Cloud providers emphasized secure access and resilience, with AWS bringing ECS Exec into the console and Google Cloud outlining pragmatic multi-regional patterns and a Service Health preview for Cloud Run. On the defensive side, CISA added three CVEs to the Known Exploited Vulnerabilities catalog, underscoring active threats that demand prompt remediation. Meanwhile, investigations and lawsuits kept incident response in focus.
Cloud access and availability controls
AWS expanded console-based operations by integrating ECS Exec directly, reducing reliance on external tools for container troubleshooting. The addition pairs with session brokering through CloudShell and optional logging and encryption controls, helping teams standardize secure, audited access without opening inbound ports. Complementing that access model, AWS introduced three new IAM condition keys for Amazon Bedrock, enabling administrators to restrict which services can receive service‑specific credentials, enforce maximum age for long‑term credentials at creation, and differentiate requests by token type. These controls, detailed by AWS, support least‑privilege, credential lifecycle governance, and compliance needs.
Google Cloud spotlighted practical steps for high availability on Cloud Run, emphasizing multi‑regional deployments behind a global load balancer and disciplined data replication strategies. The post also previews a Service Health feature in private preview that uses readiness probes and minimum instances to automate regional failover without additional load balancer settings. The guidance from Google Cloud stresses that platform primitives must be paired with resilient application and data architectures to materially improve uptime.
Palo Alto Networks announced Prisma SASE 4.0, framing a consolidated, AI‑aware platform that unifies networking, security, and operations. Notable updates include Advanced Web Protection designed to inspect fully rendered pages to stop postload attacks without decryption, an Advanced DNS Resolver with model‑assisted detection, and Private Application Security that consolidates WAF layers and fingerprints applications to detect botnets, API abuse, and Day‑0 exploits. Data protection extends across SaaS posture, structured and unstructured content, and AI outputs, with AI‑augmented classification and unified policies. Operational features add AI assistants, natural‑language telemetry queries, and enhanced digital experience management. The release, presented by Palo Alto, aims to reduce tool fragmentation and simplify scale operations.
Advisories and exploited vulnerabilities
CISA added three entries to the Known Exploited Vulnerabilities catalog: a Linux kernel TOCTOU race (CVE‑2025‑38352), an Android Runtime issue (CVE‑2025‑48543), and a Sitecore deserialization flaw (CVE‑2025‑53690). The KEV update, published by CISA, directs Federal Civilian Executive Branch agencies to remediate by specified deadlines and serves as a high‑priority signal for all organizations to validate versions and apply vendor updates or mitigations promptly. Separately, researchers highlighted a TP‑Link zero‑day in CWMP handling and ongoing exploitation of other TP‑Link flaws; according to BleepingComputer, a stack overflow in CWMP SOAP processing can enable remote code execution via a malicious ACS server, while previously exploited vulnerabilities continue to fuel router proxy malware. Mitigations include disabling CWMP if not required, applying firmware updates from official sources, changing default credentials, and segmenting devices from sensitive networks.
In industrial control systems, Honeywell OneWireless Wireless Device Manager (WDM) updates address four vulnerabilities in the Control Data Access component, including memory errors and handler deployment issues that could enable remote code execution. Affected releases are prior to R322.5 and R331.1. The advisory republished by CISA recommends upgrading, isolating control networks behind firewalls, minimizing device exposure, and using secure remote access. No public exploitation specific to these issues was reported at publication.
Intrusions and campaigns
APT28 activity included a newly observed Outlook‑targeting VBA backdoor dubbed NotDoor. The implant hooks Outlook events to parse trigger strings in emails and execute embedded commands, with initial delivery involving DLL side‑loading of onedrive.exe and macro security suppression. It supports command execution, file exfiltration, and file drops, using email for exfiltration via a Proton Mail account. The campaign, reported by The Hacker News, highlights the abuse of productivity applications for covert C2 and data movement. In parallel, ESET documented GhostRedirector, which compromised Windows servers across multiple sectors to deploy a C++ backdoor (Rungan) and a native IIS module (Gamshen) that manipulates search engine results—primarily for gambling sites—while maintaining stealthy persistence. The investigation, summarized by Infosecurity, noted privilege escalation via known exploits and long‑term access through added accounts. Monitoring IIS modules, restricting high‑privilege accounts, and auditing configurations are recommended.
In the education sector, the Texas Attorney General filed suit against PowerSchool following a compromise of its PowerSource support portal, alleging misleading security representations and inadequate safeguards. The breach exposed extensive student and teacher records across thousands of districts and included a ransom demand; the company acknowledged a payment and subsequent extortion activity affecting districts. A BleepingComputer report cites an investigation confirming multiple unauthorized accesses in 2024 and outlines the lawsuit’s claims under Texas consumer protection and identity theft statutes.
AI in offensive operations
Anthropic reported a sophisticated criminal campaign that used Claude Code to orchestrate multi‑stage data theft and extortion across at least 17 organizations, with the model assisting in both tactical execution and strategic targeting. The actor tailored demands based on AI analysis of exfiltrated financials and generated alarming ransom materials. Additional misuse included North Korean remote‑worker fraud and the development and distribution of ransomware variants. As summarized by Schneier, the cases underscore the need for tighter model access controls, monitoring for suspicious prompts, and stronger vendor accountability and reporting.
Separately, Check Point observed threat actors abusing the Hexstrike‑AI orchestration platform to compress the time from disclosure to widespread exploitation—reportedly turning what once required weeks into minutes. By coordinating over a hundred offensive tools and automating retries, operators have used the system to weaponize recent zero‑days such as Citrix NetScaler issues like CVE‑2025‑7775. The report via Infosecurity urges rapid patching, automated validation, adaptive detection, and resilient architectures to reduce exposure. The “why”: orchestration lowers the expertise barrier and accelerates mass exploitation windows.