Cloud Security Updates, Critical Patches, and Policy Moves

Cloud and platform providers rolled out security-focused capabilities, while multiple urgent advisories called for rapid patching and mitigation. Researchers also detailed active exploitation against enterprise plugins, industrial targeting in Asia, and consumer-focused malware distribution. Meanwhile, standards bodies and regulators advanced post-quantum verification guidance, multi-cloud risk work, and a major privacy settlement.

Cloud Platforms Tighten Controls and Resilience

Amazon ECS introduced automatic detection and repair for container instances with impaired ECS agent connectivity. A new AGENT_CONNECTIVITY health change event is emitted across Fargate, ECS Managed Instances, and ECS on EC2. For Fargate and Managed Instances, ECS drains tasks, launches replacement capacity, and deregisters the impaired instance to minimize disruption; ECS on EC2 surfaces the event so operators can drive their own remediation. The feature targets resiliency against issues such as storage degradation, host thermal events, or network failures, and is available at no extra cost in AWS Commercial and AWS GovCloud (US) Regions.

Amazon EKS now supports up to 10 external OpenID Connect (OIDC) identity providers per cluster, enabling distinct authentication mappings for employees, contractors, partners, and CI/CD systems without an intermediary broker. The capability runs alongside existing IAM-based authentication, is configurable via the Console or AssociateIdentityProviderConfig API, and is available at no additional cost wherever EKS is offered.

SageMaker MLflow added support for encrypting MLflow App data with customer-managed AWS KMS keys. Organizations can create and manage symmetric keys in the same account and region as the MLflow App, with auditing through AWS CloudTrail for traceability of key usage and data access. The update gives enterprises tighter control over key rotation and encryption lifecycles to meet elevated compliance requirements.

Amazon RDS for MySQL added support for the community minor version 8.4.11, which introduces post-quantum TLS (PQ‑TLS) key exchange options for data in transit, alongside bug fixes and CVE patches. Customers can apply updates via automatic minor version upgrades during maintenance windows or use RDS Managed Blue/Green deployments for safer rollouts; administrators should review compatibility notes before upgrading.

Amazon Connect Customer gained information extraction for voice and chat, capturing verbatim values like account numbers and derived insights such as reason for contact. Extraction occurs on raw content before redaction, with outputs surfaced to agents in After Contact Work, searchable for supervisors, and consumable via APIs, Kinesis Data Streams, and S3. The extracted data can trigger rule-driven actions to automate follow-ups and tasks.

Bedrock GPT‑5.6 Terra and Luna are now available in AWS GovCloud (US), bringing large context windows (up to 1,000,000 tokens) and a next-generation inference engine to government and regulated workloads. A new prompt caching feature with explicit cache breakpoints offers substantial discounts for repeated context, aligning performance, cost control, and compliance needs for advanced use cases.

Critical Vulnerabilities and Urgent Patching

Keycloak CVE‑2026‑18963 allows unauthenticated password resets due to improper state validation in the reset-credentials flow. Upstream was fixed in 26.7.2, with Red Hat issuing errata for its 26.4 and 26.6 streams (including 26.4.15 and 26.6.6). As of disclosure, there is no evidence of exploitation; a temporary mitigation is to disable “Forgot password” across all realms until updates are applied.

CISA’s directive mandates rapid patching of an actively exploited Zimbra flaw (CVE‑2026‑73570), fixed in ZCS 10.1.20. The issue arises from improper sanitization during SNMP notification processing and can lead to unauthenticated remote code execution. Administrators are advised to check for indicators of compromise (unexpected service restarts and files created by the zimbra user in specified directories) and remediate immediately.

Calix CVE‑2026‑75501 affects GS7 XGS residential routers running EXOS/6.6.47, exposing a MiniUPnPd control endpoint on the WAN (TCP 5000). Remote, unauthenticated attackers can manipulate UPnP port mappings to expose internal devices, with mappings persisting across reboots. With no patch available, users should disable UPnP via the admin interface or seek ISP assistance if the option is locked.

Windows Defender BTR.sys can be repurposed as a kernel “operation engine” for file and registry changes early in boot, according to Check Point Research. The mechanism relies on an encrypted configuration and a hard-coded RC4 key shared across signed driver versions. Microsoft noted the technique requires existing privileges and did not meet criteria for immediate servicing; there is no evidence of in-the-wild use.

Threat Activity, Exploitation, and Intrusions

miniOrange SAML 2.0 WordPress plugin attacks are chaining CVE‑2026‑61979 and CVE‑2026‑15981 to forge SAML responses and obtain admin sessions. Although patches were issued in July across free and paid editions, the vendor’s advisory referenced only the free version, leaving some customers unaware. Active exploitation from multiple IPs has been observed; site owners should manually update affected paid editions.

Operation QUICSILVER targets Myanmar’s government and IT sectors with QUICAgent, a Golang backdoor that uses Cloudflare Workers to retrieve dynamic C2 and communicates over QUIC on UDP 443. Infection relies on social-engineering lures and LOLBAS techniques; the implant supports remote execution, file transfer, directory browsing, and configurable beacons, and persists via a Startup LNK.

Doubloon Dredger abused compromised free Notion accounts to deliver device-code phishing that harvests authorization tokens. Victims were led through layered PDFs to EvilTokens pages mimicking Adobe authentication, enabling token exchange for account access; recommendations include disabling device-code auth where feasible or restricting token generation to trusted devices.

Weedhack malware is spreading via fake Minecraft clients and SEO poisoning across YouTube, Discord, Reddit, and file-hosting platforms. Malicious JARs collect system information, add Defender exclusions, and exfiltrate data; users should favor official repositories, scan downloads, and avoid disabling protections.

ReliaQuest reported a social-engineering attempt that phished an employee via a lookalike SSO page and induced an MFA push approval, yielding temporary, view-only identity-dashboard access. Device-trust controls blocked application access; sessions and tokens were reset, and the investigation found no persistence or access to customer data.

Weekly recap coverage highlighted AI-assisted attacks against exposed Siemens S7 PLCs discovered via public scanning, rapid weaponization of newly disclosed flaws, and supply-chain risks from trojanized packages. The reporting urged prioritizing patching, segmentation, and monitoring to counter AI-accelerated threats.

Firefox add-ons were found stealing cryptowallet seed phrases and browser credentials in a coordinated campaign (“Offside Wallet Theft Factory”) leveraging 77 linked extensions. Attackers used a Supabase backend to remotely toggle benign decoys into credential-harvesting pages, enabling theft without submitting store updates.

Policy, Standards, and Enforcement

NIST’s report outlines 23 distinctive risks in multi-cloud deployments across identity and access management, vulnerability management, incident response and recovery, and data protection. Challenges include inconsistent controls across providers, heterogeneous reporting formats and timelines, limited independent scanning, and cross-jurisdictional encryption obligations. NIST recommends stronger governance, centralized visibility, consistent policy enforcement, automation, and standardization, and opened public comment through October 5, 2026.

TCG guidance introduces practical steps to verify post-quantum cryptography readiness in TPMs and defines two labels—TCG PQC‑ready TPM and TCG PQC‑upgradable TPM—to simplify procurement and lifecycle planning. The guidance complements the PTP 1.07 standard and will be supported by expanded certification programs to validate vendor claims.

TikTok’s settlement with the U.S. Department of Justice totals $400 million to resolve COPPA allegations related to under‑13 accounts and data handling practices. The agreement includes a $300 million immediate payment and a contingent $100 million, reflects recent changes to privacy controls and compliance, and resolves allegations without a judicial finding of liability.