AWS Boosts Observability and AI Compute; Check Point, XFS Alerts
Coverage: 23 Jul 2026 (UTC)
< view all daily briefs >Cloud platforms rolled out significant upgrades in observability, serverless durability, AI inference, and hybrid infrastructure. At the same time, a Microsoft 365 outage disrupted collaboration services for many organizations. Security teams also faced urgent remediation tasks for a critical Check Point management flaw and a long-standing Linux XFS privilege escalation. The day’s developments span proactive capability gains and clear reminders to harden management planes and keep kernels current.
Observability and Service Continuity
Amazon has extended CloudWatch Logs to ingest Application Load Balancer (ALB) logs as vended logs, enabling direct analysis of access, connection, and health-check events. Teams can use CloudWatch Logs Insights, metric filters, alarms, and Live Tail to debug traffic patterns and target health in real time, and centrally enable logging through telemetry enablement rules across organizations, accounts, or resources. Configuration is available from the ALB integrations tab or via CLI/SDKs, with delivery to Amazon Data Firehose or Amazon S3; raw delivery to S3 is free, while optional Apache Parquet conversion is billed (for example, $0.035/GB in N. Virginia). Availability spans AWS Commercial and GovCloud regions where ALB and CloudWatch operate, reducing setup friction and improving day-2 operations for distributed applications.
Amazon has updated Bedrock AgentCore to emit all agent telemetry—traces, prompts, structured event logs, and stdout—into a single per‑agent CloudWatch log group. Consolidation under the path /aws/bedrock-agentcore/runtimes/<agent_id>-<endpoint_name> simplifies correlation, export via one subscription, and agent‑scoped IAM and CMK encryption. New agents created on or after July 20, 2026, default to unified observability; existing agents can opt in by setting UNIFIED_TRACES_DESTINATION_ENABLED=true on the runtime and upgrading the ADOT collector to version 0.17.1 or later. The change streamlines multi‑agent troubleshooting and governance by keeping each agent’s full execution history in one location.
On July 23, Microsoft 365 experienced an outage affecting multiple services, notably Teams and SharePoint, with additional reports impacting Excel and the Microsoft 365 Admin Center. Microsoft acknowledged the issue and directed administrators to incident MO1437424 in the admin center for ongoing updates while investigations continue. The disruption highlights dependencies on cloud collaboration platforms and the operational need for contingency workflows until full functionality is restored.
Serverless and AI Inference Upgrades
AWS announced the general availability of the Lambda SDK for durable execution in .NET, enabling C# developers to build long‑running, stateful workflows directly on Lambda. The SDK adds automatic checkpointing, durable invocation, and wait semantics that can pause execution for up to a year while awaiting external events, reducing the need for custom progress tracking or separate orchestration. It offers idiomatic C# APIs for progress, callbacks for human/agent‑in‑the‑loop scenarios, and ships via NuGet with a local testing emulator to develop and debug before deployment. Typical uses include payment processing, AI agent orchestration, and approval flows, with regional availability and pricing aligned to existing Lambda service terms.
AWS expanded SageMaker AI inference to G7e instances in Asia Pacific (Seoul), Europe (London), and Asia Pacific (Tokyo). G7e offers up to eight NVIDIA RTX PRO 6000 Blackwell Server Edition GPUs (96 GB per GPU), 5th Gen Intel Xeon CPUs, and up to 1,600 Gbps Elastic Fabric Adapter networking, delivering up to 2.3x inference performance versus G6e. With up to 768 GB of aggregate GPU memory, G7e supports single‑node inference for medium‑to‑large LLMs up to 70B parameters using FP8 precision, reducing multi‑node complexity for many generative AI workloads and lowering latency through regional proximity.
AWS also extended SageMaker AI inference support for G6 instances to AWS GovCloud (US‑East). G6 combines up to eight NVIDIA L4 Tensor Core GPUs (24 GB each) with third‑generation AMD EPYC CPUs, offering up to 2x the deep learning inference performance of prior G4dn instances. The expansion targets regulated customers needing compliant, residency‑constrained inference endpoints for generative AI, image generation, and computer vision workflows, emphasizing price‑performance gains for small‑to‑medium models.
Infrastructure and Database Updates
AWS announced that Amazon EVS is now available in Asia Pacific (Seoul), Europe (Zurich), and Europe (Stockholm). Amazon EVS lets customers run VMware Cloud Foundation (VCF) inside their Amazon VPC on EC2 bare‑metal with AWS Nitro, supporting VCF 9.0 and 9.1 (including capabilities such as memory tiering). The regional expansion helps reduce latency, address data residency and sovereignty requirements, and offer additional high‑availability and resiliency options—supporting modernization, redundancy planning, and accelerated data center exit timelines.
AWS now supports community MySQL 9.7 in the Amazon RDS Database Preview Environment, giving teams a sandbox to test the newest Long‑Term Support release before general availability. Preview instances persist for up to 60 days and are then automatically deleted; snapshots from preview instances can be used only within the preview environment, limiting portability to production. AWS notes preview instances are priced the same as production RDS instances in the US East (Ohio) Region. The preview enables early validation of application compatibility and operational impacts from new features, bug fixes, and security patches while maintaining cost parity.
Exploited and High-Impact Vulnerabilities
Check Point addressed an actively exploited zero‑day in SmartConsole (CVE‑2026‑16232, CVSS 9.3) that allows unauthenticated attackers to obtain an application login token and authenticate with full administrative privileges. Successful exploitation requires internet reachability to the Management Server and a configuration that does not restrict Trusted Clients. Check Point provided patches and guidance, including limiting Trusted Clients to known IPs and following hardening best practices; administrators can assess exposure by searching audit logs for “Authentication method: application token” and the provided IP indicators. The U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog and mandated federal remediation by July 25 under BOD 26‑04, underscoring the need for rapid patching and access restriction.
Qualys disclosed a Linux XFS race condition dubbed RefluXFS (CVE‑2026‑64600), a local privilege‑escalation flaw present since kernel v4.11 when XFS is created with reflink enabled. By reflink‑cloning a readable target and racing concurrent O_DIRECT writes, an unprivileged user can cause writes to land on the original file’s blocks without touching metadata, leaving no kernel logs and persisting across reboots. Enterprise distributions using reflink‑enabled XFS (for example, RHEL and derivatives, Amazon Linux, Fedora) are widely exposed; common hardening controls (SELinux, kernel lockdown, KASLR, SMEP, SMAP) do not mitigate this path. An upstream fix merged on July 16, and distributors are backporting; immediate installation of vendor kernel updates followed by a full reboot is recommended, especially for multi‑tenant and high‑value hosts.