Platform teams rolled out performance and reliability enhancements while defenders confronted fresh software supply‑chain compromises. Google Cloud detailed a new Column Metadata (CMETA) index for BigQuery that prunes data blocks before scan, targeting major latency and cost reductions at extreme scale. At the same time, attackers hijacked widely used npm packages via a phished maintainer account, with BleepingComputer reporting malicious updates across modules with billions of weekly downloads.
Cloud platforms tighten performance and developer resilience
AWS expanded reliability features for large‑scale AI training with managed tiered checkpointing in SageMaker HyperPod, blending rapid in‑memory checkpoints with periodic durable snapshots to S3. The approach targets faster recovery after infrastructure interruptions and less I/O overhead during training, and integrates with PyTorch DCP with minimal code changes. Details and regional availability are outlined by AWS. In parallel, improvements to the Amazon Q Developer assistant inside SageMaker Unified Studio introduce broader chat and CLI support, plus Model Context Protocol integration for project‑aware automation and transparent resource usage, according to SageMaker. Why it matters: context‑aware assistance and faster checkpointing aim to reduce toil and improve recovery for ML teams operating at scale.
Google Cloud also highlighted a cloud‑first development path for automotive software with Horizon, an open‑source reference platform for Android Automotive OS. The tooling standardizes code‑build‑test pipelines, scales virtualized testing, and reports drastic build time reductions using innovations like ABFS and warmed caches, per Google Cloud. In the data plane, BigQuery’s new CMETA index (noted above) seeks substantial query pruning benefits without user management overhead.
Exploited enterprise ERP flaw demands urgent patching
A critical code‑injection vulnerability in SAP S/4HANA (CVE‑2025‑42957, CVSS 9.9) is under active exploitation despite vendor fixes released August 12. Reports describe low‑privileged abuse of an RFC‑exposed function to inject ABAP code, bypassing authorizations and potentially escalating to admin or OS‑level control. With S/4HANA central to finance and operations across industries, there is no workaround; organizations are urged to accelerate testing and deployment of the update, restrict and monitor RFC interfaces, and prepare incident response for potential compromises, per InfoSecurity. The takeaway: a month‑long patch cycle is mismatched against ongoing exploitation pressure.
Supply‑chain compromises widen across ecosystems
Two campaigns underscored the breadth of software supply‑chain exposure. In the npm ecosystem, a phished maintainer account pushed malicious updates to heavily used packages, injecting client‑side code that intercepts crypto‑related activity and rewrites destination addresses before users sign transactions—an operation researchers say manipulates page content and API calls across multiple layers. In parallel, the GhostAction operation abused GitHub Actions by injecting workflows that enumerated and exfiltrated secrets (npm/PyPI tokens, GitHub tokens, cloud keys) from at least 817 repositories, with an estimated 3,325 credentials stolen before takedown actions; outreach went to affected projects and platform security teams, according to BleepingComputer. Why it matters: CI/CD workflows and developer tokens remain high‑leverage pivots for adversaries, enabling silent package tampering and lateral access to cloud and SaaS environments.
Separately, new details on the Salesloft–Drift incident trace the breach to compromised GitHub access months earlier, with rogue workflows and later theft of OAuth tokens that were used against integrated customer platforms such as Salesforce and Google Workspace. Named organizations span multiple security vendors; remediation included isolating Drift, rotating credentials, and restoring integrations in a staged manner, reports BleepingComputer. The operational lesson is consistent: reduce token scope and lifetime, tighten integration controls, and monitor API activity for anomalies.
Intrusions, tooling, and confirmed breaches
On the malware front, Fortinet analyzed a phishing campaign deploying MostereRAT on Windows, chaining privilege escalation, service creation, and aggressive AV/EDR interference. The toolset supports 37 remote commands over mutually authenticated TLS, can seed legitimate remote‑access tools like AnyDesk/TightVNC, and establishes stealthy persistence while suppressing telemetry, per Fortinet. Researchers also documented a campaign that combines Google ads with crafted GitHub commit links to deliver a large MSI whose payloads are gated by GPU checks (GPUGate) to evade sandboxes; the sequence elevates privileges, tamps down Microsoft Defender, persists via scheduled tasks, and stages cross‑platform theftware, according to The Hacker News.
Confirmed breaches continued. Wealthsimple reported a third‑party software compromise that exposed contact details and government identifiers for approximately 30,000 customers; the firm notified regulators and is offering two years of monitoring and identity protection, per InfoSecurity. Furniture retailer Lovesac disclosed unauthorized access between February 12 and March 3 with personal information stolen; enrollment for 24 months of credit monitoring is available to notified individuals, according to BleepingComputer.
A broader view from a weekly digest highlights OAuth token theft tied to a third‑party integration, active exploitation of high‑risk CVEs including a Sitecore issue, and evolving tradecraft such as Outlook VBA backdoors and IIS‑focused redirectors. Mitigations emphasize rapid token revocation, shortest‑possible credential lifetimes, accelerated patching for known‑exploited bugs, and tighter monitoring of API/SaaS integrations, per The Hacker News. The through‑line is clear: minimize trust in automation pipelines and integrations, and assume adversaries will probe developer tooling as persistently as production systems.