure to multiple actors and uncovered two previously undocumented CVEs used by the kit.

🔍 Lightwell, the open-source security effort backed by IBM and Red Hat, discovered more than 400 previously unknown vulnerabilities in popular Java libraries and now offers a new service, Lightwell Clearinghouse, for customers to submit dependencies for review. The initiative focuses on critical flaws such as a CVSS 9.1 sandbox bypass in the Thymeleaf template engine and emphasizes backporting fixes into production to avoid downtime. IBM and Red Hat committed substantial resources to Lightwell, combining engineering, community ties, and AI-assisted workflows to both find and remediate issues.

🔒 In a shift noted by Kaspersky experts, ransomware operators are increasingly abandoning encryption and focusing on extortion through access and data theft. The PAYLOAD campaign demonstrated this by abusing Active Directory and GPOs to display ransom notes, change wallpapers, disable accounts, and prove access without encrypting files. Attackers favor data exfiltration because backups negate the leverage of encryption, while leaks threaten reputation and regulatory fines. Standard cyberhygiene remains essential to mitigate these evolving extortion tactics.

🧭 Live Query and BigQuery integrate to simplify processing of large volumes of unstructured documents. The browser-based Alteryx Live Query enables business users to author pipelines without code while pushing transformation and AI-driven extraction into BigQuery. This approach reduces data movement, enforces governance, and accelerates reconciliation and exception handling for invoice-heavy finance workflows.

🛡️ The owner of a ransomware remediation firm, Zohar Pinhasi (aka "Zack Silver"), has been arraigned in New York on wire fraud charges for allegedly defrauding clients of MonsterCloud. Prosecutors say he claimed to recover encrypted data without paying ransoms but instead paid attackers and charged clients inflated fees. One alleged 2023 incident involved an $8,200 payment to criminals while the client was billed $150,000. Experts note such schemes and other scams continue to target ransomware victims.

🔒 Germany has arrested a Russian national suspected to be a leading member of the Qilin ransomware group after extradition from Japan earlier this month. Japanese and German authorities coordinated detention and extradition under the Extradition Law for Fugitives. Qilin (formerly Agenda) is a prolific RaaS operation blamed for attacks on major organizations worldwide.