Cloud Hardening Leads a Day of Active Exploits and Supply-Chain…

Secrets Manager now enables hybrid post‑quantum TLS key exchange by default, as outlined in the AWS Security blog. A sweeping Next ’26 recap from Google Cloud details agent‑first services paired with new security capabilities, from confidential computing previews to post‑quantum key options. Together they frame a prevention‑focused day—backed by fresh advisories and active exploits—while developer ecosystems continue to face coordinated supply‑chain campaigns.

Cloud platforms tighten controls

Hybrid post‑quantum transport for Secrets Manager reduces exposure to harvest‑now, decrypt‑later risks without code changes for supported clients. The AWS Security guidance maps responsibilities clearly—upgrade specific agents and SDKs, validate end‑to‑end connectivity, and confirm successful handshakes via CloudTrail (for example, tlsDetails.keyExchange showing X25519MLKEM768). The shared responsibility note emphasizes inventorying cryptographic usage and following migration plans. In parallel, the Next ’26 recap from Google Cloud highlights agent governance and layered protections: Model Armor across runtimes, new detection and hunting agents, confidential computing previews, and post‑quantum key imports—positioning enterprise AI rollouts with observability and control. The through‑line is tighter cryptographic posture and guardrails around agent behavior.

In workforce analytics, Amazon Quick now embeds Visier’s Vee assistant using MCP, enabling natural‑language queries over governed metrics and returning answers contextualized with internal policies. The integration, described by AWS, routes prompts to a remote MCP server and can be invoked from automated flows for reviews and reporting—grounding outputs in a governed data model to reduce unverified responses. Networking controls also advance: new VPC egress options for AgentCore Gateway and Identity keep agent traffic within customer boundaries, add private DNS for managed egress, and support self‑managed topologies for complex environments, per AWS. Keeping agent interactions private helps reduce credential exposure and satisfy auditing requirements.

Identity and endpoint safeguards

Support for device‑bound Entra passkeys on Windows will extend passwordless sign‑in to Entra‑protected resources from unmanaged devices, according to BleepingComputer. Admins can enable the option in Authentication Methods and control conditions via Conditional Access; keys live in the Windows Hello container and never traverse the network, reducing phishing and MFA bypass risk. Separately, Windows Update is testing controls to minimize forced restarts—skipping updates during OOBE, pausing via a calendar up to 35 days, clearer Power menu options, and consolidating reboots—reported by BleepingComputer. The changes aim to cut disruption while preserving user choice, with managed enterprise devices excluded.

Active exploits and urgent fixes

Shadowserver and the U.S. government report widespread exploitation of an unauthenticated XSS in Zimbra Collaboration Suite (CVE‑2025‑48700), with over 10,500 internet‑facing servers still vulnerable; patches exist, and disabling the Classic UI where feasible can reduce exposure, per BleepingComputer. Reinforcing patch urgency, the federal KEV list gained four exploited entries—affecting Samsung MagicINFO 9, SimpleHelp, and D‑Link DIR‑823X—under the Binding Operational Directive timeline, as announced by CISA. Why it matters: KEV inclusion signals confirmed exploitation and sets remediation deadlines for federal agencies that many enterprises mirror.

Agencies also detailed a persistent backdoor on Cisco Firepower/Secure Firewall appliances: Firestarter survives reboots and typical patches by hooking LINA and modifying boot/mount behavior, with reimaging recommended for remediation; detection includes checking for a lina_cs kernel process, according to BleepingComputer. In AI infrastructure, an SSRF in LMDeploy (CVE‑2026‑33626) was exploited within about 13 hours of disclosure, with attackers abusing the vision‑language image loader to probe internal services (including AWS IMDS) and verify egress via DNS callbacks; maintainers’ mitigations should be applied promptly, per The Hacker News. These cases underscore how quickly high‑signal advisories are weaponized and why defense on perimeter devices and AI gateways must emphasize configuration scrutiny and rapid patch validation.

Developer supply chain under pressure

A new analysis from Unit 42 tracks an escalation in npm compromises since late 2025, focusing on a coordinated campaign attributed to TeamPCP. Attackers leveraged a malicious @bitwarden/cli package to harvest credentials and tokens, embedded into CI/CD to persist, and used a Bun‑based payload with preinstall hooks and heavy obfuscation to backdoor publishable packages. Exfiltration rode encrypted HTTPS to attacker infrastructure with redundant channels, including public repositories. Immediate steps include rotating npm tokens, PATs, cloud and SSH keys; auditing packages for unauthorized version bumps or new preinstall hooks; and hunting for unexpected Bun processes. Longer‑term, routing developer and CI traffic through private registries, enforcing pinning and lockfiles, generating SBOMs with provenance, and tightening CI/CD egress help contain blast radius.

Separately, researchers described another campaign where malicious npm packages executed at install to siphon secrets and self‑propagate by republishing backdoored packages with stolen tokens, with attempts to pivot into PyPI via .pth injection. Operational overlaps with earlier activity exist, but attribution remains unresolved; signs of hijacked projects and ongoing new releases increase exposure risk, reported by Infosecurity. Why it matters: a single compromised dependency can cascade through developer machines and pipelines, turning package management into a primary control surface for enterprise defense.