Cloud providers emphasized performance and operational efficiency today. AWS made new memory- and network-optimized EC2 R8gn instances generally available, while Azure Container Storage released a major update designed to accelerate AI, databases, and stateful Kubernetes workloads. Alongside platform changes, vendors highlighted detection improvements and new integrations, and researchers detailed a Rowhammer technique that defeats DDR5 mitigations, underscoring ongoing hardware risk.
Platform performance and AI upgrades
AWS introduced EC2 R8gn, a memory- and network-optimized instance family powered by Graviton4 and 6th-generation Nitro Cards. The lineup scales to 48xlarge with up to 1,536 GiB of memory and up to 600 Gbps of network bandwidth, with Elastic Fabric Adapter on larger sizes. The positioning targets network-intensive, latency-sensitive applications such as databases and distributed systems; customers should validate sizing, EBS and network profiles, and cluster tuning to capture expected gains.
Microsoft unveiled Azure Container Storage v2.0.0, engineered for local NVMe on select VM families to deliver roughly 7× higher IOPS and ~4× lower latency versus the prior release. The update removes minimum cluster size requirements, introduces an open-source local CSI driver, and eliminates per‑GB fees for larger pools, broadening use across production, dev/test, and edge scenarios. The release aims to speed AI inference and database performance, simplify operations, and expand deployment flexibility.
For teams operationalizing custom models, Amazon Bedrock added on-demand deployment for customized Meta Llama models, letting customers serve real-time inference without pre‑provisioned endpoints. The pay‑as‑you‑go option can lower costs for intermittent or variable traffic, with the usual trade‑offs around potential cold-start latency on highly latency‑sensitive workloads.
Google released an externalized build of its internal ML profiler as XProf, integrating into OpenXLA and supporting XLA-based frameworks such as JAX, PyTorch/XLA and TensorFlow/Keras. The Google Cloud update brings a trace viewer, memory viewer across multiple memory types, graph/HLO op profiling, roofline analysis, and faster loading of large profiles via a Cloud Diagnostics library that automates dependency packaging and TensorBoard provisioning.
OpenSearch 3.1 is now supported in Amazon OpenSearch Service, incorporating Lucene 10 for optimized vector indexing, memory‑mapped Faiss for efficiency, and improvements to range queries and high‑cardinality aggregations. New relevance tooling and hybrid search scoring refinements target both generative AI applications and traditional analytics.
On the desktop, Microsoft plans to automatically deploy the Microsoft 365 Copilot app to Windows devices with Microsoft 365 desktop clients starting in October and completing by mid‑November 2025 (EEA excluded). The change, communicated via a message center update, centralizes access to Copilot experiences and can be opted out at the tenant level. Organizations should prepare helpdesk communications, review deployment policies, and test in rings to limit user disruption. Details are in BleepingComputer.
Detection and response integrations
AWS outlined how GuardDuty protection plans and Extended Threat Detection work together to correlate telemetry from sources such as S3, EKS, runtime monitoring, RDS login profiling, and Lambda network activity. Extended Threat Detection is enabled by default, applies AI/ML to combine multi‑step signals into prioritized findings mapped to MITRE ATT&CK, and includes scenarios that show multi‑vector attack surfacing. A 30‑day trial per plan per account/region supports coverage evaluation.
Cloudflare and CrowdStrike connected Cloudflare One with Falcon Fusion SOAR to automate email and access containment and endpoint isolation. Out‑of‑the‑box connectors and prebuilt actions in Falcon enable playbooks that revoke tokens, update allow/block lists, adjust access policies, and isolate hosts based on detections, with bidirectional triggers via APIs and Logpush to accelerate SOC workflows.
Hardware and software weaknesses surface
Google detailed its support for DDR5 Rowhammer research, open‑sourcing FPGA-based test platforms and contributing to standardization efforts such as PRAC for deterministic row‑activation counting. In collaboration with ETH Zurich, researchers demonstrated an access pattern that bypasses enhanced Target Row Refresh on some DDR5 modules and achieved a privilege‑escalation exploit on a commodity system under lab conditions. Complementing this, BleepingComputer reported technical details of a new technique dubbed Phoenix that synchronizes with refresh behavior to induce bit flips across tested DDR5 chips, highlighting limits of probabilistic mitigations and the need for coordinated, deterministic defenses.
On mobile, CSOonline reported a critical vulnerability in Samsung’s Quramsoft image library that enables remote code execution when crafted images are processed and has been exploited in the wild. Samsung issued a September security update; organizations should prioritize patching managed and BYOD fleets and monitor for anomalous device activity. In manufacturing IT, CSOonline covered active exploitation of a deserialization flaw in Delmia Apriso across multiple releases, with calls to expedite updates and apply compensating controls due to operational complexity.
Incidents and targeted campaigns
BleepingComputer reported that FinWise Bank disclosed an insider incident affecting American First Finance customers after a former employee accessed systems post‑termination, with 689,000 individuals noted in a partner notification. The bank engaged external investigators and is offering credit monitoring. Separately, BleepingComputer covered Google’s confirmation that a fraudulent account briefly accessed its Law Enforcement Request System portal before being disabled; the company said no requests were submitted and no data was accessed.
The Hacker News highlighted IBM X‑Force research attributing a Thailand‑focused campaign to Mustang Panda, including a USB worm (SnakeDisk) that drops the Yokai backdoor and geofences execution to Thai IP addresses. In broader commodity malware operations targeting Chinese‑speaking users, The Hacker News and partners documented SEO poisoning and abuse of legitimate hosting to deliver RAT families such as HiddenGh0st, Winos, kkRAT, and FatalRAT via trojanized installers and DLL sideloading.
On credential theft, CSOonline covered Okta’s analysis of a PhaaS framework dubbed VoidProxy that runs adversary‑in‑the‑middle phishing against Microsoft, Google, and multiple SSO providers to capture credentials, MFA responses, and session cookies. Recommended defenses include phishing‑resistant authentication, risk‑based access controls, and automated containment for suspicious sessions.