Platforms
In a post from AWS, Amazon Bedrock added Batch inference for Anthropic’s Claude Sonnet 4 and OpenAI’s GPT‑OSS family (120B and 20B). The update targets high‑volume, asynchronous workloads such as bulk document analysis, large‑scale summarization, categorization, and structured extraction. AWS positions Batch as a cost‑optimized path—roughly half of on‑demand inference pricing—while expanding observability by publishing Batch metrics to CloudWatch, including pending and processed records, tokens per minute for all models, and Claude‑specific tokens pending. Teams planning evaluation campaigns or cost‑sensitive pipelines can submit, monitor, and retrieve results through the Bedrock API, but should confirm region and model availability before deployment.
AWS also introduced a compute checksum operation for S3 Batch Operations to verify large datasets at scale without restoring or downloading objects. Operators can run integrity jobs across billions of objects using manifests or bucket filters, with algorithms including SHA‑1, SHA‑256, CRC32, CRC32C, CRC64, and MD5. The service produces detailed reports across storage classes and regions, supporting audits, compliance attestations, and preservation workflows while reducing time and operational overhead for integrity checks.
For resilience testing, AWS enabled Fault Injection Service (FIS) network disruption actions against S3 Express One Zone directory buckets. The action deliberately times out data‑plane requests so teams can observe failover and recovery when an Availability Zone issue impairs access. It is also included in the FIS “AZ Availability: Power Interruption” scenario to simulate multi‑service impact. The capability supports console, CLI, and API‑driven experiments to validate alerting, runbooks, and architectural choices for latency‑sensitive workloads that trade single‑AZ performance for operational readiness.
Infrastructure options expanded in regulated environments as AWS brought Amazon RDS io2 Block Express to both AWS GovCloud (US‑West) and (US‑East), targeting mission‑critical databases with consistent sub‑millisecond latency, up to 256,000 Provisioned IOPS, 4,000 MB/s throughput, volumes to 64 TiB, and 99.999% durability. In parallel, AWS added default‑x86_64 and default‑arm64 instance‑type options for AWS Batch managed compute environments, allowing automatic selection of cost‑effective EC2 generations in enabled, valid environments. Both updates aim to reduce operational friction—one for database performance and durability in isolated regions, the other for cost and capacity management in batch compute.
For database lifecycle planning, AWS designated Aurora MySQL 3.10 (aligned with MySQL 8.0.42) as a long‑term support minor release. Clusters that opt in can remain on the same minor version for at least three years or until the major engine’s standard support ends, receiving only focused patches for select high‑severity security and operational issues. The LTS designation joins Aurora MySQL 3.04 and is available wherever Aurora is offered, providing a predictable support horizon for teams that prioritize stability over rapid feature adoption.
Patches
CISA added CVE‑2025‑54948—an OS command injection flaw in Trend Micro Apex One—to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under BOD 22‑01, Federal Civilian Executive Branch agencies must remediate KEV‑listed issues by the specified due date, and CISA urges all organizations to prioritize fixes. Recommended steps include applying vendor patches or mitigations, validating remediation, updating asset inventories to locate affected deployments, and preparing incident response if compromise indicators appear.
Incidents
Microsoft analyzed PipeMagic, a modular in‑memory backdoor attributed to financially motivated actor Storm‑2460 and observed alongside exploitation of CVE‑2025‑29824 in ransomware activity. The framework generates a host ID, uses a named pipe (\\.\\pipe\\1.<BotID>) to receive encrypted PE modules, and manages payload lifecycle through four doubly linked lists. A network component is XOR‑decrypted and aPLib‑decompressed in memory to establish WebSocket‑style C2, report host telemetry, and execute commands for module management, process enumeration, data collection, and self‑deletion. Microsoft outlines mitigations including tamper and network protection, EDR block mode, automated investigation, cloud‑delivered protection, and vulnerability assessment for CVE‑2025‑29824, and provides selected indicators for hunting.
Research
A report from Check Point details EchoLink, a zero‑click issue in Microsoft 365 Copilot that can extract sensitive tenant data without user interaction. The analysis frames a class of AI‑era exploits operating invisibly and at machine speed, emphasizing the need for timely vendor patches, robust telemetry ingestion, AI‑aware behavioral analytics, and rehearsed response playbooks to limit exfiltration and dwell time.
ESET documents AI‑powered investment scams flooding social platforms with deepfake endorsements and cloned news, citing a 335% rise in Nomani threats between H1 and H2 2024 and more than 8,500 related domains blocked. The write‑up notes roughly $6.6 billion in reported investment‑fraud losses and outlines red flags and practical steps for users: avoid unsolicited finance ads, verify claims through official channels, never share credentials after following an ad, and contact providers and law enforcement quickly if exposure is suspected.