AWS Controls, Cross‑Cloud Moves, and Active Exploits — Daily Brief

Cloud providers rolled out new controls and scale options while cross-cloud partnerships broadened infrastructure choices. AI platforms advanced in robotics and governed data access, and certification plans took shape for workforce readiness. At the same time, CISA highlighted active exploitation, embedded TLS flaws surfaced, and internet disruptions and social‑engineering techniques underscored operational risk. The updates below prioritize prevention and hardening, followed by exploitation and incident activity.

AWS: Network Validation, GPU Efficiency, and Elastic Data Services

AWS introduced AWS Security a feature that gives AWS Network Firewall visibility into IPs returned by Route 53 Resolver and validates new outbound connections against a resolved-IP cache before stateful rules. This enables domain-based filtering for non‑HTTP protocols and prevents TLS SNI spoofing without TLS inspection. Administrators must ensure DNS uses Route 53 Resolver, associate a DNS Firewall rule group, enable validation in Alert mode to allow DNS caches to refresh, and then move to Drop/Reject with monitoring via new logs and CloudWatch metrics.

For container workloads that consume only a portion of a GPU, Amazon ECS added GPU sharing via NVIDIA Multi‑Process Service with AWS What's New support on ECS Managed Instances and ECS on EC2. Operators can declare per‑container GPU memory and optional compute caps, and ECS schedules tasks to increase utilization. Managed Instances monitor the MPS daemon and replace instances or relocate tasks automatically if the daemon is unhealthy.

Amazon Aurora Serverless for PostgreSQL now scales up to 384 ACUs, roughly 768 GiB of memory per instance, according to AWS What's New. New clusters can set the higher maximum on supported Aurora PostgreSQL versions, and existing clusters on Platform Version 4 can be modified without downtime. AWS recommends checking Region availability and pricing when raising capacity ceilings.

Amazon ElastiCache for Valkey introduced in‑place durability changes on existing clusters, letting customers switch between synchronous and asynchronous write modes, per AWS What's New. Synchronous writes persist across at least two Availability Zones before acknowledgment to target zero data loss, while asynchronous writes prioritize microsecond latency with a small risk of uncommitted data loss in rare failures.

In compliance, AWS reported completion of the Canadian Cloud High (PBHH) assessment for 172 services and features in the Canada regions, becoming the first CSP to meet Cloud High, as detailed on AWS Security. The program raises integrity and availability controls for sensitive workloads up to Protected B, with a summary assessment available through AWS Artifact.

Cross‑Cloud Infrastructure and Partnerships Expand Options

Google announced general availability of a self‑managed VMware solution on dedicated bare metal, offering full control over Broadcom’s VMware Cloud Foundation stack with BYOL subscriptions on high‑density hardware, as outlined by Google Cloud. The architecture provides direct access to native Google services and aims to lower storage and server TCO via vSAN ESA, NVMe tiering, and broad live‑patch coverage, complementing the existing Google‑managed VMware Engine.

Google Cloud and Oracle plan to bring Google TPUs to Oracle Cloud Infrastructure starting in 2027, making OCI the first hyperscaler outside Google to offer TPUs, according to Google Cloud. The announcement cites performance‑per‑watt advantages, system goodput targets, developer tooling such as TorchTPU, and benefits from OCI’s networking and liquid‑cooled facilities, aiming to give enterprises multi‑architecture choice alongside GPUs.

Google Cloud and Oracle also expanded Oracle AI Database@Google Cloud integrations across Google’s data and AI stack, described by Google Cloud. Highlights include a GA Remote MCP Server with an IAM‑governed ExecuteSQL Data API, Knowledge Catalog integration (preview), a Gemini connector (preview), bi‑directional Apache Iceberg Lakehouse support, GoldenGate CDC into BigQuery, and BigQuery federation (preview) for live, in‑place queries against Oracle databases. Oracle plans to pursue FedRAMP High for the service to support regulated workloads.

AI Platforms, Robotics, and Governed Data Access

Google made Gemini Robotics Embodied Reasoning 2 available in public preview for enterprise robotics via Model Garden, enabling spatio‑temporal video reasoning, long‑horizon planning, and safety guardrails as a high‑level brain for varied robot embodiments, per Google Cloud. The stack integrates with simulation, data curation, training, and secure edge deployment tools, and early partners highlighted use cases spanning inspection, data curation, robotics compute platforms, and lab automation.

For governed access to enterprise data, Google described a secure pattern for connecting Gemini Enterprise to Snowflake using the Model Context Protocol and the Agent Development Kit, keeping SQL generation and execution within Snowflake’s controlled boundary and enforcing per‑user OAuth roles, according to Google Cloud. The approach emphasizes least‑privilege roles, secure views when needed, and token handling that preserves auditable access paths.

Separately, researchers disclosed that OpenAI’s compaction mechanism previously allowed recovery of internal reasoning via “compaction smuggling,” an issue OpenAI confirmed and fixed on October 23 with a bug bounty paid, as reported by Infosecurity. In workforce development, ISC2 announced a pilot and beta exam for its first AI security certification with six domains spanning AI fundamentals, governance, model security, architecture, operations, and threats, targeting availability in early 2027, per Infosecurity.

Exploitation, Advisories, and Operational Threats

CISA confirmed active exploitation of two critical PHP vulnerabilities enabling unauthenticated RCE, adding them to KEV and setting an October 29 remediation deadline for federal agencies; fixes were released for multiple PHP branches on October 21, alongside Windows builds addressing a Brotli decoder bug, according to The Hacker News. Operators are urged to patch PHP and Brotli components and monitor for compromise indicators.

EmbedThis’s GoAhead embedded server disclosed multiple TLS issues across backends, including a critical OpenSSL‑backed mTLS revocation‑check failure and other backend‑specific flaws, with patches in GoAhead 6.1.1, per The Hacker News. Device owners must wait for firmware updates from manufacturers and should restart services, end sessions, and change Blowfish‑stored passwords where applicable.

Beyond PHP’s Brotli fixes, a separate Brotli decoder bug dubbed Node2Shell (CVE‑2026‑111497) affected Node.js, .NET, and Python Brotli packages, enabling out‑of‑bounds writes and RCE in applications that decompress attacker‑controlled data, as covered by CSO Online. Vendors issued out‑of‑band updates; remediation requires upgrading runtimes and rebuilding artifacts that embed vulnerable decoders.

Apple backported fixes for an exploited CoreGraphics flaw (CVE‑2026‑86950) to older iPhones and iPads via iOS/iPadOS 18.7.11, addressing additional Audio and CoreMedia issues and tightening entitlement checks in Apple Intelligence, according to The Hacker News. Users should update promptly to mitigate confirmed exploitation on pre‑iOS 27 devices.

On the threat front, researchers detailed a campaign using 44 AI agents in CyberStrikeAI to automate reconnaissance through exfiltration across at least 19 organizations, mostly in Japan, while separate operations leveraged LLMs to speed intrusions and tooling development, as reported by The Hacker News. In parallel, attackers increasingly abused Microsoft Teams external chat to impersonate IT support and obtain remote access in minutes via Quick Assist or RMM tools, with mitigation guidance on domain restrictions and user training from Infosecurity.

Cloudflare Radar recorded 49 internet disruptions in Q3 2026, with government‑directed shutdowns (notably exam‑related in Iraq) the largest category, followed by power outages and natural disasters, according to Cloudflare. The analysis highlights dependence on electricity and physical interconnects and stresses resilience strategies that diversify power and exchange points.