Critical Exploits, AI Threats, and Major Cloud Updates

Active exploitation warnings, AI-enabled threats, and notable cloud platform updates shaped the day. Critical flaws in networking and management infrastructure drew urgent patch guidance, while researchers documented an implant that delegates tactical decisions to commercial AI. Cloud providers rolled out new model options, security visibility, and reliability features across edge and data platforms.

Active Exploits and Urgent Fixes

A critical vulnerability in on‑premises VeloCloud Orchestrator is under active exploitation, affecting deployments that authenticate Edges using certificates. The issue, tracked as CVE‑2026‑93952 with a CVSS score of 10.0, allows a remote, unauthenticated attacker to privilege internal functions on the orchestrator and potentially compromise the host and managed data; successful compromise may also expose managed Edge devices. Fixes are available for several release trains, with interim mitigations and detailed indicators of compromise (files, a systemd service, an nginx header, and suspicious IPs) provided in the vendor’s guidance. See details via Arista VCO.

Check Point disclosed two critical issues with active exploitation: CVE‑2026‑85102, a pre‑authentication RCE in VPN certificate handling (patched September 9), and CVE‑2026‑93616, a pre‑authentication path traversal in the Management web service enabling arbitrary‑script execution and Java class loading. The company reports pinpointed attacks and urges immediate patching, review of logs for anomalous Mobile Access certificate logins, and follow‑on activity hunting. Affected products, fixed builds, validation steps, mitigation options, and IOCs are listed in the advisory at Check Point.

D‑Link warned of a maximum‑severity zero‑day in DIR‑822A routers due to a stack‑based buffer overflow in the DHCP server component. A published proof‑of‑concept enables attackers on the same LAN to send crafted DHCP packets to crash the daemon or achieve code execution; the vendor is also investigating a second disclosed issue, CVE‑2026‑86510, involving an out‑of‑bounds write in the L2TP control parser. Pending patches, D‑Link advises avoiding Internet exposure, restricting or disabling remote management, and limiting admin access to trusted systems. See the report at D‑Link DIR‑822A.

A newly disclosed flaw in the Linux kernel’s ARM64 KVM nested virtualization path, CVE‑2026‑89775, can grant a guest read‑write access to freed host memory due to a missed TLB invalidation when a size calculation yields zero. The defect enables guest‑to‑host escape when nested virtualization is enabled and may also be abused by local users with access to /dev/kvm. Fixes are in upstream kernels 6.18.51, 7.2.5, and 7.3‑rc1, with distribution rollouts varying. Exposure is limited to hosts that explicitly enable ARM64 nested virtualization. Analysis is available via Linux KVM.

In the AI gateway space, an unauthenticated remote code execution vulnerability in Bifrost (CVE‑2026‑90898, CVSS 9.8) allows attackers to run arbitrary commands as the gateway process user via a single POST to the management API when authentication is disabled — the default for affected HTTP transport releases prior to transports/v2.1.0. The flaw enables registration of a stdio‑type MCP client, causing immediate command execution before any handshake; exposed environments risk leakage of stored provider API keys. Upgrade to transports/v2.1.0 or enable management authentication and restrict network exposure. Details and a related historical issue (CVE‑2026‑86242) are summarized at Bifrost RCE.

CISA added a high‑severity buffer overflow in Zyxel GS1900 switches, CVE‑2026‑7273, to the Known Exploited Vulnerabilities catalog following observed in‑the‑wild LAN‑side command execution via a crafted HTTP request to device CGI handling. Concurrently, Arctic Wolf reported active exploitation of CVE‑2026‑32996 in Veeam Agent for Microsoft Windows, a local privilege escalation stemming from reuse of a cached elevated administrator principal bound to a client‑controlled session UID written to logs, enabling SYSTEM‑level command execution. Firmware and software updates, monitoring for exploitation indicators, and local access controls are advised. Read more at CISA KEV.

AI‑Driven Intrusions and Takedowns

Cisco Talos documented CLOSEDQUORUM, the first publicly reported Windows implant that delegates tactical command‑and‑control decisions to commercial large language models. The Go‑based malware queries up to four providers in sequence under a strict JSON decision schema, then uses plurality voting (with deterministic tie‑breaking) to select actions such as LSASS dumping, browser credential theft, crypto wallet extraction, process injection, and persistence. By using LLM endpoints as C2 infrastructure, the design seeks resilience against refusals and rate limits while introducing failure modes from malformed outputs or provider guardrails. Defensive guidance emphasizes behavioral detection — correlating simultaneous LLM provider contacts with suspicious host activity — over simple domain blocking. The research is detailed at Cisco Talos.

Microsoft announced a disruption of EvilTokens, an AI‑powered phishing‑as‑a‑service platform implicated in compromising over 12,000 Microsoft 365 inboxes across more than 10,000 organizations. The service abused OAuth 2.0 device‑code authentication by steering victims to legitimate login pages to submit short‑lived codes, capturing tokens to maintain access without passwords. An embedded AI "analyst" scanned mailboxes to identify payment owners, trusted relationships, and exploitable invoices, then generated tailored messages to facilitate business email compromise and fraud. Microsoft secured a court order to seize domains and coordinated with partners for the takedown, while arrests were reported in the UK. Operational details and recommended defenses are summarized by CSO Online.

Cloudflare Expands Vary Handling and Previews

Cloudflare introduced support for the HTTP Vary header in Cache Rules to balance correctness in content negotiation with cache efficiency. Origins continue to declare which request fields may alter responses, while cache operators choose how each named header is treated — normalize (collapse equivalent values), passthrough (preserve exact values), or bypass (disable caching for high‑cardinality or personal headers). Normalization occurs before contacting origins so cache keys align with origin selection, and purges apply across variants. Operators are reminded that origins must consistently return appropriate Vary headers for all cacheable responses to prevent incorrect caching. Full guidance is provided in Cloudflare Blog.

Cloudflare also launched Worker Previews, which provision isolated, production‑like environments per Git branch for testing before merging. Each Preview receives separate configuration, URL, observability data, and stateful resources — including automatically created Durable Object namespaces and Container applications — to avoid cross‑branch interference. Teams can trigger Previews locally or via Git‑connected builds, scope observability to each Preview, and gate access with Cloudflare Access or custom domains. The release replaces Version URLs when isolation and separate resources are required. Details and early customer feedback are outlined in Cloudflare Blog.

AWS Models and Security Capabilities

OpenAI’s GPT‑6 Sol and GPT‑6 Luna are now generally available on Amazon Bedrock, extending the GPT‑6 family. GPT‑6 Sol targets complex, recurring tasks and software development with improved factuality over prior Sol releases, while GPT‑6 Luna focuses on high‑volume operations such as summarization, extraction, classification, and routing with adjustable reasoning effort to tune quality, speed, and cost. Both models support contexts up to 1 million tokens, run on the Bedrock inference engine, and are accessible via console and supported APIs with existing security, governance, and auditing controls. Announcement: GPT‑6 on Bedrock.

Anthropic’s latest Opus‑class model, Claude Opus 5.5, is now available on AWS with two access paths — Amazon Bedrock and Claude Platform on AWS — and is optimized for extended coding sessions and complex knowledge work with lower per‑token costs and cheaper cache reads versus Opus 5. It emphasizes clear reporting of actions, findings, and next requirements, and Bedrock provides zero data retention by default with regional data residency and AWS‑managed guardrails. Availability also extends to government‑focused AWS regions via Claude Opus 5.5 and GovCloud (US).

AWS expanded Security Hub AI Inventory to discover and catalog AI assets on self‑hosted instances running in Microsoft Azure. Leveraging enhanced SBOM analysis from Amazon Inspector, the integration identifies inference endpoints, models, and AI agents (including common frameworks like Ollama, vLLM, and Hugging Face TGI), maps them to underlying infrastructure, and correlates them with security findings for centralized, multi‑cloud visibility. The capability is part of Security Hub Essentials at no additional cost. See Security Hub. AWS also announced that AWS Glue Data Quality can now generate context‑specific data quality rules in seconds using a generative AI–powered Advanced mode, enabling rapid baselining across large data lakes; users can review and adjust recommendations before monitoring. More in Glue Data Quality.

For on‑premises workloads, Amazon made Route 53 Resolver generally available on second‑generation AWS Outposts, providing local managed recursive DNS that reduces latency, avoids Service Link traffic, and preserves cached records during disconnections. It is delivered on AWS‑managed infrastructure within each Outpost, enabled by default on multi‑rack deployments, and offered with a time‑limited free trial before pricing begins. Details are in Route 53 Resolver. Separately, Amazon EMR introduced Long Term Support releases, starting with emr‑spark‑8.1.0 (Apache Spark 4.1) that will receive 36 months of support for critical and high‑severity fixes. The release adds full Apache Iceberg v3 support (including geospatial features and improved schema evolution), automatic table format detection across Iceberg, Delta Lake, and Hudi, expanded fine‑grained access controls, and Spark Connect endpoints with token‑based authentication on EMR on EKS. Availability spans all AWS Regions offering EMR across EC2, EKS, and Serverless. Learn more at Amazon EMR.