All news in category “Vendor and Hyperscaler Watch”

🔒 AWS Private Certificate Authority now supports partitioned Certificate Revocation Lists (CRLs) to scale revocation handling up to 100 million certificates per CA. Partitioning breaks revocation data into ~1 MB CRL partitions and binds certificates to partitions using a critical Issuer Distribution Point (IDP) extension, allowing validators to match CDP and IDP URIs for accurate checks. The feature is backward compatible, RFC5280-compliant, configurable in the console (including S3 setup), and carries no charge beyond AWS Private CA and Amazon S3 usage.

🔒 The article by Stan Kaminsky summarizes practical hardening steps for on-premises Microsoft Exchange, emphasizing that Exchange Server Subscription Edition (Exchange SE) will be the only supported on-premises option in 2026 following the end of support for Exchange Server 2019. It outlines common attacker techniques — from password spraying and web shells to mail-flow rule abuse — and highlights immediate actions like migrating to Exchange SE or obtaining Extended Security Updates, applying regular Cumulative Updates, and enabling the Emergency Mitigation service. Recommendations also cover baseline configuration, EDR/EPP deployment, modern authentication, Kerberos adoption, TLS and HSTS, administrative access controls, PowerShell stream signing and protections for forged mail headers.

🔒 The NordVPN Black Friday promotion offers up to 77% off select plans, including a highlighted 27‑month Basic package priced at $80.73 and a 2‑year plan with three extra months free. Running from October 16 through December 10, the deal activates automatically via the article link with no promo codes. NordVPN emphasizes fast NordLynx speeds, a strict no‑logs policy, and bundled extras like Threat Protection and NordPass.

⚡ Amazon SageMaker HyperPod now offers Managed Tiered KV Cache and Intelligent Routing to optimize LLM inference for long-context prompts and multi-turn conversations. The two-tier cache combines local CPU memory (L1) with disaggregated cluster storage (L2) — with AWS-native tiered storage recommended and Redis optional — to reuse computed key-value pairs and reduce recomputation. Intelligent Routing directs requests using prefix-aware, KV-aware, or round-robin strategies, while built-in observability integrates with Amazon Managed Grafana and deployment is enabled via InferenceEndpointConfig or SageMaker JumpStart.

🔐 This post introduces the AWS provider for the Secrets Store CSI Driver and the new Amazon EKS add-on that mounts Secrets Manager secrets and Systems Manager parameters as files in Kubernetes pods. The add-on simplifies installation compared with Helm or kubectl, supports EC2 and hybrid nodes, and includes security patches and FIPS endpoint options. The walkthrough covers prerequisites, creating a test secret, installing the add-on, configuring an IAM role and EKS Pod Identity association, deploying an example pod that mounts the secret at /mnt/secrets-store, validating retrieval, and cleaning up resources.

🛠️ Amazon SageMaker HyperPod now supports custom Kubernetes labels and taints configured at the instance group level via the CreateCluster and UpdateCluster APIs. You can specify up to 50 labels and 50 taints per instance group using the KubernetesConfig parameter. HyperPod automatically applies and preserves these settings across node creation, replacement, scaling, and patching, eliminating manual kubectl work and ensuring device plugin pods (EFA, NVIDIA) schedule correctly while allowing NoSchedule taints to protect costly GPU nodes.

📦 AWS announced a new warm storage tier for Amazon Kinesis Video Streams, offering lower-cost storage for extended media retention while preserving sub-second access latency. The existing standard tier is now designated the hot tier and remains optimized for real-time, short-term use. Developers can configure fragment sizes to trade latency for ingestion cost, and both tiers integrate with Amazon Rekognition Video and Amazon SageMaker for continuous video analytics. The warm tier is available in all supported regions except AWS GovCloud (US).

🔒 Amazon Aurora PostgreSQL-Compatible Edition now supports PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22, bringing community fixes plus Aurora-specific enhancements. The release introduces database-level Dynamic Data Masking (DDM) for 16.10 and 17.6 to mask sensitive column values at query time using role-based policies without altering stored data. Additional updates include a shared plan cache, improved performance and recovery-time-objective (RTO), and more reliable Global Database switchovers. New clusters can be created in the Amazon RDS console or existing databases upgraded; releases are available across all commercial AWS Regions and AWS GovCloud (US).

🔐 The AWS API MCP Server is now available on AWS Marketplace, enabling customers to deploy the Model Context Protocol (MCP) server to Amazon Bedrock AgentCore as a managed offering. The marketplace deployment provides built-in authentication (SigV4 or JWT), session isolation, and simplified container management while enabling configurable IAM roles and network settings to meet enterprise security requirements. Customers also benefit from AgentCore's logging and monitoring capabilities and regional availability where Bedrock AgentCore is supported.

🔒 Amazon S3 Block Public Access now supports organization-level enforcement via AWS Organizations, enabling centralized standardization of public-access settings across member accounts. When attached at a root or OU the single policy configuration propagates to existing and new accounts, or it can be targeted to specific accounts for granular control. Policy attachment and enforcement are auditable through AWS CloudTrail, and the feature is available in the console and via CLI/SDK in supported regions at no additional charge.

🔒 Amazon CloudWatch now lets you enable deletion protection on log groups to prevent accidental or unintended removals. Once enabled, a log group cannot be deleted until protection is explicitly turned off, helping preserve audit, compliance, and operational logs. The feature is available in all AWS commercial Regions and can be configured during creation or applied to existing groups via the Console, AWS CLI, AWS CDK, and AWS SDKs.

🔔 AWS now supports Apache Iceberg V3 deletion vectors and row lineage across key analytics services. These features — available in Amazon EMR 7.12, AWS Glue, SageMaker notebooks, Amazon S3 Tables, and the AWS Glue Data Catalog — accelerate data modifications and make it simpler to identify changed records. Enable V3 by setting the table property 'format-version = 3' in CREATE TABLE or by updating table metadata; supported AWS query engines will automatically use deletion vectors and row lineage.

🔔 AWS Health introduced two new event schema properties — actionability and persona — to help customers identify and prioritize operational notifications. Delivered via the AWS Health API and Health EventBridge, these fields let organizations programmatically flag events that require customer action and route them to relevant teams such as security or billing. Available across all AWS Commercial and GovCloud (US) Regions, the change streamlines integrations with monitoring, ticketing, and automation systems to improve triage and remediation workflows.

🔔 AWS announced that AWS Compute Optimizer now provides idle resource recommendations for NAT Gateways, helping identify unused NAT Gateways and realize potential cost savings. The feature flags NAT Gateways that show no traffic over a 32-day analysis period by evaluating CloudWatch metrics such as active connection count and incoming packet metrics. Compute Optimizer also checks Route Table associations to avoid recommending critical backup resources and surfaces estimated savings and utilization details for validation before remediation.

🚀 Amazon SageMaker HyperPod is now generally available with new programmatic APIs that let administrators reboot or replace cluster nodes at scale. The BatchRebootClusterNodes and BatchReplaceClusterNodes APIs provide an orchestrator-agnostic way to recover unresponsive or degraded nodes for both Slurm and EKS clusters. Each API supports batch operations for up to 25 instances and complements existing orchestrator-specific workflows. The capabilities are currently available in US East (Ohio), Asia Pacific (Mumbai), and Asia Pacific (Tokyo) and are accessible via the AWS CLI, SDKs, or API calls.

⚡ Enabling the accelerated recovery option for Amazon Route 53 public hosted zones gives customers a predictable 60-minute recovery time objective (RTO) to regain the ability to modify public DNS records if AWS services in US East (N. Virginia) are temporarily unavailable. The feature is available globally except in GovCloud and China, and there is no additional charge. It supports faster DNS change operations for banking, FinTech, and SaaS customers to meet continuity and disaster recovery objectives.

🔒 Microsoft will strengthen the Entra ID browser sign-in experience starting mid-to-late October 2026 by enforcing a stricter Content Security Policy that permits scripts only from Microsoft-trusted CDN domains and approved inline sources. The change applies to sign-ins at login.microsoftonline.com; Microsoft Entra External ID is not affected. Administrators should test sign-in flows, remove code-injecting extensions and review developer-console violations to identify and address dependencies before the rollout.

🔍 The excerpt, from House of Huawei, recounts Wan Runnan’s experience as a celebrated 1980s entrepreneur who later fled China after supporting the 1989 pro‑democracy protests. At a late‑1980s dinner, local officials told him the Ministry of State Security planned to embed agents in tech firms under the pretext of protection, particularly in roles handling international relations. Wan reports that similar approaches were made to other companies and says Huawei, then a small Shenzhen startup, almost certainly would not have been exempt. He warns that telecommunications back‑end platforms are uniquely able to enable state eavesdropping, a rare public glimpse into intelligence ties with industry.

🔐 Passwork 7 is a self-hosted password and secrets manager designed for enterprise teams, combining a user-facing password vault with a programmatic secrets management system. It introduces a flexible vault architecture (user, company, and custom vault types), granular RBAC, secure internal and external sharing, and comprehensive audit trails. The platform supports SSO/LDAP, an API-first model with a Python connector, CLI and Docker deployment, and a zero-knowledge encryption mode to keep data encrypted client-side. Passwork 7 targets organizations seeking unified human and machine credential governance with self-hosting and compliance controls.

🔒 Amazon Bedrock now offers a Reserved service tier that provides prioritized compute and guaranteed input/output tokens-per-minute capacity for inference workloads. Customers can reserve asymmetric input and output capacities to match workload patterns, and excess traffic overflows automatically to the pay-as-you-go Standard tier to keep operations running. The tier targets 99.5% model response uptime and is available today for Anthropic Claude Sonnet 4.5, with 1- or 3-month reservations billed monthly at a fixed price per 1K tokens-per-minute.