Cloud Security Advances: PQC, OCSF, Rollouts, and KEV Alerts

TwelveLabs Pegasus 1.2 Now in Three Additional AWS Regions

🚀 Amazon expanded availability of TwelveLabs Pegasus 1.2 to US East (Ohio), US West (N. California), and Europe (Frankfurt) via Amazon Bedrock. Pegasus 1.2 is a video-first language model optimized for long-form video understanding, video-to-text generation, and temporal reasoning across visual, audio, and textual signals. The regional rollout brings the model closer to customers' data and end users, reducing latency and simplifying deployment architectures. Developers can now build enterprise-grade video intelligence applications in these regions.

OpenAI Updates GPT-5 to Better Handle Emotional Distress

🧭 OpenAI rolled out an October 5 update that enables GPT-5 to better recognize and respond to mental and emotional distress in conversations. The change specifically upgrades GPT-5 Instant—the fast, low-end default—so it can detect signs of acute distress and route sensitive exchanges to reasoning models when needed. OpenAI says it developed the update with mental-health experts to prioritize de-escalation and provide appropriate crisis resources while retaining supportive, grounding language. The update is available broadly and complements new company-context access via connected apps.

Google Cloud's Roadmap to a Quantum-Safe Infrastructure

🔒 Google Cloud has been migrating its infrastructure toward post-quantum cryptography for nearly a decade to mitigate Store Now, Decrypt Later (SNDL) risks. The company has deployed the standards-based ML-KEM (FIPS 203) for key exchange across internal traffic and the Google Cloud networking stack, and introduced ML-KEM capabilities in Cloud KMS (preview) for key generation, encapsulation, and decapsulation. It also added native support for ML-DSA and SLH-DSA in Cloud KMS to protect long-lived digital signatures, and is phasing quantum-safe certificate support into Certificate Authority Service to enable future PQC-ready PKI. Administrators will receive tooling to opt in, audit cryptographic assets, and manage transitions to hybrid or pure PQC deployments as standards mature.

Amazon ECS Adds Built-in Linear and Canary Deployments

🚀 Amazon ECS now supports built-in linear and canary deployment strategies to give teams finer control over traffic shifts during container rollouts. Linear deployments shift traffic in equal percentage steps with configurable step percentage and step bake time, while canary deployments route a small portion of traffic to the new revision for a configurable canary bake time before completing the shift. Both strategies provide a post-deployment bake time, support deployment lifecycle hooks, and can use Amazon CloudWatch alarms to detect failures and trigger automated rollbacks. The feature is available in all commercial AWS Regions and is supported via Console, SDK, CLI, CloudFormation, CDK, and Terraform for services using ALB or ECS Service Connect.

Ex-L3Harris Executive Pleads Guilty to Selling Exploits

🔒 Peter Williams, a former general manager at L3Harris Trenchant, pleaded guilty in U.S. court to stealing and selling protected cyber-exploit components between 2022 and 2025. Prosecutors say he removed at least eight sensitive trade-secret exploit components intended for exclusive government use and sold them to a broker that works with the Russian government for $1.3 million in cryptocurrency. He now faces up to 10 years in prison and significant fines.

GitHub Universe 2025: Agents, AI, and Developer Tools

🚀 At GitHub Universe 2025, Microsoft and GitHub presented a vision for agentic development that lets developers see, steer, and build across autonomous agents. The event introduced platform capabilities like Agent HQ, a prompt-first AI Toolkit for VS Code, and the GA release of Azure MCP Server. Announcements focused on enterprise-grade security, standards-based integration, and faster, more intuitive agent creation and governance.

Amazon Managed Service for Prometheus Adds Anomaly Detection

🔍 Amazon Managed Service for Prometheus now includes anomaly detection using the Random Cut Forest (RCF) algorithm to continuously analyze time series and surface unexpected metric behavior with minimal user intervention. When you create an anomaly detector in an AMP workspace, it generates four derived time series that represent detected anomalies and their confidence values. Those derived series can be used to build dynamic alerting rules in the AMP Alertmanager and visualized alongside input metrics in self‑managed Grafana or Amazon Managed Grafana. The feature is available in all regions where AMP is generally available and is configurable via the AWS CLI, SDKs, or APIs.

Amazon Bedrock AgentCore Browser Adds Web Bot Auth Preview

🔐 Amazon Bedrock AgentCore Browser now previews Web Bot Auth, a draft IETF protocol that cryptographically identifies AI agents to websites. The feature automatically generates credentials, signs HTTP requests with private keys, and registers verified agent identities to reduce CAPTCHA interruptions and human intervention in automated workflows. It streamlines verification across major providers such as Akamai, Cloudflare, and HUMAN Security, and is available in nine AWS Regions on a consumption-based pricing model with no upfront costs.

AWS Serverless MCP Server Adds ESM Tools for Lambda

🔧 The AWS Serverless Model Context Protocol (MCP) Server now includes specialized tools to configure and manage AWS Lambda event source mappings (ESM), combining AI assistance with ESM expertise. The new toolset—comprising the ESM guidance tool, the ESM optimization tool, and an ESM Kafka troubleshooting tool—translates high-level throughput, latency, and reliability requirements into concrete ESM configurations and generates optimized AWS SAM templates. It also validates VPC network topology for VPC-based event sources and diagnoses common ESM issues to streamline setup, tuning, and troubleshooting workflows.

Amazon OCSF Ready Specialization for AWS Partners Program

🔒 Amazon today introduced the Amazon OCSF Ready Specialization to recognize AWS Partners that have technically validated their software to integrate with OCSF-compatible Amazon services and demonstrated customer success in production. The designation helps customers find pre-validated partner solutions that send or receive logs and security events in the OCSF schema, reducing integration complexity. Partners earn AWS Specialization Program benefits and signature support, including private strategy sessions and AWS guest speaker assistance. The specialization replaces and expands the prior Amazon Security Lake Specialization to broaden standardized security data interoperability.

Master Multitasking with the Jules Extension for Gemini CLI

🤖 The new Jules extension for Gemini CLI lets developers delegate routine engineering tasks—like bug fixes, dependency updates, and vulnerability patches—to an autonomous background agent. Jules runs asynchronously and can work on multiple GitHub issues in parallel, preparing fixes in isolated environments for review. It also composes with other extensions to automate security remediation, crash investigation, and unit test creation, returning ready-to-review branches so you can stay focused on higher-value work.

Conduent Confirms Data Breach Affects 10.5 Million People

🔒 Conduent has confirmed a 2024 data breach that state attorney general notifications indicate affected more than 10.5 million people. Reported exposed data includes names, Social Security numbers, full dates of birth, health insurance policy or ID numbers, and medical information. Conduent says the environment was first compromised on October 21, 2024 and discovered in January 2025; as of October 24, 2025 it reports no evidence the stolen data has been misused. Affected individuals are advised to obtain credit reports and consider fraud alerts or a security freeze; the company did not offer identity monitoring services.

CISA orders federal patch for VMware Tools privilege bug

⚠️ CISA has ordered Federal Civilian Executive Branch agencies to remediate a high-severity vulnerability in Broadcom's VMware Aria Operations and VMware Tools (CVE-2025-41244), patched by Broadcom in October 2024. The flaw enables a local, non-administrative user on a VM to escalate privileges to root when Aria Operations’ SDMP is enabled or when VMware Tools runs in credential-less mode. Agencies must patch within three weeks under BOD 22-01; CISA also urges all organizations to prioritize mitigations or discontinue affected products if no fix is available.

Critical Flaws in King Addons for Elementor Risk Takeover

⚠️ King Addons for Elementor, installed on over 10,000 WordPress sites, contains two unauthenticated critical vulnerabilities that can enable full site takeover. Patchstack identified an arbitrary file upload (CVE-2025-6327) and a registration-based privilege escalation (CVE-2025-6325) that allow remote attackers to place files in web-accessible directories and create administrative accounts. The vendor released version 51.1.37 to add a role allowlist, input sanitization, upload permission checks and stricter file-type validation — administrators should update immediately and verify whether the 'King Addons Login | Register Form' widget is active.

Chromium Blink flaw crashes Chrome, Edge; exploit published

⚠ A researcher, Jose Pino, published a proof-of-concept on October 29 demonstrating a Blink rendering-engine flaw that can crash Chrome, Microsoft Edge and several other Chromium-based browsers within seconds by flooding document.title updates. Pino says he reported the issue to Google on August 28 and, after no response, released the PoC to force public attention. The exploit saturates the main thread with millions of DOM mutations per second, producing rapid CPU spikes, tab freezes and eventual process termination, and it raises particular concern for headless and automated enterprise workflows.

Defense Contractor Pleads Guilty to Selling Zero-Days

🛡️ The former general manager of L3Harris cyber-division Trenchant, Australian national Peter Williams, pleaded guilty in a US district court to stealing and selling zero-day exploit components to a Russian cyber broker. Prosecutors allege he exfiltrated at least eight exploit components via encrypted channels in exchange for millions in cryptocurrency and follow-on support payments. Authorities say the code could be worth tens of millions and that the broker’s clients include the Russian government, creating a national security threat. Williams faces up to 20 years in prison and significant fines.

CISA and NSA Issue Hardening Guidance for Exchange

🔒 CISA and the NSA, joined by the Australian Cyber Security Centre and the Canadian Centre for Cyber Security, released guidance to harden on-premises and hybrid Microsoft Exchange servers against attacks. The advisory emphasizes stronger authentication, minimized application attack surfaces, robust TLS configurations, and decommissioning unsupported servers after migration to Microsoft 365. It also recommends enabling emergency mitigations and built-in anti-spam and anti-malware protections and restricting administrative access to authorized workstations.

Human Cost of UK Government's Afghan Data Leak Exposed

🔓 A leaked Ministry of Defence spreadsheet in February 2022 exposed thousands of Afghan nationals who assisted UK forces, and research from the charity Refugee Legal Support shows the fallout continues. Survivors report murder, torture, repeated home searches and persistent Taliban threats; 49 people are reported to have lost relatives or colleagues. Only a minority were offered relocation to the UK, underscoring how data leaks and inadequate responses can cause real, ongoing harm.

CISA Adds Two CVEs to Known Exploited Vulnerabilities

🔔 CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2025-24893 (XWiki Platform eval injection) and CVE-2025-41244 (Broadcom VMware Aria Operations and VMware Tools privilege-defined unsafe actions). Evidence indicates active exploitation and substantial risk to the federal enterprise. Under BOD 22-01, affected FCEB agencies must remediate by required due dates. CISA urges all organizations to prioritize timely remediation as part of routine vulnerability management.

PhantomRaven: Malware in 126 npm Packages Steals Tokens

⚠️ Koi Security has identified a supply-chain campaign dubbed PhantomRaven that inserted malicious code into 126 npm packages, collectively installed more than 86,000 times, by pointing dependencies to an attacker-controlled host (packages.storeartifact[.]com). The packages include preinstall lifecycle hooks that fetch and execute remote dynamic dependencies, enabling immediate execution on developers' machines. The payloads are designed to harvest GitHub tokens, CI/CD secrets, developer emails and system fingerprints, and exfiltrate the results, while typical scanners and dependency analyzers miss the remote dependencies because npmjs.com does not follow those external URLs.

WhatsApp Adds Passwordless Passkey Chat Backups now

🔒 WhatsApp is rolling out passkey-encrypted chat backups on iOS and Android, allowing users to secure backups with biometrics or a device screen lock instead of a password. Passkeys rely on a device-generated private/public key pair so the private key never leaves the device, reducing exposure to credential theft. Users can enable the feature under Settings > Chats > Chat backup > End-to-end encrypted backup. Meta has begun a global rollout that will reach users over the coming weeks and months.

AdaptixC2 Abused by Ransomware Operators Worldwide

⚠️ Silent Push reports a surge in malicious use of AdaptixC2, an open-source adversarial emulation framework that researchers say is now being delivered by the CountLoader malware as part of active ransomware operations. Deployments accelerated after new detection signatures were released, and public incident reports show increased sightings across multiple intrusions. Analysts flagged the developer alias RalfHacker and issued indicators covering Golang C2 traffic and unknown C++/QT executables.

Brash Exploit Crashes Chromium Browsers via Title API

⚠️ Security researcher Jose Pino disclosed "Brash", a severe flaw in the Blink rendering engine that can crash many Chromium-based browsers within 15–60 seconds via a single malicious URL. The root cause is missing rate limiting on the document.title API, enabling attackers to inject millions of DOM mutations per second and saturate the browser UI thread. Pino describes a three-phase technique — hash generation, burst injection, and UI-thread saturation — and warns the code can be time-triggered to act like a logic bomb. Affected products include Google Chrome, Microsoft Edge, Brave, Opera, Vivaldi, Arc, Dia, and some AI browser interfaces; Firefox and Safari are not vulnerable.

AWS announces EC2 Capacity Reservation Topology API

🚀 AWS has announced general availability of the Amazon EC2 Capacity Reservation Topology API, providing a hierarchical, per-account view of the relative location of capacity reservations for AI/ML and HPC workloads. The API represents reservations as a network node set so customers can assess proximity without launching instances. Paired with the Instance Topology API, it enables consistent job scheduling, capacity planning, and node ranking across distributed parallel workloads and is available in most major AWS regions.

Hitachi Energy TropOS Command Injection and Privilege Issues

⚠️ Hitachi Energy's TropOS wireless devices contain multiple vulnerabilities — including OS command injection and improper privilege management — that can be exploited remotely by authenticated users to obtain root access. Affected 4th Gen firmware versions up to 8.9.6.0 are vulnerable (CVE-2025-1036, CVE-2025-1037, CVE-2025-1038); CVSS v4 scores reach 8.7. Hitachi Energy advises immediate update to version 8.9.7.0, and CISA recommends isolating devices, minimizing network exposure, and following ICS security best practices.

AWS Backup: Single-step Cross-Region Snapshot Copy

🔁 AWS Backup now supports a single-action copy of database snapshots across AWS Regions and accounts for Amazon RDS, Amazon Aurora, Amazon Neptune, and Amazon DocumentDB. This eliminates the previous two-step process and removes the need for intermediate copies, custom scripts, or Lambda automation. The change reduces operational complexity and helps achieve faster RPOs while removing costs associated with intermediate snapshot storage. You can use the feature today via the AWS Management Console, AWS CLI, or AWS SDKs.

Agent Registry for Discovering and Verifying Signed Bots

🔐 This post proposes a lightweight, crowd-curated registry for bots and agents to simplify discovery of public keys used for cryptographic Web Bot Auth signatures. It describes a simple list format of URLs that point to signature-agent cards—extended JWKS entries containing operator metadata and keys—and shows how registries enable origins and CDNs to validate agent signatures at scale. Examples and a demo integration illustrate practical adoption.

Nation-state Hackers Breach Ribbon Communications' Network

🔒 In a filing with the SEC, Ribbon Communications disclosed that unauthorized actors, reportedly tied to a nation-state, had access to its IT network, with initial intrusion activity traced as far back as December 2024. The company detected the breach in September 2025, has worked to terminate access, and is collaborating with third-party cybersecurity experts and federal law enforcement. Ribbon says it has not yet found evidence of material corporate data theft, although attackers accessed customer files on two laptops outside the main network.

ISO 15118-2 SLAC Vulnerability in EV Charging Protocol

🔒 ISO 15118-2-compliant EV charging implementations using the SLAC protocol are vulnerable to spoofed measurements that can enable man‑in‑the‑middle attacks between vehicles and chargers, tracked as CVE-2025-12357 (CVSS v4 7.2). The issue is an improper restriction of communication channel (CWE-923) and may be exploitable wirelessly at close range via electromagnetic induction. ISO recommends using TLS (required in ISO 15118-20) with certificate chaining; CISA advises minimizing network exposure, isolating control networks, and using secure remote access methods.

Blueprint for Hardening Microsoft Exchange Servers

🔒 CISA, the NSA, and international partners released the Microsoft Exchange Server Security Best Practices blueprint to help administrators of on‑premises and hybrid Exchange environments strengthen defenses against persistent cyber threats. The guidance builds on CISA’s Emergency Directive 25‑02 and emphasizes restricting administrative access, implementing multifactor authentication, enforcing strict transport security, and adopting zero trust principles. It also urges organizations to remediate or replace end‑of‑life Exchange versions, apply recommended mitigations, and consider migrating to cloud-based email to reduce operational complexity and exposure.

Typosquatted npm Packages Deliver Cross-Platform Stealer

🚨 A multi-stage supply-chain campaign published ten typosquatted npm packages on July 4 that collectively reached nearly 10,000 downloads before removal, according to Socket. Each package abused npm’s postinstall lifecycle to open a new terminal, present a fake CAPTCHA prompt, and retrieve a PyInstaller-packed binary that harvests credentials from browsers, OS keyrings, SSH keys, tokens and cloud configuration files. The JavaScript installers combined four layers of obfuscation with social engineering to evade detection and delay scrutiny while exfiltrating collected secrets to the attacker’s host.

AI-Designed Bioweapons: The Detection vs Creation Arms Race

🧬 Researchers used open-source AI to design variants of ricin and other toxic proteins, then converted those designs into DNA sequences and submitted them to commercial DNA-order screening tools. From 72 toxins and three AI packages they generated roughly 75,000 designs and found wide variation in how four screening programs flagged potential threats. Three of the packages were patched and improved after the test, but many AI-designed variants—often likely non-functional because of misfolding—exposed gaps in detection. The authors warn this imbalance could produce an arms race where design outpaces reliable screening.

LinkedIn to Use EU, UK and Other Profiles for AI Training

🔒 Microsoft-owned LinkedIn will begin using profile details, public posts and feed activity from users in the UK, EU, Switzerland, Canada and Hong Kong to train generative AI models and to support personalised ads across Microsoft starting 3 November 2025. Private messages are excluded. Users can opt out via Settings & Privacy > Data Privacy and toggle Data for Generative AI Improvement to Off. Organisations should update social media policies and remind staff to review their advertising and data-sharing settings.

ThreatsDay: DNS Poisoning, Supply-Chain Heist, New RATs

🔔 This week's ThreatsDay bulletin highlights a critical BIND9 vulnerability (CVE-2025-40778) enabling DNS cache poisoning and a public PoC, along with widespread campaign activity from loaders, commodity RATs and supply-chain trojans. Other notable items include a guilty plea by a former defense employee for selling cyber-exploit components to a Russian broker, a new Linux Rust dual-personality evasion technique, and Avast's free decryptor for Midnight ransomware. Recommended defensive actions emphasize patching to the latest BIND9 releases, enabling DNSSEC, restricting recursion, and strengthening monitoring and authentication controls.

AWS releases AI agent context pack for Greengrass developers

🤖 AWS announced an open-source AI agent context package for AWS IoT Greengrass that provides ready-to-use instructions, examples, and templates to accelerate edge device application development. The package is published on GitHub under the Creative Commons Attribution Share Alike 4.0 license and is designed to integrate with generative AI tools such as Amazon Q. Developers can clone the repository to jumpstart creation, testing, and fleet-wide deployment workflows across supported Regions.

Amazon ECS Service Connect Adds Envoy Access Logs Support

🔍 Amazon ECS Service Connect now captures per-request telemetry with Envoy access logs to improve visibility into service-to-service traffic for tracing, debugging, and compliance. Access logging is enabled via the ServiceConnectConfiguration and emits Envoy logs to STDOUT alongside application logs, flowing through the existing ECS log pipeline without extra infrastructure. Query strings are redacted by default and the feature supports HTTP, HTTP/2, gRPC, and TCP protocols. The capability is available in all regions where Service Connect is supported.

Smashing Security Podcast 441: Poker, F1 Data Risks

🎧 In episode 441 Graham Cluley and guest Danny Palmer discuss an alleged poker scam that reportedly involved basketball players working with organised crime to cheat high‑stakes games using hacked shufflers, covert cameras and an X‑ray card table. Researchers also uncovered that an FIA driver portal could be probed to expose personal details of Formula 1 stars. The hosts close with Graham’s “Pick of the Week,” a surreal CAPTCHA browser game, and a lighter cultural segment.

Russian Ransomware Gangs Adopt Open-Source AdaptixC2

🔒 AdaptixC2, an open-source command-and-control framework, has been adopted by multiple threat actors, including groups tied to Russian ransomware operations, prompting warnings about its dual-use nature. The tool offers encrypted communications, credential and screenshot managers, remote terminal capabilities, a Golang server, and a cross-platform C++ QT GUI client. Security firms Palo Alto Networks Unit 42 and Silent Push have analyzed its modular capabilities and traced marketing activity to a developer using the handle RalfHacker. Observed abuse includes fake Microsoft Teams help-desk scams and an AI-generated PowerShell loader used to deliver post-exploitation payloads.

CISA Releases Microsoft Exchange Server Security Guide

🔐 Today, CISA, in collaboration with the National Security Agency and international partners, published Microsoft Exchange Server Security Best Practices to help defenders harden on-premises Exchange servers against ongoing exploitation. The guidance emphasizes strengthening user authentication and access controls, enforcing robust network encryption, and reducing application attack surfaces through configuration and feature management. CISA also urges organizations to decommission end-of-life or hybrid 'last Exchange' servers after migrating to Microsoft 365 to reduce exposure to continued exploitation.

Surge in NFC Relay Malware Targeting European Cards

📱Zimperium reports a sharp rise in Android apps abusing Host Card Emulation (HCE) to steal contactless payment card data across Eastern Europe. Researchers observed over 760 malicious APKs and 70+ command-and-control servers that capture EMV fields, respond to POS APDU commands, or forward requests to remote servers. Variants include data exfiltration to Telegram, relay toolkits, 'ghost-tap' real-time HCE manipulation, and fake payment apps impersonating Google Pay and regional banks. Users are advised to avoid sideloading APKs, restrict NFC permissions, run Play Protect, and disable NFC when not in use.

How Android Uses AI to Protect Users from Scams Globally

🔒 Android applies layered Google AI to anticipate and block mobile scams before they reach users. Built-in protections—such as Google Messages spam filtering and on-device Scam Detection, plus Phone by Google automatic call blocking and Call Screen—identify conversational scam patterns and surface real-time warnings. Android blocks over 10 billion suspected malicious calls and messages monthly and recently stopped more than 100 million suspicious numbers from using RCS. Protections are ephemeral, on-device where possible, and continuously updated to adapt to evolving threats.

Amazon GameLift Servers Adds Built-in Telemetry Metrics

📊 Amazon GameLift Servers now includes built-in telemetry metrics across all server SDKs and game engine plugins, powered by OpenTelemetry, to generate, collect, and export client-side metrics for game-specific insights. The feature can be configured to collect and publish telemetry from game servers running on managed Amazon EC2 and container fleets, supporting both pre-defined and custom metrics and exporting to Amazon Managed Service for Prometheus or Amazon CloudWatch. Visualizations are available via Amazon Managed Grafana and Amazon CloudWatch dashboards to help optimize resources, improve player experience, and surface operational issues. Telemetry is available in all supported regions except AWS China; see the GameLift Servers documentation for details.

AWS Clean Rooms adds Spark SQL tuning and cache options

🔧 AWS Clean Rooms now supports advanced runtime configurations to improve Spark SQL query performance. Customers can set Spark properties—such as shuffle partition counts and autoBroadcastJoinThreshold—select compute sizes or custom worker counts, and opt to cache existing or newly created tables containing query results to accelerate complex, large-scale queries. These controls enable collaborators to tune performance, scale, and cost for workloads like advertising lift analysis without changing SQL logic.

AWS Elastic Beanstalk Adds Amazon Corretto 25 on AL2023

🚀 AWS Elastic Beanstalk now supports Amazon Corretto 25 on the Amazon Linux 2023 (AL2023) platform, enabling developers to build and deploy applications with the newest Java 25 runtime and language features. The update brings improvements such as compact object headers, ahead-of-time (AOT) caching, and structured concurrency to Beanstalk-managed environments. Developers can provision Corretto 25 instances via the Elastic Beanstalk Console, CLI, or API, with general availability in commercial regions and AWS GovCloud (US) Regions.

Microsoft adds Copilot to more Microsoft 365 companion apps

🤖 Microsoft is extending Copilot functionality across its Microsoft 365 companion apps, with People and Files already supported and Calendar due in the coming weeks. These taskbar mini-apps—available only to enterprise and business Microsoft 365 customers—surface contextual info like contact details, org-wide search and OneDrive file results. Microsoft says Copilot now offers instant suggestions such as recaps, flagged comments, and updates from top collaborators, and supports seamless handoff to the full Microsoft 365 Copilot app for deeper inquiries. There is no indication that Copilot can be disabled within these companion apps.

AWS Cloud Map Adds Cross-Account Support in GovCloud

🔁 AWS Cloud Map now supports cross-account service discovery in AWS GovCloud (US) Regions through integration with AWS Resource Access Manager (AWS RAM). By sharing namespaces, you can allow individual accounts, Organizational Units, or an entire AWS Organization to discover resources such as Amazon ECS tasks, EC2 instances, and DynamoDB tables across accounts. The capability is available now in GovCloud (US-East) and GovCloud (US-West) via Console, API, SDK, CLI, and CloudFormation.

Trick, Treat, Repeat: Patch Trends and Tooling for Q3

🎃 Microsoft’s free Windows 10 updates have largely ended, with EEA consumers receiving free Extended Security Updates through Oct 14, 2026, while most other users must pay. Q3 telemetry shows roughly 35,000 CVEs through September, averaging about 130 new entries per day, and a rising set of Known Exploited Vulnerabilities (KEV) that widen vendor and network impact. Talos also launched the Tool Talk series, offering a hands-on guide to dynamic binary instrumentation with DynamoRIO for malware analysis and runtime inspection.

Google's Android AI Blocks Billions of Scam Messages

📱 Google says built-in scam defenses on Android prevent more than 10 billion suspected malicious calls and messages every month and have blocked over 100 million suspicious numbers from using RCS. The company uses on-device artificial intelligence to filter likely spam into the "spam & blocked" folder in Google Messages and recently rolled out safer link warnings for flagged messages. Analysis of user reports in August 2025 identified employment fraud as the most common scam type, while scammers increasingly employ group-message tactics and time-of-day scheduling to increase success rates.

Atlas browser CSRF flaw lets attackers poison ChatGPT memory

⚠️ Researchers at LayerX disclosed a vulnerability in ChatGPT Atlas that can let attackers inject hidden instructions into a user's memory via a CSRF vector, contaminating stored context and persisting across sessions and devices. The exploit works by tricking an authenticated user to visit a malicious page which issues a CSRF request to silently write memory entries that later influence assistant responses. Detection requires behavioral hunting—correlating browser logs, exported chats and timestamped memory changes—since there are no file-based indicators. Administrators are advised to limit Atlas in enterprise pilots, export and review chat histories, and treat affected accounts as compromised until memory is cleared and credentials rotated.

Hezi Rash: Kurdish Hacktivist DDoS Campaigns Rising

🛡️ Hezi Rash is a Kurdish nationalist hacktivist collective formed in 2023 that has escalated to coordinated DDoS campaigns targeting entities perceived as hostile to Kurdish or Muslim communities. Their public rhetoric mixes nationalism, religion, and activism, and they have claimed attacks in response to symbolic provocations such as an anime scene depicting a burning Kurdish flag. Targets reported include anime platforms, media outlets, NGOs, and government services, causing intermittent service disruptions and demonstrating growing technical sophistication.

Protecting Older Family Members From Financial Scams

🔒Elder fraud is rising sharply: in 2024 Americans aged 60+ reported nearly $4.9 billion lost to online scams, with an average loss of about $83,000 per victim. Effective protection pairs ongoing, shame-free family communication with practical technical measures and a clear remediation plan. Teach relatives to use a password manager, enable two-factor authentication, block popups and robocalls, keep devices updated, and verify any urgent financial request before acting.

Email and Remote Access Drive 90% of Cyber Claims in 2024

📧 At-Bay's 2025 InsurSec analysis finds email and remote access were central to 90% of cyber insurance claims in 2024. Email accounted for 43% of incidents and fraud schemes commonly begin with credential theft, domain spoofing, and impersonation. Google Workspace was cited as the most secure mail provider, though claims rose; MDR services were highlighted as the most reliable defense against full encryption.

Amazon S3 Access Grants Expand to Thailand and Mexico

🔒 Amazon S3 Access Grants are now available in the AWS Asia Pacific (Thailand) and AWS Mexico (Central) Regions. The feature maps corporate identities—such as Microsoft Entra ID or AWS IAM principals—to S3 datasets, enabling administrators to automate and scale dataset access. This reduces manual policy overhead and helps ensure consistent, auditable permissions. Check the AWS Region Table and product page for regional availability and details.

Global Payments: Resilient Scale Architecture with Cloud SQL

☁️ Global Payments partnered with Google Cloud to design a multi-region, highly available database architecture using Cloud SQL Enterprise Plus. The deployment spans three regions with zonal replication, read replicas, cascading replication, and Cloud SQL Auth Proxy integration to support low-latency reads and rapid failover. This configuration yields near-zero planned downtime, sub-minute RTO and zero RPO for Tier 1 workloads, while meeting PCI DSS, GDPR, and NIST requirements.

Anonymous Credentials for Privacy-preserving Rate Limiting

🔐 Cloudflare presents a privacy-first approach to rate-limiting AI agents using anonymous credentials. The post explains how schemes such as ARC and ACT extend the Privacy Pass model by enabling late origin-binding, multi-show tokens, and stateful counters so origins can enforce limits or revoke abusive actors without identifying users. It outlines the cryptographic building blocks—algebraic MACs and zero-knowledge proofs—compares performance against Blind RSA and VOPRF, and demonstrates an MCP-integrated demo showing issuance and redemption flows for agent tooling.

Stolen Credentials and Remote Access Abuse in 2025

🔒 FortiGuard Incident Response observed that in H1 2025 financially motivated actors frequently used stolen credentials and legitimate remote-access software to gain and extend access across environments. Adversaries relied on compromised VPN logins, password reuse, or purchased credentials, deploying tools like AnyDesk, Splashtop, Atera and ScreenConnect to move laterally and exfiltrate data manually. These intrusions often bypass endpoint-focused defenses because activity mimics normal user behavior, so FortiGuard emphasizes identity- and behavior-driven detection, broad MFA enforcement, and monitoring of remote access tooling.

Policy, Privacy, and Post-Quantum Anonymous Credentials

🔒 Lena Heimberger examines the challenge of building post-quantum Anonymous Credentials that are practical for large-scale use. The post summarizes real-world needs — from the EU digital identity wallet to Cloudflare’s Privacy Pass rate-limiting — and defines key requirements like unlinkability, unforgeability, round-optimality, and per-origin rate limits. It surveys PQ approaches (generic ZKP composition, lattice-based signatures, hash-and-sign with aborts, and MPC-in-the-head/VOLEitH), evaluates trade-offs in bandwidth and latency, and calls for standardized ZK-friendly hashes and PQ-native protocol designs.

LinkedIn Phishing Targets Finance Executives With Fake Board

🔒 Hackers are exploiting LinkedIn direct messages to phish finance executives with messages claiming to invite recipients to an executive board and leading to credential-harvesting pages. Push Security says victims are redirected — including via a Google open redirect — to a Firebase-hosted 'LinkedIn Cloud Share' page that urges users to click a 'View with Microsoft' button. That flow then presents a Cloudflare Turnstile and a fake Microsoft sign-in used as an adversary-in-the-middle to capture credentials and session cookies; organizations should verify senders, avoid unsolicited links, and enforce MFA and conditional access.

CISA Releases Two ICS Advisories on ISO 15118-2 and TropOS

🛡️ CISA released two Industrial Control Systems advisories addressing the International Standards Organization ISO 15118-2 standard and Hitachi Energy TropOS. The advisories provide timely information on security issues, vulnerabilities, and potential exploits affecting ICS components. Administrators and operators are urged to review the advisories for technical details and recommended mitigations to protect operational environments.

Proton Finds 300M+ Records Linked to 794 Breaches Worldwide

🔎 Proton and Constella Intelligence have launched the Data Breach Observatory, a real‑time dark‑web monitoring service that has identified more than 300 million compromised records tied to 794 incidents so far this year. The service combines automated crawlers, curated feeds and human analysts to surface breached data and alert affected parties. Proton says small and medium businesses are heavily targeted, with email addresses, names and contact details the most commonly exposed items. If aggregated datasets are included, Proton reports incidents rise to 1,571 and exposures reach hundreds of billions of records.

AWS Step Functions introduces unified metrics dashboard

🔍 AWS Step Functions now provides a unified metrics dashboard in the console that centralizes usage and billing metrics for both account and state-machine levels. The dashboard covers standard and express workflows and surfaces existing metrics such as ApproximateOpenMapRunCount. It is available in all Regions where the service operates and can be opened from the Step Functions console.

Rethinking Identity Security for Autonomous AI Agents

🔐 Autonomous AI agents are creating a new class of non-human identities that traditional, human-centric security models struggle to govern. These agents can persist beyond intended lifecycles, hold excessive permissions, and perform actions across systems without clear ownership, increasing risks like privilege escalation and large-scale data exfiltration. Security teams must adopt identity-first controls—unique managed identities, strict scoping, lifecycle management, and continuous auditing—to regain visibility and enforce least privilege.

Shadow AI: One in Four Employees Use Unapproved Tools

🤖 1Password’s 2025 Annual Report finds shadow AI is now the second-most prevalent form of shadow IT, with 27% of employees admitting they used unauthorised AI tools and 37% saying they do not always follow company AI policies. The survey of 5,200 knowledge workers across six countries shows broad corporate encouragement of AI experimentation alongside frequent circumvention driven by convenience and perceived productivity gains. 1Password warns that freemium and browser-based AI tools can ingest sensitive data, violate compliance requirements and even act as malware vectors.

Greens Urge Immediate National Cybersecurity Offensive

⚠️ The Greens are calling for a rapid, pre-Christmas security offensive to counteract sabotage, espionage and cyberattacks, saying the federal government is moving too slowly to act. Parliamentary deputies Konstantin von Notz and Irene Mihalic welcome recognition of the threat by Chancellor Friedrich Merz and Interior Minister Alexander Dobrindt but demand immediate, concrete measures and activation of the National Security Council. They also press for a major intelligence service reform and criticize weaknesses in the draft bill to transpose NIS-2 obligations, warning exemptions and gaps would undermine resilience across public administration, municipalities and critical infrastructure.

Ransomware Profits Decline as Fewer Victims Pay through 2024

🔍 A new Coveware study shows the ransomware economy is shifting: despite an increase in attacks, both average ransom amounts and the share of victims paying demands have fallen. In Q3 only 23% of victims paid, down from 28% in Q1 2024, and average payments dropped from around $377,000 last year to roughly $140,000 this year. Coveware attributes the change to better prevention and incident handling by organizations and growing pressure from authorities. Insurance provider Hiscox warns that 40% of paying victims still lose data, underscoring persistent recovery risks.

Amazon WorkSpaces Adds USB Redirection for DCV on Windows

🔌 AWS announced USB redirection support for Amazon WorkSpaces using the Amazon DCV protocol, enabling users to access locally connected USB peripherals from their virtual desktops. Supported devices include credit card readers, 3D mice, and other specialized hardware. The capability is limited to WorkSpaces Personal running Windows and accessed from Windows clients; performance and compatibility may vary, so testing before allowlisting is recommended. The feature is available in all AWS Regions where WorkSpaces is offered.

Five Generative AI Security Threats and Defensive Steps

🔒 Microsoft summarizes the top generative AI security risks and mitigation strategies in a new e-book, highlighting threats such as prompt injection, data poisoning, jailbreaks, and adaptive evasion. The post underscores cloud vulnerabilities, large-scale data exposure, and unpredictable model behavior that create new attack surfaces. It recommends unified defenses—such as CNAPP approaches—and presents Microsoft Defender for Cloud as an example that combines posture management with runtime detection to protect AI workloads.

EKS Split Cost Allocation Now Imports Pod Labels for Billing

🔖 Starting today, Split Cost Allocation Data for Amazon EKS can import up to 50 Kubernetes custom labels per pod as cost allocation tags. You can attribute pod-level costs in the AWS Cost and Usage Report (CUR) using labels such as cost center, application, business unit, and environment. New customers enable the feature in the AWS Billing and Cost Management console; existing customers will have labels automatically imported but must activate them as cost allocation tags. After activation labels appear in CUR within 24 hours and can be visualized via the Containers Cost Allocation dashboard in Amazon QuickSight or queried with Amazon Athena.

MXDR for SMBs: Practical, Partnered Security Solution

🛡️ Small and medium-sized businesses often find enterprise-grade MXDR solutions overwhelming; instead, they need a partnered approach that builds internal expertise while delivering managed detection and response. The ideal MXDR for SMBs is adaptive to maturity, reduces false positives through tailored rules, offers transparent incident reporting and dashboards, and provides threat intelligence and targeted employee training. Kaspersky's Next MXDR Optimum exemplifies this model by combining expert-led support, accessible XDR tools, and role-specific training to foster a security culture.

Converged Security and Networking: The Case for SASE

🔒 Today's complex IT environments — multi-cloud, hybrid work, and AI — have expanded the attack surface, exposing limits of fragmented point solutions. The article argues that unifying networking and security on a natively integrated platform like VersaONE reduces blind spots, enforces consistent policies, and enables real-time threat detection and automated response using built-in AI. With zero trust access and microsegmentation, the platform aims to minimize lateral movement and simplify operations compared with bolt-together or 'platformized' vendor offerings.

From Checkbox to Continuous Proof: BAS Summit Insights

🔍 At the Picus Breach and Attack Simulation (BAS) Summit, practitioners and CISOs argued security must move from annual compliance checks to continuous, evidence-driven validation. Speakers emphasized outcome-first testing, purple-team collaboration, and using AI as a curated intelligence relay rather than an improvisational engine. BAS was portrayed as the operational core of CTEM, converting missed detections into prioritized remediation and demonstrable protection for leadership.

Spam text operator fined £200,000 for targeting debtors

⚠️ The UK Information Commissioner’s Office fined sole trader Bharat Singh Chand £200,000 after he sent 966,449 unsolicited spam texts promoting fake debt relief and purported energy-saving grants between December 2023 and July 2024. Many recipients were already in financial hardship and were induced to reply, then contacted by callers posing as 'The Debt Relief Team'. The campaign used a SIM farm, false business names and unregistered numbers, generated 19,138 complaints, and Chand has appealed.

Board Cyber Resilience: Metrics That Drive Governance

🔒 Boards need concise, business-focused cyber metrics that translate technical activity into measurable resilience. The article argues that traditional SOC metrics (patch counts, blocked phishing attempts) are poor indicators of business impact and recommends focusing on financial impact, governance, operational resilience, and strategic readiness. It highlights concrete measures — average cost per incident, downtime cost per minute, MTTR, MTTD, regulatory violations, third-party risk, and residual risk — and urges boards to choose 1–2 metrics per category, set reporting cadence, and iterate until metrics drive oversight.

Fortinet Recognized by Crime Stoppers for Cyber Leadership

🏆 Fortinet received two 2025 Crime Stoppers International awards—the Cybersecurity Leadership Award and the Corporate Leadership in Crime Prevention Award—for its global efforts to disrupt cybercrime through intelligence sharing, partnership, and workforce development. FortiGuard Labs and the Fortinet Training Institute are cited for delivering actionable threat intelligence and scalable education. The honors validate more than a decade of sustained public‑private collaboration and data‑driven prevention.

Dynamic Binary Instrumentation with DynamoRIO on Windows

🛠️ This post introduces dynamic binary instrumentation (DBI) and provides a hands-on guide to building DBI tooling using DynamoRIO on Windows 11. It explains the difference between static and dynamic instrumentation and highlights practical uses such as malware analysis, anti-anti-analysis techniques, runtime de-obfuscation, and automated unpacking. The tutorial includes example clients, build instructions, and a GitHub repository with sample code to help researchers get started.

How CISOs Can Transition Between Industries Successfully

🧭 Successful cross-industry moves for CISOs require reframing technical experience as demonstrable business impact. Executives often assume security leaders are industry‑locked, but practitioners such as Marc Ashworth and Tim Youngblood show that a background in consulting, active participation in ISACs, and strong risk‑management fundamentals translate across sectors. Recruiters advise emphasizing measurable outcomes, targeting structurally similar industries, and leveraging client relationships to bridge credibility gaps. Avoid being pigeonholed by clearly linking past achievements to the goals of the prospective organization.