AWS Detection Upgrades, AI Governance, and Critical Patches

Cloud providers announced a broad set of security and operations updates spanning detection, resilience, AI governance, and compliance. AWS led with new runtime threat detections, cross-region recovery enhancements, and agent platform scale, while Google Cloud and Cloudflare detailed governance and monetization infrastructure for AI-era traffic. Critical patches from Adobe and a sandbox-escape report for Cursor underscored the need to keep development environments and enterprise software promptly updated. Microsoft, meanwhile, advanced its post-quantum cryptography timeline, signaling a tighter horizon for crypto transitions.

Detection, Logging, and Monitoring Upgrades

AWS update expands Amazon GuardDuty Runtime Monitoring with three sensitive file modification detections that alert when critical system files are altered on Amazon EC2 instances and container workloads on Amazon EKS and Amazon ECS. The new findings—Persistence:Runtime/SensitiveFileModified, PrivilegeEscalation:Runtime/SensitiveFileModified, and DefenseEvasion:Runtime/SensitiveFileModified—inspect five file operations (open-for-write, rename, symlink, link, unlink) to identify tampering directly, and apply correlation-based analysis to reduce false positives. Findings include MITRE ATT&CK mappings and remediation recommendations, are available to customers with Runtime Monitoring enabled, and can be trialed for 30 days; feature and detection updates are also available via the GuardDuty SNS topic. In parallel, AWS update enables Amazon CloudWatch alarms to be created directly from log queries, streamlining the path from analysis to alerting without metric filters or custom metrics. Alarms created from log queries integrate with existing CloudWatch Alarm actions, including Amazon SNS and Amazon EventBridge, and are available in all commercial Regions except Middle East (UAE) and Middle East (Bahrain), with support across the console, AWS CLI, CloudFormation, and SDKs.

AWS update introduces a new Amazon OpenSearch Service engine optimized for log analytics, citing internal benchmarks of up to 4x better price-performance, 70% lower storage via a columnar format, 2x higher ingestion throughput, and 2x faster analytical queries. Running on OpenSearch 3.5+ with an “optimized” engine mode for the observability use case, it supports PPL in the UI as well as SQL via API, JDBC/ODBC, and Query Workbench, and is available in 12 Regions at no additional charge. Complementing this, AWS update confirms Amazon Managed Service for Prometheus has achieved FedRAMP High and DoD CC SRG Impact Level 4/5 authorizations within AWS GovCloud (US), enabling regulated agencies and enterprises to operate Prometheus-compatible monitoring and alerting pipelines under documented controls.

Resilience and Access Controls in AWS Workloads

AWS update adds a Kubernetes minor version rollback for Amazon EKS, allowing reversion to the previous minor version within seven days. EKS runs automated rollback readiness checks for API compatibility, version skew, add-on compatibility, and cluster health, and coordinates worker-node rollback first in EKS Auto Mode while honoring disruption controls. The capability is available at no additional cost through the console, CLI, and SDKs. For database continuity, AWS update expands Amazon RDS Cross-Region Automated Backups to four additional Regions, enabling replication of snapshots and transaction logs across specified region pairs and supporting point-in-time restore with RPO measured in minutes for engines including PostgreSQL, MariaDB, MySQL, Db2, Oracle, and Microsoft SQL Server.

AWS update now lets Amazon RDS for Db2 directly join self-managed Microsoft Active Directory domains—across all RDS for Db2 Regions, including AWS GovCloud—so teams can use Kerberos SSO and centralized authn/authz without deploying AWS Managed Microsoft AD. Administrators supply a delegated service account stored in AWS Secrets Manager and encrypted with AWS KMS; there is no additional charge for this integration. On the network layer, AWS blog adds container attribute-based rules in AWS Network Firewall for Amazon EKS and Amazon ECS, allowing policies keyed to native attributes (namespaces, pod names, cluster names, labels) instead of ephemeral IPs. Network Firewall auto-discovers matching pods and resolves them to current IPs in near real time, supports Suricata-compatible stateful rules with @ aliases evaluated at packet time, and enriches alerts/logs with container metadata for traceability to originating workloads.

AI Agents, Governance, and Monetization

AWS update makes Amazon Bedrock AgentCore available in four additional Regions—Asia Pacific (Bangkok), Asia Pacific (Malaysia), Europe (Milan), and Europe (Spain)—so customers can deploy agents closer to users, reduce latency, and address residency needs. AgentCore provides built-in controls for identity, policy enforcement, session persistence, tool connectors, runtime, and observability. In parallel, AWS update raises default AgentCore runtime quotas to 5,000 concurrent sessions in US East (N. Virginia) and US West (Oregon), 2,500 in other supported Regions, plus throughput defaults of 200 agent interactions per second and 25 new session creations per second—reducing immediate quota-increase requests and simplifying capacity planning.

AWS update introduces Assurance Assistant in AWS Artifact, an AI-driven capability that produces citation-backed answers to security and compliance questions from official documentation such as SOC, ISO, and C5 reports. It supports single-question mode and XLSX questionnaire uploads (including CAIQ and SIG), selective or full exports with optional citations, and new IAM managed policies for read-only and full-access use. The feature is available at no additional charge in all commercial Regions via the AWS Artifact console. Beyond AWS, Google Cloud and Anthropic outlined the Claude Apps Gateway, a self-hosted service that intermediates developer clients and Google Cloud Agent Platform using short-lived OIDC sessions from an organization’s IdP. It centralizes governance—RBAC, policy enforcement, telemetry attribution, spend caps, and routing—so inference runs under a single Cloud Run service identity with verified telemetry and budget controls.

Cloudflare blog unveiled the Monetization Gateway, an edge enforcement engine built on the x402 protocol to require and validate payments—initially settling in stablecoins—for any resource served through Cloudflare, from webpages and APIs to datasets and MCP tool calls. By embedding payment negotiation and proof-of-payment into HTTP exchanges (leveraging 402 Payment Required on first access), the gateway aims to enable low-overhead micropayments with near-instant settlement, configurable by route, verb, or caller type via dashboard, API, or Terraform. Cloudflare positions this as infrastructure for usage-based monetization in an agent-driven internet, with early access available via waitlist.

Advisories and Roadmaps: Critical Fixes and PQC Plans

The Hacker News reports Adobe emergency updates for multiple critical issues affecting Adobe ColdFusion and Adobe Campaign Classic, including several CVSS 10.0 vulnerabilities. Fixes are in ColdFusion 2023 Update 21 and ColdFusion 2025 Update 10, and in ACC v7: 7.4.3 build 9397 for CVE-2026-48286 (CVSS 10.0). Adobe credited several researchers and said it has not observed exploitation, and also announced a twice-monthly bulletin schedule starting July 14, 2026. Customers running affected products should apply the indicated updates promptly to mitigate risks such as arbitrary code execution, privilege escalation, and file disclosure.

The Hacker News details two critical flaws in the Cursor AI code editor—CVE-2026-50548 and CVE-2026-50549 ("DuneSlide")—rated 9.8, where a crafted prompt can escape the sandbox and execute arbitrary commands by manipulating write paths or exploiting symlink fallback behavior. Reported in February and fixed in Cursor 3.0 on April 2, the issues allowed disabling the sandbox helper so subsequent agent commands ran with developer privileges. There is no public evidence of exploitation; users are advised to update.

Infosecurity covers Microsoft’s accelerated plan to transition critical products and services to post-quantum cryptography by 2029, integrating PQC work into its Quantum Safe Program and Secure Future Initiative. Priorities include upgrading network cryptography (promoting TLS 1.3 for hybrid/PQC key exchange), building crypto-agility for data at rest, and modernizing trust chains for code signing, certificates, and key protection. The company highlights the harvest-now, decrypt-later risk to long-lived sensitive data and recommends organizations assign ownership, maintain a living crypto inventory, and adopt modern standards as part of a multi-year engineering program.