Cloud platforms emphasized preventive controls while defenders faced urgent patching. AWS enabled hybrid post‑quantum key establishment by default for CloudFront and added a TLS‑only viewer policy, and Microsoft set October 2025 for Phase 2 of mandatory MFA across Azure Resource Manager operations. At the same time, a max‑severity flaw in BleepingComputer’s reporting on Argo CD and active exploitation of SAP S/4HANA highlighted the patching backlog, as detailed by The Hacker News.
Cloud edge, identity, and detection tighten
AWS is pushing defense forward at the edge. CloudFront now supports hybrid post‑quantum key establishment on client‑to‑edge TLS by default, and a new TLS1.3_2025 policy can enforce modern protocol use. The move reduces friction for adoption—no added cost—and lets teams future‑proof in‑transit encryption while validating viewer compatibility where strict TLS 1.3 is required. In parallel, GuardDuty expanded custom intelligence beyond IPs with entity lists for domains and combined IP/domain indicators; detections can now trigger on domain activity and suppression lists can reduce alert noise, easing multi‑Region operations. See AWS for details.
Microsoft will begin Phase 2 enforcement of mandatory MFA for Azure Resource Manager on October 1, 2025, with a gradual rollout. The requirement covers any client performing resource management actions—including Azure CLI, PowerShell, SDKs, REST APIs, and IaC tools—while excluding workload identities such as managed identities and service principals. Administrators should enable MFA ahead of enforcement, test built‑in policy definitions in audit mode to gauge impact, and update clients (Azure CLI 2.76 and Azure PowerShell 14.3 or later) to ensure compatibility; Global Administrators can postpone deadlines if needed.
Operations and troubleshooting also get updates. Google Cloud introduced Gemini Cloud Assist Investigations (public preview) to accelerate root‑cause analysis for Dataproc and Serverless for Apache Spark by correlating logs, Spark UI metrics, configuration, and cross‑product telemetry into role‑aware summaries and recommendations. And for patch governance, AWS added support in Amazon RDS for Microsoft’s latest SQL Server GDRs (2016 SP3, 2017 CU31, 2019 CU32, 2022 CU20), addressing CVE‑listed issues; teams should snapshot, validate in staging, and schedule upgrades within maintenance windows.
Critical flaws and active exploitation
A CVSS 10.0 issue in Argo CD (CVE‑2025‑55190) allows API tokens with project‑level get permissions to retrieve sensitive repository credentials via the project details endpoint. The vulnerability undermines isolation controls and increases risk that low‑privilege tokens expose usernames and passwords, enabling cloning of private repositories and potential supply‑chain manipulation. Fixes are available in versions 3.1.2, 3.0.14, 2.14.16, and 2.13.9; administrators should upgrade promptly, audit token scopes, consider rotating repository credentials, and review recent access for misuse, per BleepingComputer.
Exploitation is underway against SAP S/4HANA (CVE‑2025‑42957, CVSS 9.9), where a command‑injection flaw exposed via RFC permits arbitrary ABAP code execution with low‑privileged accounts. Observed attacks can yield full system compromise—creation of SAP_ALL superusers, database modification, password hash exfiltration, and business process tampering. Mitigations include immediate patching from SAP’s August updates, monitoring for suspicious RFC activity and new administrative users, enforcing network segmentation and backups, implementing SAP UCON to restrict RFC use, and auditing access to authorization object S_DMIS activity 02, according to The Hacker News.
The U.S. CISA directed agencies to update Sitecore by September 25, 2025, following active exploitation of a critical deserialization bug (CVE‑2025‑53690). Attackers abused default or publicly exposed ASP.NET machine keys—some from older deployment guides—to conduct ViewState deserialization and deploy a reconnaissance payload (WEEPSTEEL), then moved to privilege escalation and Active Directory abuse. Guidance includes rotating machine keys, hardening configurations, removing public exposure, and performing comprehensive compromise assessments; new deployments auto‑generate unique keys, per The Hacker News. Why it matters: reliance on sample or shared keys turns configuration debt into remote code execution risk.
Supply‑chain abuse and evasive lures
Between August 26 and 31, attackers weaponized a flawed GitHub Actions workflow in the Nx repository to publish a malicious npm release containing a post‑install backdoor that stole tokens, SSH keys, .env files, and crypto wallets—then exfiltrated data to public “s1ngularity‑repository” projects. Notably, the malware leveraged installed AI CLI tools to craft prompts that helped locate secrets, with iterations showing role‑prompting and occasional refusals. A review attributed impact to 2,180 accounts and 7,200 repositories across three phases; mitigations included removing packages, revoking tokens, enforcing two‑factor authentication, adopting npm’s Trusted Publisher model, and adding manual approvals for PR‑triggered workflows, per BleepingComputer.
Supply‑chain risks also surfaced in the npm ecosystem. Socket researchers found four malicious packages impersonating Flashbots tooling that steal Ethereum private keys and mnemonic phrases, with one library exfiltrating environment variables over SMTP and redirecting unsigned transactions to attacker addresses while remaining functionally plausible. Others exfiltrate seed phrases to a Telegram bot and provide modular data theft mechanics. The packages were still available at analysis time, underscoring the need to vet package provenance and scrutinize code paths that handle secrets, according to The Hacker News.
Phishing tradecraft continued to blend content and behavior. VirusTotal’s AI Code Insight support for SVGs uncovered a campaign hiding JavaScript inside SVG files to render a fake Colombian judicial portal, luring victims to download a password‑protected ZIP. Executing a renamed legitimate browser sideloaded a malicious DLL, enabling follow‑on payloads. The feature expansion led to 523 additional SVGs being identified from the same campaign that had evaded signature‑based tools, per BleepingComputer. The takeaway: inspect vector formats and combine behavioral analysis with content inspection to surface embedded scripts.