AWS Security Gains, Active Exploitation, and AI Risk Updates

Cloud providers expanded security controls and telemetry while researchers detailed active exploitation techniques and emerging AI-enabled attack tooling. AWS announced broader visibility, identity, and isolation features, and introduced a local emulator to tighten build-and-test loops. Separate research highlighted browser-resident C2, abuse of relay networks, and compact model backdoors, alongside urgent patch guidance for widely used software.

Network Visibility and Policy Expansion on AWS

AWS Cloud WAN now supports centralized Flow Logs, giving core network owners a consolidated view of IP traffic across VPCs, Regions, and on‑premises connections. Logs include source and destination metadata, packet‑loss counters, and Cloud WAN context (segments, Regions, service‑insertion hops, attachments), and can be published to CloudWatch Logs, S3, or Data Firehose. The feature aims to simplify troubleshooting, capacity planning, anomaly detection, and compliance recordkeeping by centralizing global network telemetry without additional Cloud WAN logging fees.

Network Security Manager is generally available in the AWS European Sovereign Cloud and 31 additional Regions. The service centralizes deployment and enforcement of network security policies at scale, automates AWS WAF protections for internet‑facing resources, integrates with AWS Shield for DDoS resilience, and provides drift detection with automated remediation. Availability in the European Sovereign Cloud enables organizations with strict data‑residency requirements to apply the same automated controls used elsewhere.

Identity, Isolation, and Safer Defaults on AWS

Amazon Cognito added user‑pool session management, allowing administrators to list active SSO and token sessions across devices and app clients, view session metadata, revoke individual or linked sessions, enforce global sign‑outs, and cap concurrent token sessions per user. In parallel, EKS Auto Mode now supports security groups for Pods, enabling per‑Pod network segmentation so workloads sharing a node can carry distinct security group policies and connect to AWS resources authorized by security group.

Lambda MicroVMs added x86 CPU architecture support, allowing existing x86 applications and tools to run in serverless MicroVMs without recompilation while maintaining VM‑level isolation and near‑instant launch/resume. This broadens compatibility for teams with x86‑only software stacks while preserving Arm (Graviton) as an option for performance and cost considerations.

An AWS Security Blog post detailed a redesigned onboarding experience emphasizing secure defaults: per‑project Builder ID sign‑in with MFA, a managed AWS Organization/member‑account structure, a default Region, baseline data perimeter constraints, IAM Role Manager enabled by default, and hard spend limits that pause activity at a ceiling to prevent surprise charges. The approach is intended to streamline initial setup while preserving guardrails that scale with the customer.

Build and Test With Less Risk

AWS Emulator is now available for local development and CI, accepting standard AWS SDK and CLI calls with emulator‑issued credentials and returning the same responses and errors for supported operations. Each emulator instance holds resources in memory with isolated ports and keys, reducing cross‑test interference. Services are generated from official AWS API models, with fidelity verified per release; unsupported calls return 501. The source is published under CC0 1.0 Universal.

Google introduced preview SQL functions AlloyDB AI functions ai.classify and ai.extract, embedding Gemini model capabilities directly into the database engine via the google_ml_integration extension on PostgreSQL 18. The functions support classification and schema‑guided extraction to JSON, with smart batching to optimize inference latency and costs when used in WHERE clauses, helping operationalize AI while keeping data in‑database.

Exploitation Activity, Tooling, and Patch Watch

Microsoft documented widespread abuse of the open‑source remote access tool GSocket to establish stealthy, persistent C2 on Linux servers following single web application compromises. In its investigation, Microsoft blog notes a 356.2% rise in GSocket‑related detections from March to August 2026, with operators staging clients in writable paths, disguising processes, setting multiple persistence mechanisms, and reconnecting through the Global Socket Relay Network using shared secrets.

Unit 42 analyzed Falcon (also tracked as XG/Xiàng Gē), a browser‑resident C2 framework that delivers obfuscated JavaScript implants through targeted webmail portals and government apps. The implant negotiates encrypted sessions over TLS WebSockets, persists identifiers across browser storage, and is complemented by extensions that harvest credentials, cookies, and messages, enabling data exfiltration and in‑browser tasking against government targets across multiple regions.

Separately, Unit 42 reported growing use of AI‑powered red‑teaming frameworks like ARTEX to automate reconnaissance, identity enumeration, and credential abuse at machine speed, recommending controls that reduce exposed attack surface and harden identity and API workflows. In related research, Hacker News summarized Microsoft’s “Lazarus” technique, showing that editing fewer than 10 neurons in a model’s final feed‑forward layer can plant a triggerable backdoor in agents, with mitigation centered on provenance checks, restricted agent permissions, and weight‑level audits.

Two issues in Zoom Workplace for Windows received fixes following disclosure, including CVE‑2026‑108186 (CVSS 9.6) and CVE‑2026‑108187 (CVSS 8.1), both allowing unauthenticated remote privilege escalation. Administrators are advised to update affected versions immediately; details are covered by Hacker News. CISA also added two Cisco‑related flaws to its KEV catalog after evidence of exploitation: an XXE in Cisco BroadWorks (CVE‑2026‑20320) and an issue in Openwave Messaging Webtop Media Transcoder (CVE‑2026‑111793), with patch timelines and agency deadlines summarized by Hacker News.

N‑able released an emergency hotfix for N‑central after public release of 33 alleged zero‑days and PoC code. The company’s build 2026.4.1.26 temporarily disables built‑in remote control, addresses seven tracked CVEs across multiple classes (including XXE, OGNL injection, SSRF, and RCE), and instructs customers to update agents and probes; details via N‑able fix. The vendor brought hosted environments back online post‑upgrade and urged on‑premises customers to remain offline until patched.

ESET uncovered “Cereal,” a toolkit that compromises on‑premises Microsoft Exchange servers to conduct long‑term espionage without external C2. As reported by CSO Online, the malware injects into Exchange transport processes to collect email and credentials, listens on paths mimicking normal OWA/Autodiscover/ActiveSync traffic, and selectively exfiltrates attachments, complicating detection for internet‑exposed, high‑privilege mail systems.

Operational technology risks remained prominent. Check Point linked sabotage of supermarket refrigeration controllers at roughly 700 French retail sites to Shahid Kaveh, with historical ties to the CyberAv3ngers persona and earlier targeting of U.S. water sector PLCs. The campaign details and broader OT exposure risks are outlined by Check Point Research, which urges defenders to minimize internet‑facing OT surfaces and monitor exposed systems closely.

Attribution efforts also advanced: a multi‑source probe identified a Russian resident as a likely administrator of the Qilin ransomware‑as‑a‑service operation, correlating forum personas, Telegram identifiers, and breached records. The investigation’s methods and findings are summarized by KrebsOnSecurity, illustrating how reused identifiers and OPSEC lapses can enable deanonymization of criminal operators.