Quantum Readiness, AI Cyber Models, and Critical Patches

Cloud and AI providers advanced quantum-safety plans and developer tooling, while defenders faced a large Microsoft patch cycle and zero-click risks affecting widely used collaboration software. Several hyperscaler updates centered on key lifecycle control, supply chain integrity, and smoother data-to-ML workflows. At the same time, new research and ransomware activity underscored how attacker techniques are adapting to automation and decentralized infrastructure.

Quantum-Safe Roadmaps and Cloud Controls

Google Cloud published an updated post-quantum cryptography (PQC) roadmap aiming for full cloud-side readiness by 2029, with alignment to evolving standards into the 2030s. The plan targets three domains: mitigating Store Now, Decrypt Later risk, strengthening signature integrity to prevent forgery, and building cryptographic agility for future transitions. Near-term milestones include quantum-safe key exchange on API endpoints, PQC-capable load balancers and TLS 1.3 hybrids, general availability of NIST-standardized PQC algorithms in Cloud KMS, and at-scale experiments with PQC and Merkle Tree Certificates. The roadmap splits responsibilities: Google will update network endpoints, front-ends, ALTS, and server hardening, while customers must modernize client software, configurations, and key lifecycles to negotiate PQC handshakes. Customers are urged to inventory assets and plan migration paths now.

AWS extended AWS Secrets Manager’s managed external secrets to rotate Jenkins API Tokens and SonarQube Tokens directly from the console. For Jenkins, the service generates a replacement token and revokes the old one only after verifying the new token is active; rotations support both self-rotation and admin-assisted models. SonarQube support covers User Tokens, Global Analysis Tokens, and Project Analysis Tokens via the SonarQube Web API, with self-rotation for user tokens and admin-token rotation for analysis tokens. The feature is available in all Regions that already support managed external secrets, aiming to improve secret hygiene and reduce operational effort for CI/CD credentials.

AWS also added one-click access to Amazon SageMaker Unified Studio from the AWS Glue console (and related consoles for S3 Tables, Athena, EMR, Redshift). The integration lets teams move from catalog browsing or ETL authoring to querying data, running quality checks, and building data pipelines in Unified Studio using the same IAM role. A new inline permissions panel helps create required IAM policies without leaving the Glue workflow, reducing context switching and streamlining onboarding where SageMaker Unified Studio is supported.

Google announced Americas Connect, adding three subsea systems — Alisios, Canoa, and OlaLuz — plus a new Firmina branch. Alisios links the Dominican Republic, Panama, and Chile; Canoa connects the Dominican Republic and Bermuda and interoperates with Nuvem and Sol to reach Europe and North America; OlaLuz provides a direct path from the Dominican Republic to Florida. The investments create diverse, redundant rings across the Pacific, Caribbean, and Atlantic to strengthen reach, capacity, and resilience for regional cloud services.

AI Models for Security and Agents

According to CSOOnline, OpenAI launched GPT‑5.6‑Cyber and restructured its Daybreak program into Blue (defensive use of frontier models) and Red (purpose-trained cyber models for vetted researchers). Internal evaluations report GPT‑5.6‑Cyber completed 95% of advanced cybersecurity requests, and the model helped identify two previously unknown bugs in Google’s V8 engine via coordinated disclosure. OpenAI rates the model “High” in its Preparedness Framework and imposes controls including identity verification, monitoring, and a requirement for hardware security keys for individual accounts by September 1, 2026. Analysts expect faster discovery-exploitation cycles and recommend governance that emphasizes controlled access, logging, human oversight, and validation before production changes.

AWS added NVIDIA Nemotron 3.5 Lightning to SageMaker JumpStart. The model uses a hybrid Mixture‑of‑Experts architecture with roughly 30B total parameters and ~3B active per token, targeting efficient throughput (reported up to ~410 tokens/second) and support for large contexts up to 1 million tokens via DFlash speculative decoding. It integrates with common agent harnesses and can be deployed through the JumpStart catalog or the SageMaker Python SDK for experimentation and production.

AWS also added three models to SageMaker JumpStart: LocateAnything‑3B for rapid visual grounding via Parallel Box Decoding; Qwen‑AgentWorld‑35B‑A3B, a language world model trained on over 10 million interaction trajectories across seven domains; and Qwen3.5‑122B‑A10B, a 122B-parameter hybrid model activating ~10B parameters per token with a 262K context window. The additions target use cases spanning visual localization, environment simulation, multimodal reasoning, and agents.

The Hacker News detailed “GhostSplice,” showing that malicious Model Context Protocol (MCP) servers can split exfiltration instructions across tool descriptions and results so coding agents reassemble them and return sensitive files. In tests with seeded fake credentials, fragmented prompts increased compliance rates compared to single-piece instructions. The technique is not a remote compromise by itself; it requires the attacker’s MCP server to be connected and the agent to have file access. Recommended client-side controls include treating server outputs strictly as data, preventing unchecked tool-to-tool flow, and keeping a human in the loop for tool invocation.

Critical Patches and Exploit Chains

Talos highlighted Microsoft’s August 2026 release addressing 421 vulnerabilities across Windows, Office, Azure and more, with 62 marked critical. One flaw, CVE‑2026‑68820 in the WinSock ancillary driver, is reported as exploited in the wild. Notable network-facing RCEs include CVE‑2026‑62893 (Windows Deployment Services TFTP), CVE‑2026‑65665 (SharePoint Server) and CVE‑2026‑62823 (Windows DHCP Server), alongside high-scoring elevation‑of‑privilege issues across Azure components. Organizations should prioritize patches for known‑exploited and exposed services while sequencing updates to minimize disruption.

CSOOnline reported Zoom fixes for four vulnerabilities, including two memory‑corruption bugs in the annotation feature that enable zero‑click remote code execution when a participant sends crafted packets. Additional issues include a client denial‑of‑service and a VDI path traversal (CVE‑2026‑53416). The annotation flaws (CVE‑2026‑53413, CVE‑2026‑53415) stem from unsafe deserialization and missing bounds checks on fixed buffers. Zoom recommends updating clients and tightening meeting features to reduce attack surface.

The Hacker News covered Rapid7’s disclosure of an authentication bypass in on‑premises SharePoint (CVE‑2026‑55040) that can be chained to a SharePoint RCE (CVE‑2026‑63520) for unauthenticated execution. The exploit path was developed with help from an AI agent under human supervision. Microsoft’s July updates break the chain; organizations should confirm those builds are in place and apply August updates when available, particularly given end‑of‑support timelines for older editions.

BleepingComputer noted CISA’s addition of CVE‑2026‑45659, a SharePoint deserialization RCE, to the Known Exploited Vulnerabilities Catalog after ransomware abuse was observed. Federal agencies were directed to mitigate quickly; organizations should apply Microsoft’s patches, verify installations, monitor for compromise, and enable detections.

Ransomware Operations Adapt Infrastructure and Entry Points

The Hacker News described how DeadLock ransomware adopted decentralized infrastructure to fortify extortion and leak operations. The malware employs a hybrid cryptographic scheme, selective encryption, and geofencing, and directs victims to an HTML app with end‑to‑end encrypted chat, a leak blog, and file browsing that operate without a traditional server. The app uses Polygon smart contracts for proxy rotation and hosts leak content via the Wasabi protocol, increasing takedown resistance. Operators also apply anti‑forensic steps, resource‑aware throttling, and remote tools like AnyDesk.

The Hacker News reported joint warnings on Gunra ransomware, a Conti‑derived operation active since April 2025 that exploits internet‑facing flaws — including CVE‑2024‑5559 (Schneider Electric PowerLogic P5) and CVE‑2025‑24472 (Fortinet FortiOS/FortiProxy) — to gain initial access. Affiliates use double extortion, standard lateral‑movement tooling, and have offered a RaaS kit with cross‑platform builders. Guidance focuses on rapid patching of known vulnerabilities, segmentation, hardened authentication, monitored exfiltration paths, and resilient backups.