All news in category “Vendor and Hyperscaler Watch”

🔒 Microsoft will change Edge so saved passwords are not loaded into process memory in clear text at startup. Security researcher Tom Jøran Sønstebyseter Rønning disclosed on May 4 that Edge decrypted all stored credentials at launch and released a proof-of-concept showing how attackers with Administrator privileges could dump other users' passwords. Microsoft initially described the behavior as "by design" but now says a defense-in-depth change will roll out across Stable, Beta, Dev, Canary and Extended Stable; the fix is live in Canary and will be in build 148 and newer.

🔐 Amazon CloudFront now supports Online Certificate Status Protocol (OCSP) for viewer mutual TLS (mTLS), allowing real-time validation of client certificate revocation during connection establishment. Previously, revocation was handled via CloudFront Functions and KeyValueStore with static lists. CloudFront now queries the OCSP responder embedded in certificates and caches responses up to 30 minutes. The OCSP result is exposed to connection functions for custom logic.

🔐Amazon CloudFront now supports passthrough mode for viewer mutual TLS (mTLS), enabling customers to forward client certificate chains directly to their origin for validation instead of requiring CloudFront to perform certificate verification. In passthrough mode CloudFront forwards every request and the full client certificate chain to the origin and does not cache responses, ensuring end-to-end authentication is enforced by the origin. Connection functions remain available so you can inspect or transform connection-level data before it reaches your origin. CloudFront mutual TLS (viewer) passthrough is available at no additional cost.

🔔 Amazon Web Services announced general availability of Amazon EC2 M3 Ultra Mac instances, built on Apple M3 Ultra Mac Studio hardware. These instances, powered by the AWS Nitro System, deliver up to 10 Gbps network and 8 Gbps EBS bandwidth and include a 28-core CPU, 60-core GPU, 32-core Neural Engine, and 256 GB of unified memory. Compared to M4 Max, they provide significant uplifts in CPU, GPU, memory, and Neural Engine capacity. Available in US East (N. Virginia) and US West (Oregon).

🌐 AWS outlines how to present a single, brand-aligned vanity entry point (for example, aws.mycompany.com) in front of IAM Identity Center multi-Region access portals. The approach uses Amazon Route 53 latency-based routing, Application Load Balancer 302 redirects, and optional Amazon ARC Region switches for automated failover while TLS is managed through AWS Certificate Manager. Traffic is directed to the nearest healthy regional portal and the vanity domain does not persist in the browser address bar.

🚀 Amazon Web Services has launched EC2 High Memory U7i instances in the AWS Europe (Paris) region, adding u7i-12tb.224xlarge and u7in-16tb.224xlarge. These 7th-generation instances use custom 4th-generation Intel Xeon Scalable (Sapphire Rapids) processors and provide 12 TiB or 16 TiB of DDR5 memory with 896 vCPUs. They offer up to 100 Gbps of Amazon EBS bandwidth, ENA Express, and up to 200 Gbps network bandwidth on the 16 TiB variant, delivering up to 45% better price performance versus prior U-1 instances. Ideal for mission-critical in-memory databases like SAP HANA, Oracle, and SQL Server.

🚀 Amazon SageMaker AI now supports serverless customization for the Qwen3.6 27B parameter model using supervised fine-tuning (SFT) and reinforcement fine-tuning (RFT). This extends SageMaker's existing fine-tuning support for Qwen3.5 and other open-weight models. Serverless customization removes infrastructure management—SageMaker handles provisioning and orchestration—so teams pay only for what they use. The feature is available in US East (N. Virginia), US West (Oregon), Asia Pacific (Tokyo), and EU (Ireland).

🗂️ AWS Transform now supports customer-owned Amazon S3 buckets, letting customers control where transformation artifacts are stored and how they are secured. You can configure your own S3 bucket, optionally encrypt artifacts with your AWS KMS key, and manage access policies in your account. Migration teams can upload files directly and centralize artifacts across accounts to support regulated industries and data sovereignty requirements. This capability is available in all Regions where AWS Transform is offered.

🛠️ AWS has made its AWS Transform agents available through an agent plugin, a Kiro Power in the Kiro marketplace, and the AWS Transform MCP server. Developers can now invoke transformation capabilities from their IDE, the web console, or programmatically, maintaining consistent job state across surfaces. IAM role authentication is supported, enabling use of existing AWS credentials for environments, workspaces, and jobs.

🛠️ AWS announced general availability of the agent builder toolkit Kiro Power for AWS Transform, enabling partners and customers to create customized transformation agents tailored to modernization projects. The toolkit supports the full agent lifecycle—build with Kiro Power, share across teams and partner networks, and register agents with AWS Transform for discovery. It's available in the Kiro Power marketplace and targets Migration and Modernization Competency Partners, ISVs, and customers.

🔊 AWS has added three Qwen speech foundation models—Qwen3-TTS-12Hz-1.7B-CustomVoice, Qwen3-TTS-12Hz-1.7B-Base, and Qwen3-ASR-1.7B—to Amazon SageMaker JumpStart. The models deliver multilingual text-to-speech and automatic speech recognition capabilities across more than 10 languages and 52 languages/dialects. CustomVoice offers instruction-driven control over timbre, emotion, and prosody while Base enables 3-second rapid voice cloning. SageMaker JumpStart lets customers deploy these models from SageMaker Studio or via the SageMaker Python SDK with a few clicks.

🔔 AWS has added GLM-5.1-FP8 (from Z.ai) and Phi-4-mini-instruct (from Microsoft) to Amazon SageMaker JumpStart, expanding foundation model choices for enterprise workloads. GLM-5.1-FP8 targets agentic software engineering and multi-round optimization for repository-level code, debugging, and long-horizon automation. Phi-4-mini-instruct provides compact, low-latency reasoning across 24 languages and supports function calling for edge and latency-sensitive use cases. Customers can deploy these models via SageMaker Studio or the SageMaker Python SDK in a few clicks.

🔁 Amazon Aurora DSQL now supports change data capture (CDC) in preview, enabling real-time streaming of database changes directly to Amazon Kinesis Data Streams. The fully managed capability captures insert, update, and delete operations as discrete change events and removes the need to build and maintain custom streaming pipelines. It is designed for zero impact on database throughput and latency, requires no infrastructure setup, and integrates with AWS Lambda and Data Firehose for downstream delivery. CDC streaming in preview is available in all Regions where Aurora DSQL is offered and is billed using Distributed Processing Units (DPUs); standard Amazon Kinesis pricing applies separately.

🚦 Amazon Application Recovery Controller (ARC) Region Switch adds a Lambda event source mapping execution block to automate coordinated failover of event-driven streams across Regions. The block enables or disables Lambda event source mappings for Kinesis, DynamoDB Streams, MSK, and SQS to prevent duplicate processing. Customers can chain a disable block before an enable block, or run plans in ungraceful mode for impaired Regions. Native cross-account support lets a single plan span multiple AWS accounts.

🔁 Fn::GetStackOutput enables CloudFormation templates and CDK applications to reference stack outputs across AWS accounts and Regions directly. By specifying a target stack name, output key, an IAM role ARN for cross-account access, and optionally a Region, CloudFormation assumes the role and resolves the output during template processing. In CDK, cross-account and cross-Region references use this function automatically, removing the need for custom resources and SSM parameters. Configure appropriate IAM permissions and add the function to templates to get started; the feature is available in all Regions where CloudFormation is supported.

🖥️ Amazon EC2 X8aedz instances are now available in Europe (Ireland), powered by 5th Gen AMD EPYC processors delivering up to 5 GHz single-thread performance. Built on sixth generation AWS Nitro Cards, these instances are optimized for EDA workloads and relational databases that need high CPU frequency and large memory. They provide a 32:1 memory-to-vCPU ratio, sizes from 2–96 vCPUs with up to 3,072 GiB memory and up to 8 TB local NVMe, and are offered via Savings Plans, On-Demand, and Spot.

🛡️ Amazon Connect Customer now offers a permission that lets agents access only their own performance evaluations directly in the Connect UI. Agents can search for contacts where they received evaluations, view evaluations alongside call recordings and transcripts, and submit an acknowledgment after review. Administrators can grant department-level contact visibility for investigations while preventing access to peers' evaluation data. The feature is available in all AWS regions where Amazon Connect Customer is offered.

📢 Amazon RDS for PostgreSQL now supports minor versions 18.4, 17.10, 16.14, 15.18, and 14.23. We recommend upgrading to these latest minor versions to remediate known security vulnerabilities and benefit from community bug fixes and improvements. This release also adds postgis_topology support in PostGIS 3.6.3 for PostgreSQL 18 to model and query topological relationships. Use automatic minor upgrades, AWS Organizations Upgrade Rollout Policy, or RDS Blue/Green deployments to orchestrate large-scale, low-downtime upgrades.

🔒 Kaspersky Container Security (KCS) is presented as a comprehensive platform that reaches beyond registry image scanning to secure container workflows across development and production. The Product Security Team uses KCS in CI/CD pipelines, registry correlation, and cluster runtime monitoring to tie findings to specific artifacts, pipelines, and scan times. KCS computes risk ratings, supports SBOM processing, and produces reports in SARIF, CycloneDX, SPDX and standard formats to integrate with AppSec and internal tooling.

🔒 The PQC Readiness Scanner automates inventory and continuous monitoring of AWS-terminated TLS endpoints — Application Load Balancer (ALB), Network Load Balancer (NLB), and Amazon API Gateway — to evaluate TLS policies for Post-Quantum Cryptography (PQC) readiness. It classifies endpoints into a three-tier framework (Tier 1: PQ-ready, Tier 2: PQ-ready with backward compatibility, Tier 3: not PQ-ready) and returns COMPLIANT/NON_COMPLIANT results with policy recommendations. Built as an AWS Config conformance pack with custom rules and Lambda functions, it supports organization-wide deployment via CloudFormation StackSets and S3-hosted artifacts. The scanner reduces manual review, tracks migration progress across accounts, and helps prioritize upgrades to TLS 1.3 with PQC key exchange.