AWS Security Updates, Oracle KEV Exploitation, and U.S. Iran Sanctions

Cloud and security updates dominated the day, led by new AWS controls for access management, secrets rotation, and managed compute. Active exploitation continued to pressure enterprise patching, with a maximum-severity Oracle WebLogic flaw added to CISA’s KEV. U.S. sanctions targeted Iran-linked operators accused of breaching critical infrastructure, signaling sustained policy attention on state-aligned cyber activity.

AWS Expands Access and Secrets Controls

AWS Lambda functions now support full IAM resource-based policies, enabling administrators to grant multiple principals and actions in a single policy and apply granular IAM condition keys (such as source IP or principal tags). The update replaces one-principal-at-a-time permissions with comprehensive documents manageable via the Lambda console JSON editor, AWS CLI, SDKs, and infrastructure-as-code tools including AWS CloudFormation and AWS SAM. The capability is available in all AWS commercial Regions at no additional charge.

Secrets Manager added managed external secrets integrations for Cisco Security Platform API keys and Netskope RBACv3 service-account tokens. Cisco keys are rotated by updating the refresh token on a schedule aligned with OAuth flows, while Netskope rotations use the SCIM API with validation before finalization. Both integrations are self-authenticating, avoiding separate administrator credentials, and are available wherever managed external secrets are supported—reducing custom rotation code for customers.

IAM Roles Anywhere now provides a Java plugin for the AWS SDK for Java v2 that acquires and refreshes temporary credentials within the JVM. The plugin integrates with service client builders, automates CreateSession calls and rotation, supports RSA, EC, and ML-DSA keys, and requires Java 8 or later. It is offered at no additional cost and is available across all AWS Regions, including AWS GovCloud (US), the AWS European Sovereign Cloud (Germany), and China Regions.

Managed Compute and Private Connectivity

AWS Batch now supports Amazon ECS Managed Instances as a first-class compute option, simplifying GPU-accelerated and compute-intensive batch workloads on AWS-managed infrastructure. Customers configure allowed instance types and networking through the managedInstancesProvider block, associate compute environments with job queues, and submit jobs using On-Demand, Spot, or reserved capacity. AWS handles AMI updates, security patching, and lifecycle management, and the feature is supported in all Regions where AWS Batch is available.

Lambda MicroVMs now support AWS PrivateLink, allowing VPC resources to privately connect to MicroVM management APIs and individual MicroVM HTTP endpoints without traversing the public internet. Customers can provision VPC Endpoints through the console, CLI, CloudFormation, or SDKs. The capability, available in Regions where Lambda MicroVMs are offered, enhances isolation for regulated and security-sensitive workloads by removing reliance on NAT or internet gateways for control and data plane operations.

gVisor sandboxes are being brought to distributed Ray clusters via an experimental library from Google Cloud and Anyscale. Represented as Ray Actors, sandboxes integrate with Ray scheduling and lifecycle management starting in Ray 2.58. The API supports OCI images, resource limits, environment configuration, networking, command execution, file transfer, inspection, and termination. gVisor, which implements much of the Linux syscall interface in userspace, offers an extra isolation boundary with sub-second start times and low memory overhead—suiting dynamic, fine-grained sandboxes for untrusted, model-generated code.

Exploitation and Enterprise Risk

WebLogic flaw CVE-2026-21962, affecting Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in, has been added to CISA’s KEV catalog amid active exploitation. With a CVSS score of 10.0, the vulnerability allows unauthenticated attackers with HTTP access to create, delete, or modify critical data and potentially gain full access to services. Oracle issued patches in January 2026, but telemetry indicates continued scanning and exploitation attempts, including activity against older WebLogic RCEs. Under BOD 26-04, U.S. federal agencies must apply fixes by August 27, 2026; organizations should verify patch status and monitor for indicators of compromise.

miniOrange SAML for WordPress is under active probing for two unauthenticated authentication bypass flaws: CVE-2026-61979 (signature algorithm confusion, CVSS 8.1) and CVE-2026-15981 (malformed-signature bypass, CVSS 9.8). Fixes are available in the Standard edition (versions 17.0.5 and 17.0.6). CVE-2026-15981 is linked to a boolean check in mo_saml_validate_signature() that can misinterpret OpenSSL’s error return, enabling crafted SAMLResponses to set authentication cookies for arbitrary accounts. Public proof-of-concept code exists, and scanning is characterized as opportunistic; operators should update promptly and review for unauthorized admin sessions.

Policy and Geopolitics

U.S. sanctions announced under Operation Economic Outcast designate nearly 60 Iran-linked entities, individuals, and vessels, including a cyber group tied to Iran’s MOIS accused of intrusions into U.S. critical infrastructure. Five individuals allegedly connected to the Mabna Institute were singled out, and blockchain analysis cited on-chain receipts linked to wallets controlled by accused operators. The State Department’s Rewards for Justice program is offering up to $10 million for information on individuals conducting malicious cyber activity against U.S. critical infrastructure on behalf of foreign governments, reflecting a multifaceted response across sanctions and incentives.