Hello, stay ahead with CISO Brief 🚀

🛡️ Threat actors have begun exploiting a critical command execution flaw (CVE-2026-110447) in the Collabora Online built-in CODE Server app for Nextcloud. The vulnerability affects richdocumentscode versions prior to 26.4.303 and enables OS command injection via the app’s proxy.php endpoint when the bundled CODE server is stopped, requiring no authentication. Administrators are urged to update to 26.4.303 or remove the app, as operators have reportedly deployed PHP webshells and searched for credentials and crypto wallets.

🛡️ A critical Linux kernel networking flaw, tracked as CVE-2026-99999 and nicknamed PwnEscape, lets code running inside a VM read host memory and potentially crash or execute code on the host. The issue was discovered in a Vercel security challenge by researcher Paulos Yibelo of pwn.ai and confirmed by Vercel; no evidence of real-world exploitation has been reported. Fixes have been merged and backported to multiple stable kernel branches; hosts must be updated and rebooted to be protected.

🔐 Amazon SageMaker Studio now allows new users to sign up using Google, GitHub, or Apple credentials and land directly in a pre-configured Studio environment without a traditional AWS account setup. Users receive AWS Free Tier credits in most cases with no credit card required, can invite collaborators who sign in with their own credentials, and access shared models, notebooks, and endpoints without configuring IAM users. The feature is available in all AWS Commercial Regions where SageMaker Studio is supported.

🚀 Amazon EC2 T8i instances are now available in South America (São Paulo). Powered by custom sixth generation Intel Xeon 6 processors and built on the latest sixth generation AWS Nitro cards, T8i offers up to 30% better price performance than T3 and comes in four sizes: nano, micro, small, and medium. These burstable instances target low to moderate CPU workloads such as small databases, microservices, CI/CD pipelines, and low-traffic websites. T8i also delivers up to 70% higher compute, improved network and EBS bandwidth, uses the same CPU credit model as T3, and includes Free Tier options for micro and small.

📱 Google is rolling out new AI-powered protections for Android to combat increasingly sophisticated messaging and call scams. The safeguards use cloud-based Gemini analysis and on-device Gemini Nano checks to flag fraudulent links and suspicious conversations while preserving privacy within Private AI Compute. Additional improvements include expanded on-device scam detection, masking of sensitive fields during screen sharing, and blocks against silent call forwarding. Users must enable cloud protections and keep devices updated to benefit.

🛡️ This week's ThreatsDay Bulletin covers active ransomware exploitation, DNS-powered cryptocurrency wallet drainers, and multiple remote access trojans expanding surveillance and harassment capabilities. Other highlights include post-quantum readiness guidance, strengthened AI model theft defenses, Android anti-scam updates, and new enterprise browser controls from Mozilla. Read on for details about evolving attacker tactics, supply-chain persistence, and emerging MaaS targeting developer and AI credentials.

🕒 Amazon DynamoDB Streams now supports timestamp-based stream processing using the AT_TIMESTAMP shard iterator type, allowing you to start reading records from a specified point in time rather than only from the oldest retained record or new records. This capability integrates with the Amazon Kinesis Client Library via the DynamoDB Streams Kinesis adapter. It helps prevent reprocessing large retained streams, enables targeted data replay for debugging and auditing, and aids resuming consumption after interruptions or restores. The feature is available across commercial, GovCloud (US), and China Regions with no extra charge beyond standard GetRecords API requests.

🕒 Amazon DynamoDB Streams now supports timestamp-based stream processing, allowing you to begin reading stream records from a specific point in time using the AT_TIMESTAMP shard iterator. Previously, consumption could only start from the oldest retained record or from new records written after starting. This feature integrates with the Kinesis Client Library via the DynamoDB Streams Kinesis adapter and is available in all commercial, GovCloud, and China Regions at no extra charge beyond standard API requests.

🛠️ Today AWS announced GA of the AWS Lambda Durable Execution SDK for Go, allowing Go developers to build resilient, long-running workflows using Lambda durable functions. The SDK offers native Go constructs for checkpointing progress, callback integration for human and agent workflows, durable invocation for reliable function chaining, and efficient waits for suspension. It integrates with standard Go tooling, supports local testing via the durabletest package, and includes the durablelint analyzer to detect resume-time issues before deployment.

🧭 SageMaker JumpStart now includes Muse Spark Open, Meta’s open-weight, coding-optimized foundation model tailored for agentic coding workflows. The model uses a Mixture-of-Experts architecture (816B total, 42B active) and supports a 1M-token context window for long-running projects and multimodal inputs. JumpStart provides BF16 and NVFP4 quantized variants, and customers can deploy endpoints in their own AWS accounts with a few clicks or via the SageMaker Python SDK.

📊 This report reviews Q3 vulnerability trends, noting CVE volume surged past 70,000 while KEV growth lagged behind, indicating discovery outpacing known exploitation. The author highlights a persistent patch gap with one-third of actively exploited flaws originating in 2025 or earlier, and flags increases in networking device CVEs. Practical guidance urges checking tooling for expanded CVE formats, watching forensicTriage KEV flags, and prioritizing remediation of legacy systems.

🔒 AWS HealthOmics now supports sharing VPCs across accounts using AWS Resource Access Manager (RAM), enabling bioinformatics workflows to run in subnets and security groups managed centrally. HealthOmics places each account’s workflows into shared subnets so workflows can access data privately without separate VPC peering or duplicated endpoints. This reduces infrastructure overhead and simplifies network management for organizations with centralized networking. Shared VPCs are available in all Regions where AWS HealthOmics is offered.

🕒 Amazon Time Sync Service now supports microsecond-accurate time and nanosecond hardware timestamps on 135 additional EC2 instance types across all commercial regions. This capability leverages the Nitro System reference clocks and enables precise event ordering, one-way latency measurement, and faster distributed transactions. Customers can enable the feature by launching instances in a Precision Time Placement Group (PTPG), and can associate PTPGs with Cluster Placement Groups (CPGs) when low network latency is also required.

🔎 Circle to Search on Android helps users quickly evaluate suspicious text messages by letting them draw a circle around content for an AI-generated overview. The feature surfaces guidance, red flags, and suggested next steps so you can decide whether to delete the message or block the sender. It aims to reduce the risk of clicking malicious links or sharing personal information.

🛡️ Cloudflare is integrating its edge compute platform with Gateway and DLP to enable inline programmability. Customers can use a new Forward action and Custom Functions to run Cloudflare Workers during policy evaluation, transforming requests or returning selector values. These features remove the need for separate proxy infrastructure and let teams perform custom actions like header injection, notifications, sandboxing, or audit logging directly at the edge.

🛠️ AWS Transform for full‑stack Windows modernization now supports cross‑region deployment of converted Amazon Aurora PostgreSQL databases and has expanded availability to seven additional AWS Regions. Customers can upload SQL Server DDL files, choose a target Region in the transformation plan, and deploy the converted Aurora PostgreSQL cluster across Regions while updating dependent .NET application data access. This update helps address data residency, latency, and disaster recovery requirements and extends service presence to multiple global Regions.

🔔 Starting today, Amazon MSK Connect and the AWS Glue Schema Registry are available in the AWS European Sovereign Cloud (Germany) region, complementing existing Amazon MSK Standard brokers. MSK Connect provides fully managed Kafka Connect clusters to deploy, monitor, and scale connectors that move data between Apache Kafka and external systems with automatic scaling and pay-as-you-go pricing. The AWS Glue Schema Registry is a serverless feature that validates and controls streaming data formats using Avro, JSON, and Protobuf schemas, reducing validation logic and coordination across teams.

🔒 AWS tested its autonomous AWS Security Agent (now part of AWS Continuum) against 37 recent, containerized CVE targets sourced from 2025–2026. Starting from low or no privileges, the agent had to discover each flaw, build exploits, chain primitives when needed, and extract a hidden flag without external CVE lookups. The run on Claude Opus 5 captured 35 flags, with 33 audited as genuine end-to-end exploits, spanning eight vulnerability classes and a median capture time of ~4 hours. The benchmark is continuously refreshed and designed to reduce contamination from public write-ups; an independent validation layer audited findings to remove unintended paths and false positives.