New preventive controls led the day. AWS Security introduced post‑quantum code signing using ML‑DSA certificates through Private CA and KMS, while Route 53 added targeted blocking of dictionary‑based domain generation algorithms to its DNS Firewall Advanced feature. These updates sit alongside notable infrastructure and AI developments and a steady drumbeat of exploitation and operational impacts across sectors.
Post‑quantum signatures and smarter DNS controls
AWS Private CA now issues ML‑DSA X.509 certificates and integrates with AWS KMS for post‑quantum code signing and private PKI authentication. The release supports ML‑DSA‑65 and provides a practical path to deploy quantum‑resistant roots of trust, with guidance on PKI design, CMS detached signatures, and verifier compatibility. It also outlines production considerations such as distributing a secure trust store and using dual signatures to preserve interoperability.
Amazon Route 53 Resolver DNS Firewall Advanced gained explicit detection and blocking for dictionary‑based DGA. The control inspects domain queries in real time and supports monitor or block actions. Operators can pilot policies in monitoring mode to tune thresholds, then roll out at scale via Firewall Manager or CloudFormation. The addition aims to curb command‑and‑control, phishing, and exfiltration patterns that rely on human‑readable generated domains.
Cloud capacity and automation expand
AWS EC2 broadened extreme‑memory options in Europe with the EC2 U7i 12 TB instance in the Ireland Region, aimed at in‑memory databases such as SAP HANA and latency‑sensitive analytics. For data orchestration, MWAA Serverless introduced usage‑based, automatically scaled Apache Airflow v3.0 environments, with per‑workflow isolation and IAM scoping to reduce blast radius while cutting operational overhead.
For migrations, AWS Transform now generates Landing Zone Accelerator‑compatible network configuration files from VMware environments, accelerating secure multi‑account onboarding. In India, new EC2 M8i and M8i‑flex instances bring custom Intel Xeon 6 performance gains targeted at web, database, and AI inference footprints.
Google also announced Dhivaru, a Trans‑Indian Ocean subsea cable connecting the Maldives, Christmas Island, and Oman, with new regional connectivity hubs. The project focuses on resiliency, automated rerouting, and content caching to support lower‑latency delivery for AI‑driven services.
AI security research and model updates
In collaborative work, Microsoft Security and NVIDIA detailed adversarially trained transformer classifiers compiled with TensorRT and served via Triton, achieving 7.67 ms latency and over 130 req/s on H100 hardware with >95% accuracy on adversarial benchmarks. Kernel‑level and tokenizer optimizations enabled inline, enterprise‑scale detection against fast‑mutating threats, indicating headroom for broader deployment under strict latency constraints.
On the model platform side, Google published hands‑on labs for deploying open Gemma 3 using Cloud Run and GKE, documented in Gemma 3 labs. Separately, references to a Gemini 3 model appeared in AI Studio, as reported by BleepingComputer, indicating a staged developer‑first rollout is imminent.
For GenAI application protection, Check Point described an integration of CloudGuard WAF with Lakera’s model‑ and prompt‑aware controls. The Check Point approach combines WAF‑level inspection with AI‑specific telemetry to detect injection, sensitive data exposure, and harmful content, with policy‑driven enforcement to block, sanitize, or log interactions.
Active exploitation and operational impact
Threat actors quickly weaponized a critical XWiki RCE, CVE‑2025‑24893, with the RondoDox botnet deploying payloads via Groovy injection in the SolrSearch endpoint, according to BleepingComputer. Concurrently, a joint advisory highlighted Akira ransomware’s expansion to Nutanix AHV alongside ESXi, Windows, Linux, and Hyper‑V targets, summarized by CSO Online. For espionage threats, Mandiant and Google Threat Intelligence provided a detailed analysis of UNC1549 tradecraft, tooling, and supplier compromise pathways in Google Cloud. Why it matters: rapid exploitation cycles, hypervisor targeting, and trusted‑third‑party pivots demand aggressive patching, hardening of edge and VDI, and detection focused on credential theft, DLL search order abuse, and stealthy tunneling.
At the infrastructure and business layers, Microsoft reported that Azure mitigated a 15.72 Tbps DDoS attack attributed to the Aisuru botnet, per BleepingComputer, while Jaguar Land Rover recorded about $258 million in direct cyber costs from a September ransomware incident, according to Infosecurity. These events underscore persistent IoT‑scale DDoS risk and the material financial impact of ransomware on large manufacturers.