Platform providers leaned into verifiable trust and automated defenses, with Cloudflare shifting bot protection to per-customer models and AWS delivering EC2 instance attestation for cryptographic runtime assurance. These moves target integrity and resilience at scale while teams continue to contend with fast-moving supply chain risks and high‑impact vulnerabilities.
Platform trust and bot defense advance
Apple is pushing memory safety into hardware. As described by Schneier.com, Memory Integrity Enforcement operationalizes Arm’s tagging concepts on iPhone 17 to generate and check allocation tags on every access. When tags fail to match, the system blocks access, terminates the offending process, and logs diagnostic data. Apple positions the feature to raise the cost of exploiting memory‑unsafe code without noticeable performance impact, a step that aligns with broader industry momentum to shift some memory protections into silicon.
Cloudflare is also moving detection closer to context. Its new per‑customer behavioral bot defenses train a unique model per zone, baseline normal traffic, and detect deviations that global signatures might miss. The company says these detections—integrated into Super Bot Fight Mode and Enterprise Bot Management—flagged hundreds of millions of requests in closed beta and surfaced activity that prior bot scoring would have missed. The approach blends bespoke, zone‑level intelligence with global fingerprinting and heuristics to help teams challenge, rate‑limit, or block automation without degrading user experience.
Governance gets attention too: Cloudflare introduced Application Confidence Scorecards to help security and GRC teams assess SaaS and AI tools at a glance. According to Cloudflare, the scorecards produce two five‑point metrics that rate application security and privacy posture and AI‑specific controls (such as ISO 42001 alignment, authentication, rate limiting, and training data governance). The scores—derived from crawled documentation and LLM‑assisted extraction with analyst review—are integrated into the Application Library and are slated for future enforcement ties in Cloudflare One.
Attestation and incident response, built in
AWS announced general availability of EC2 instance attestation, allowing customers to cryptographically verify that an instance is running an expected AMI and configuration. Backed by NitroTPM and Attestable AMIs, the workflow compares a reference measurement embedded in the AMI with a runtime measurement from the instance; when they match, organizations gain strong assurance over software stack integrity. The capability integrates with KMS to restrict key operations to attested instances and is available in all AWS Commercial Regions, including GovCloud. The result is tighter supply‑chain and runtime integrity and a clearer path to enforce least‑privilege on sensitive workloads.
On operations, AWS detailed Security Incident Response, an AWS‑native managed service that automates triage on GuardDuty and Security Hub findings, escalates suspect activity to AWS CIRT via a secure portal, and coordinates investigation and containment with customer responders. The guidance covers prerequisites (Organizations, delegated administrators), configuration (finding sources, escalation frameworks), and operational preparation (RACI, IAM roles, tabletop exercises), positioning the service to augment in‑house SOC workflows and reduce mean time to resolution.
Software supply chain under pressure
CISA issued an alert on a widespread compromise of the npm ecosystem by a self‑replicating worm dubbed “Shai‑Hulud.” The advisory reports more than 500 packages were poisoned as the actor reused developer credentials to impersonate maintainers and publish malicious updates. After initial access, malware scanned for sensitive secrets—GitHub Personal Access Tokens and cloud keys for AWS, Google Cloud, and Azure—exfiltrating them before using the stolen credentials to publish more tainted packages, driving rapid propagation. Recommended mitigations in CISA’s alert include a full dependency review, pinning to known‑safe releases prior to September 16, rotating developer credentials, enforcing phishing‑resistant MFA, and hardening GitHub configurations and monitoring.
In parallel, GitHub is tightening npm publishing safeguards. As reported by BleepingComputer, upcoming changes require two‑factor authentication for local publishing, enforce granular short‑lived publishing tokens (seven‑day lifetime) with default disallow, deprecate classic tokens and TOTP‑based 2FA in favor of FIDO/WebAuth, and promote trusted publishing to eliminate embedded long‑lived credentials in CI/CD. The controls follow campaigns that compromised maintainers and injected malicious packages, and aim to reduce credential theft and token reuse across build systems.
Advisories and active threats
SolarWinds released a hotfix for a critical unauthenticated deserialization flaw in Web Help Desk tracked as CVE‑2025‑26399. According to The Hacker News, the bug is a patch bypass of earlier fixes (CVE‑2024‑28988/28986) in the AjaxProxy component and carries a CVSS 9.8 remote code execution risk. While there is no public evidence of exploitation of this latest bypass, prior iterations were weaponized; administrators should upgrade to 12.8.7 HF1 and review logs and network controls around AjaxProxy endpoints.
CISA also published an ICS advisory for AutomationDirect’s CLICK PLUS PLCs, detailing multiple vulnerabilities—including cleartext storage of sensitive data, hard‑coded AES keys, insecure RSA, predictable PRNG seeds, authorization bypass in KOPR, and DoS conditions. Firmware v3.80 addresses affected versions prior to v3.71. The advisory urges minimizing network exposure of control devices, segmenting control networks, and implementing secure remote access while updates are applied. See CISA for full details.
Separately, Cloudflare reported mitigating a record 22.2 Tbps, 10.6 billion pps DDoS attack that lasted about 40 seconds. The volumetric burst, described by BleepingComputer, highlights evolving attacker emphasis on extreme packet rates that can overwhelm stateful network functions even when bandwidth capacity exists.
Law enforcement activity also intersected with critical infrastructure risk. The U.S. Secret Service said it seized more than 300 SIM servers and roughly 100,000 SIM cards across the New York tri‑state area after anonymous telephonic threats toward senior officials near the UN General Assembly. As reported by The Hacker News, authorities warned the devices could enable disruption of telecom infrastructure, denial‑of‑service conditions, and encrypted communications among criminal networks; the investigation is ongoing.