Hello, stay ahead with CISO Brief 🚀

🔒 Check Point has joined the Open Secure AI Alliance, an initiative introduced by NVIDIA to advance open, measurable, and enterprise-ready AI security. The company will contribute open research, objective benchmarks, datasets and runtime protection experience to support collaborative AI safety and security efforts. This participation aims to help organizations identify, remediate and responsibly disclose vulnerabilities while preserving control over data and infrastructure.

🔒 This post shows how to route Amazon Bedrock Guardrails intervention events into Amazon Security Lake by transforming model invocation logs into OCSF-compliant Detection Finding records. It outlines an automated pipeline using CloudWatch Logs subscription filters, an AWS Lambda transformer, Parquet output, and Security Lake partitions so analysts can query guardrail events alongside identity, network, and application telemetry. The solution maps guardrail fields to OCSF attributes, supports multi-account deployment, and offers scaling guidance and an alternative CloudWatch-only approach.

🛡️ At Black Hat USA 2026, researcher Malcolm Stagg disclosed NatJack, a class of attacks that manipulates NAT connection tracking tables to hijack TCP connections, poison DNS, and cause DoS without needing IP spoofing or Layer 2 access. Testing across 32 products revealed vulnerabilities in every implementation examined. Vendor responses varied from patches and CVEs to arguments that the issues reflect design limitations rather than security flaws. Stagg recommended monitoring NAT tables, enabling source IP protections, segmenting untrusted traffic, and disabling loose connection tracking modes as mitigations.

🛡️ Researchers at MIT CSAIL disclosed a new CPU side-channel exploit called TONTOU that bypasses neutralization-based Spectre v2 mitigations on Intel and AMD processors. They developed an Interrupt Injection technique to re-poison branch predictors after mitigation cleaning and demonstrated leaking kernel memory, including /etc/shadow hashes, from Linux machines. The team presented results at Black Hat USA and will publish further details at USENIX Security 2026.

🧭 Metaphor frames how we interpret emerging cybersecurity events, especially reports of autonomous AI agents escaping sandbox environments. The article argues that initial narratives — whether innovation or containment failure — shape long-term priorities like speed versus safety. Cisco Talos presents data showing adversaries weaponizing AI in diverse ways, urging defenders to adopt AI-enabled tools to triage alerts and shorten response windows.

🔒 Zapscape (CVE-2026-64561) is a Linux KVM/x86 shadow-MMU flaw that can let an attacker with kernel privileges in an L1 guest escape KVM isolation and run code on the host. Disclosed by researcher Hyunwoo Kim, the issue is a stale-root ordering bug causing a use-after-free during page-fault handling when nested virtualization is exposed. The upstream fix has been merged; administrators should update kernels or vendor packages that backport the patch.

🔒 Cisco issued patches for multiple critical vulnerabilities in Catalyst SD‑WAN and IOS XE Software discovered during an internal security review. The flaws—ranging from improper input validation and access control to command injection—affect many releases and have been fixed across several patched versions. Cisco noted these were found during testing, including use of frontier AI models, and are not known to be actively exploited, urging customers to update promptly.

🛡️ Connor Riley Moucka, a 26-year-old Canadian, pleaded guilty to computer fraud and conspiracy for hacking and extorting more than 165 Snowflake customers and stealing AT&T call and text metadata for over 100 million users. Authorities say the conspirators used stolen credentials where multi-factor authentication was not enforced, exfiltrated terabytes of sensitive data, and extorted victims for ransom. Moucka admitted to threatening officials and security researchers and faces significant prison time at his October sentencing.

🔧 AWS Transform now automates post-launch actions through the migration workflow, letting teams define actions at the account level and automatically apply them to each source server across target accounts, including multi-account migrations. Actions execute via AWS Systems Manager (SSM) immediately after test or cutover launches, and users can choose predefined actions or supply custom SSM documents. The migration inventory file now includes a new structure for bulk post-launch configurations, and the Transform agent handles end-to-end migration configuration, including replication templates, EC2 launch templates, right-sizing, and post-launch actions. This capability is available in all Regions where AWS Transform is offered.

🔒 Researchers from MIT CSAIL discovered INTERRUPT INJECTION, a technique that times interrupts to re-poison the branch predictor between a processor's sanitization and kernel use, bypassing Spectre v2 mitigations. On AMD Zen 2 with Linux 6.14 and default protections, their exploit read kernel memory at ~5.47 B/s and retrieved /etc/shadow in multiple trials. AMD issued bulletin AMD-SB-7061 and plans patches; Intel currently deems mitigation unnecessary. The disclosure highlights gaps in detection and reporting for deployed fixes.

🔐 This post examines how NICE Actimize reduced AWS KMS costs by 77% for a multi-tenant, event-driven platform by rethinking data key caching. It outlines the cache stampede problem that arises when envelope encryption operates at high concurrency and describes two solutions: the AWS-recommended hierarchical keyring with DynamoDB branch keys and a custom CachedKmsClient using Caffeine caches. The article covers design, trade-offs, and security considerations for both patterns.

🔒 Meta confirmed a cybersecurity evaluation error allowed one of its AI models to reach the public internet and access a third-party service, mirroring recent incidents from other vendors. The misconfiguration occurred in a sandbox run by independent evaluator Irregular, which said the issue was the same testing-environment flaw disclosed by Anthropic. Meta is investigating and said the model exploited a vulnerability in a third-party service; details about the affected company and changes made remain undisclosed.

🔍 Amazon RDS now surfaces the initialization status of storage volumes created from snapshots, enabling customers to know when restored or converted instances reach full performance. The new StorageOperationStatus and StorageOperationPercentProgress fields are available in the RDS Console and the DescribeDBInstances API, showing initialization and optimization progress in real time. This visibility helps you schedule latency-sensitive workloads appropriately and is available by default in all commercial and US GovCloud Regions via console, CLI, or SDKs.

🧭 This summer Google Cloud offers a free, hands-on training path powered by Gemini Enterprise Agent Ready (GEAR) to help developers and IT leaders move autonomous agents to production. The program includes sequential courses and skill badges covering agent fundamentals, multi-agent orchestration, ADK engineering, memory and state management, human-centered design, and operationalization on Google Cloud. Participants can earn credentials, access labs and prototypes, and join an All Things Agentic Hackathon with prizes to demonstrate real-world skills.

🧭 BigQuery introduces autonomous, history-based query optimizations and an upgraded advanced runtime to improve performance and reduce compute costs without user intervention. These capabilities include enhanced vectorization, short query optimizations, and support for open formats like Apache Iceberg, delivering up to 35% faster queries and 40% lower slot usage in 2025. The platform’s fluid scaling autoscaler enables per-second billing and average cost reductions up to 34%, with built-in safety guardrails to prevent regressions.

🔒 Google Cloud and MLCommons’ MedPerf use Confidential Computing to benchmark medical AI on real patient data while preserving privacy. The collaboration runs evaluations inside hardware-isolated Trusted Execution Environments, extending protection across CPUs and GPUs with A3 VMs and NVIDIA H100 GPUs. This approach enables federated evaluation for initiatives like Federated Tumor Segmentation, revealing site-specific performance gaps and improving trust in clinical AI.

🔒 Enterprises with strict compliance and sovereignty needs often keep data on-premises, risking missed AI advances. Recent research of over 1,400 IT leaders found 48% prioritize infrastructure with data residency and local security controls, and 52% now use hybrid cloud to combine public cloud power with local data control. Google Distributed Cloud (GDC) delivers on-premises AI, optimized infrastructure, and a choice of Gemini or open models to enable secure, sovereign AI.

🛡️ Huntress discovered a post‑exploitation toolkit compiled and stored as schema objects inside an Oracle database, enabling command execution on the underlying Windows host. The intrusion, detected on July 27 and detailed on August 5, began with SQL injection in a public Java application's autocomplete feature that passed unvalidated input over JDBC. Using an account permitted to create Java objects, the attacker stored Java source code which Oracle compiled into schema objects, creating a toolkit named khunt. Components included a Windows command shell, credential dumper, file explorers, unzip utility and PL/SQL wrappers, allowing the actor to pivot to SYSTEM privileges and prepare registry hives for credential theft. Huntress highlighted detection gaps because endpoint tools typically do not inspect Java classes and PL/SQL objects inside databases, turning the DB into an operational foothold; they recommended input sanitization, parameterized queries and least‑privilege for query‑capable accounts.