Cloud migration and AI services advanced alongside fresh risk guidance. AWS introduced more flexible network management for VMware migrations and broadened target region coverage, while Amazon Bedrock became available in Jakarta with built-in governance controls. At the same time, CISA warned operators about a critical hard-coded-credential flaw in SunPower PVS6 inverters, urging immediate mitigations.
Platform migrations and AI reach expand
AWS Transform for VMware adds the ability to modify VPC CIDR ranges during migrations, automatically propagating changes across dependent resources such as subnets, security groups, routes, and target instances. Teams can preserve source IPs, align to new CIDRs, or rely on DHCP, reducing manual reconfiguration and IP conflict risk when on‑premises and cloud workloads run concurrently. As an agentic AI service, Transform automates discovery, migration wave planning, network configuration, and server moves; support now includes US East (Ohio) and two European regions, expanding lift‑and‑shift and hybrid options. The practical effect is simpler network planning and reduced cutover risk, provided teams validate app connectivity, firewall rules, DNS, and other IP‑bound dependencies as part of runbooks.
Amazon Bedrock is now in the Asia Pacific (Jakarta) Region, bringing local access to a managed platform that aggregates foundation models via one API and offers Guardrails and model customization to shape outputs. Regional hosting aims to cut inference latency and support data residency and sovereignty needs, with tighter integration into IAM, encryption, logging, and monitoring across the AWS ecosystem. The expansion can speed regulated deployments, but customers should still assess data handling, retention, and third‑party model terms, and plan for model selection, testing, and cost management.
Critical ICS flaw exposed in SunPower PVS6
CISA detailed a critical issue in SunPower PVS6 inverters (CVE-2025-9696) stemming from hard‑coded credentials in the BLE interface. With BLE parameters fixed and publicly exposed, an attacker in Bluetooth range could access the servicing interface to replace firmware, disable power production, alter grid and firewall settings, create persistent SSH tunnels, and manipulate connected devices. The CVSS v4 base score is 9.4; there are no confirmed reports of public exploitation and the vulnerability is not internet‑exploitable. SunPower did not respond during coordination and no patch details are available; operators should contact the vendor, survey sites for BLE exposure, and disable BLE where feasible. CISA advises isolating control networks, minimizing network exposure, using VPNs only as needed for remote access, performing risk assessments before changes, and deploying targeted intrusion detection aligned to ICS best practices.
OAuth token theft hits Salesforce integrations
According to Cloudflare, compromised OAuth credentials from a third‑party integration allowed access to its Salesforce tenant, leading to exfiltration of support case text between August 12 and 17. Attachments were not accessed. Investigators found 104 platform‑issued API tokens in the exposed text and rotated them, shared indicators of compromise (including specific IPs and tooling), disconnected affected integrations, and tightened controls and rotations. The company is notifying impacted customers and recommends revoking vendor integrations, rotating any credentials shared in support cases, enforcing least privilege, and monitoring for unusual exports or logins.
Unit 42 reports a coordinated campaign (August 8–18) that leveraged stolen OAuth tokens for the Salesloft Drift integration to mass‑exfiltrate Salesforce records across objects such as Account, Contact, Case, and Opportunity. Analysts observed anti‑forensics (deleted SOQL queries) and automated Bulk API use; Salesloft revoked active Drift tokens to force re‑authentication. Recommended actions include auditing Drift integrations, reviewing Salesforce Event Monitoring and UniqueQuery logs, checking identity provider and network telemetry, scanning for exposed secrets, rotating credentials, and prioritizing least‑privilege and Zero Trust controls. The focus on service‑to‑service tokens underscores a common SaaS blind spot where trusted integrations evade rule‑based detections.
Attack automation and high‑volume disruptions
Check Point describes HexStrike‑AI, an orchestration layer coordinating more than 150 AI agents to scan, identify, exploit, and persist in target environments, with claims that exploitation of complex, newly disclosed CVEs can drop from days to minutes. For defenders, that acceleration raises the premium on rapid patching, prioritization of high‑risk CVEs, and monitoring for webshells and automated persistence. In parallel, The Hacker News details a BYOVD campaign attributed to Silver Fox that abuses a Microsoft‑signed WatchDog anti‑malware driver to terminate protected processes and escalate privileges, delivering ValleyRAT. After a patch, the actor reportedly flipped a byte in the timestamp field to preserve signature trust while evading hash-based blocklists. Defenders should broaden signed‑driver behavior monitoring, enforce driver allow/block policies, validate driver integrity, and watch for anomalous process termination and C2 egress.
BleepingComputer reports Cloudflare mitigated a record volumetric DDoS peaking at 11.5 Tbps, a short‑lived UDP flood attributed primarily to traffic from cloud infrastructure; the event fits a wider rise in hyper‑volumetric attacks and emphasizes capacity planning and automated mitigation. Separately, BleepingComputer covers an attempted $130 million fraud at Sinqia’s Pix environment via stolen vendor credentials, prompting a halt in transaction processing and regulatory suspension of Pix access pending assurances. Both episodes point to a need for tighter controls on cloud‑origin traffic and vendor access, along with robust incident response to limit operational impact.