AI Code Defense, AWS Upgrades, and Active Exploitation Roundup

AI-assisted vulnerability management gained new momentum, while AWS expanded compute, observability, and database options across regions. At the same time, multiple actively exploited vulnerabilities and social-engineering techniques underscored the need for rapid patching, rigorous identity controls, and careful treatment of agent tooling and automation layers.

AI-Driven Vulnerability Management Reaches New Milestones

Google introduced CodeMender in preview as a managed agent for vulnerability discovery, exploitability verification, and automated remediation at scale. The service orchestrates multiple models to balance cost and depth, integrates with CI/CD and developer tools, and can operate in customer-managed sandboxes with VPC routing, encryption, and zero source-code retention. A distinguishing feature is verification via proof-of-concept exploits executed in isolated environments, which helps reduce false positives and prioritize fixes. When issues are confirmed, CodeMender produces targeted code diffs, validated by an LLM-based judge, while retaining developer review and approval. CodeMender also ties into Wiz’s AI Threat Defense to enrich findings and manage remediation as part of a broader security graph workflow.

DeepMind announced Gemini 3.5 Flash Cyber, a lightweight model optimized for scalable vulnerability discovery, validation, and patching. Distributed initially via a limited-access pilot in CodeMender and available to governments and trusted partners, the model is positioned as a high-throughput alternative for scanning complex targets. Internal evaluations reported higher unique issue discovery compared to prior Gemini variants and Anthropic’s Claude Opus 4.6, including severe flaws and an exploit that bypassed mitigations such as ASLR and W^X. DeepMind highlighted controlled rollout measures to mitigate dual-use risks, and Google plans to bring CodeMender capabilities into its Gemini Enterprise Agent Platform for broader enterprise access.

AWS Expands High-Throughput Compute, Observability, and Database Options

AWS broadened its network-optimized instance footprint. EC2 R6in/R6idn are now available in Europe (Paris) and Canada (Central), offering up to 200 Gbps networking, up to 100 Gbps EBS bandwidth, and EFA support on larger sizes; R6idn variants add up to 7.6 TB of low-latency local storage. Separately, EC2 C6in launched in Asia Pacific (Taipei), targeting throughput-intensive, low-latency workloads such as network appliances, 5G UPF, analytics, HPC, and CPU-based AI/ML, with up to 200 Gbps networking and EFA support on top sizes.

Amazon Managed Service for Prometheus raised per-workspace limits to 1.5 billion active time series and 200,000 combined recording and alerting rules. The increase reduces the need for metric sharding and helps centralize monitoring for large microservices estates. Customers can request higher limits via AWS Support Center or AWS Service Quotas, while retaining Prometheus compatibility and AWS-native security and access controls.

In the EU Sovereign Cloud, Amazon ECS added built-in staged rollout support for blue/green, linear, and canary strategies. With ECS deployments, teams can validate new versions alongside running services, insert lifecycle hooks (including Lambda and pause hooks), define bake times, and rely on CloudWatch alarms, the ECS circuit breaker, or StopServiceDeployment for automated rollback without downtime. These strategies work with ALB, NLB, and Service Connect and are configurable via console, CLI, SDKs, or IaC.

For deeper operational visibility, ECS Action Logs now emit detailed, timestamped records of service-side actions during deployments and managed daemon updates. Logs include event names, severity, related resource ARNs, and status reasons, and can be delivered to CloudWatch Logs, S3, or Kinesis Data Firehose. The ECS console’s Amazon Q feature integrates with these logs to detect issues such as circuit-breaker rollbacks and unstable revisions, providing root-cause analysis and guided remediation.

RDS for SQL Server added support for Microsoft SQL Server 2025 across Enterprise, Standard, and Developer editions. The release brings AI integration via T-SQL calls to external REST endpoints, enabling connectivity to services such as Amazon Bedrock, SageMaker, S3, and Lambda without middleware. Standard Edition gains support for up to 32 cores, a 256 GB buffer pool, and Resource Governor, while a native vector data type simplifies ML and retrieval-augmented patterns directly in the database. Existing RDS customers can upgrade in place; on-premises users can migrate to managed RDS.

Active Exploitation and Patch Watch

Researchers reported active exploitation of CVE-2026-50522, a critical SharePoint Server deserialization flaw patched in July. The bug allows remote code execution by authenticated Site Owners, with reports of attackers retrieving machine keys to maintain persistence. Guidance emphasizes immediate patching, followed by rotation of credentials and machine keys and close monitoring for post-exploitation behavior.

Arctic Wolf Labs and others observed Qilin ransomware affiliates abusing CVE-2026-0257, a PAN-OS GlobalProtect authentication bypass fixed in May and added to CISA’s KEV catalog. Intrusions since June leveraged unauthorized VPN sessions to move laterally and deploy ransomware, with varied affiliate tradecraft spanning rapid encryption-only attacks to double extortion. Organizations are urged to patch, apply available mitigations, and monitor for VPN abuse and post-compromise activity.

Threat actors are exploiting the WordPress wp2shell chain (CVE-2026-63030, CVE-2026-60137) to achieve unauthenticated RCE via REST API batch processing. WordPress issued emergency fixes (7.0.2, 6.9.5, 6.8.6) and forced automatic updates, while researchers documented large-scale scanning, malicious plugin uploads, webshells masked as cache files, and rogue admin creation. Guidance includes immediate updating, log review for indicators, plugin and cache directory inspection, and verification of administrator accounts.

Researchers disclosed a prompt-injection chain in AWS’s agentic IDE, AWS Kiro flaw, that allowed a poisoned web page to trigger remote code execution by manipulating Model Context Protocol settings. AWS responded by protecting sensitive paths and enforcing explicit approvals and capability-based permissions; the fix shipped earlier this year, and tests against patched builds blocked the attack. No CVE has been issued and no in-the-wild exploitation was reported by the researchers.

The Anubis ransomware group claimed responsibility for a July attack on Coca-Cola’s Fairlife subsidiary, alleging theft of about 1 TB of corporate data and encryption of Nutanix infrastructure. Coca-Cola previously disclosed a ransomware incident on July 16 that disrupted U.S. production but did not affect product quality; claims by Anubis remain unverified. Coverage: Fairlife incident.

Identity and Agent Risks: OAuth Abuse and Mobile-Agent Pitfalls

A new social-engineering technique dubbed ConsentFix demonstrates hijacking Microsoft 365 accounts by coercing users into granting OAuth tokens through deceptive steps, such as dragging a token-bearing URL onto an attacker page. Consequences range from mail and document access to internal impersonation and pivoting, with openly shared guides and tooling on cybercrime forums lowering barriers to entry. Organizations should adjust controls and training to detect and block token-based OAuth abuse.

Google outlined IAM hardening patterns that combine allow-conditions with explicit principal lists and Deny policies to narrow privileges safely. Examples show CEL conditions limiting APIs, services, and even specific MCP tools, as well as time-based access windows. The guidance cautions against replacing explicit principals with principal attributes and recommends defense-in-depth via Deny to eliminate residual excess.

Academic and lab researchers detailed seven practical attacks against open-source Android mobile-agent frameworks, where invisible on-screen text and tampered screenshots led to host command execution due to unsafe shell invocation and input channels. Findings include reliable command injection when frameworks used shell=True, TOCTOU screenshot swaps within tens to hundreds of milliseconds, and credential leakage via broadcast-based inputs. Proposed mitigations include passing argv lists, streaming screenshots, restricting broadcast inputs, and per-task allowlists. Summary: Android agent risks.