Cloud Governance, Database Performance, and Critical Patch Watch

Cloud providers concentrated on governance, performance, and hybrid connectivity, while researchers and vendors detailed urgent security risks and patches. New controls from Google Cloud and AWS aim to tighten access boundaries and reduce policy friction. Database, storage, and networking updates target higher throughput and simpler routing. In parallel, fresh research and advisories underscore the need for resilient backup strategies, disciplined model and dataset provenance, and rapid patching.

Governance And Access Boundaries Tighten

Google Cloud expanded its Organization Policy Service with two capabilities: a Model Context Protocol (MCP) server for programmatic policy discovery and management, and Gemini-powered natural-language authoring for custom constraints. The MCP server enables agents and CI/CD pipelines to compute effective policies across inheritance and tags, execute operations such as CreatePolicy and CreateCustomConstraint, and support posture audits, drift detection, and exemption workflows. Natural-language prompts can generate constraints and compliant/non-compliant test resources for dry runs, aiming to reduce manual CEL work and improve accuracy.

MWAA introduced fine-grained access control via IAM Identity Center and multi-team environments. Authorization is evaluated on every request using Permission Sets and condition keys scoped to resource types (for example, DAGs, connections, variables, pools), actions, and resource IDs. Multi-team environments let several teams share a single MWAA environment while maintaining separation, limiting DAG visibility to shared assets plus each team’s folder in Amazon S3, determined by group membership.

AWS Quick reached general availability for structured data connector restrictions using custom permissions. Administrators in the Enterprise edition can allow or block connector types and scope distinct actions—create, update, and share—independently. The feature targets secure self-service analytics by constraining risky or noncompliant source types while preserving user flexibility across all supported Regions.

NCSC launched the Cyber Adversary Simulation (CyAS) scheme to strengthen resilience for critical national infrastructure, larger organisations, and government bodies. Vetted providers design bespoke attack simulations grounded in reconnaissance of the client’s environment, complementing frameworks such as the Cyber Assessment Framework and Cyber Resilience Audit. Operating initially as a Minimum Viable Product, the scheme focuses on assured, high-quality assessments that reveal detection and containment gaps and inform remediation priorities.

Data Platforms And Storage: Performance And Efficiency Gains

Aurora/RDS added Graviton5-based R9g instances for Aurora (PostgreSQL/MySQL compatibility) and Amazon RDS for PostgreSQL, MySQL, and MariaDB. The R9g family offers up to 192 vCPUs, an 8:1 memory-to-vCPU ratio, up to 100 Gbps networking, and up to 72 Gbps EBS bandwidth across nine sizes. AWS reports performance improvements up to 30% and on-demand price-performance gains up to 22% over equivalent Graviton4 sizes, with benefits depending on engine, version, and workload. In parallel, RDS SQL Server added M8id and R8id instances powered by AWS-exclusive custom Intel Xeon 6 processors and local NVMe SSD instance storage. These instances scale to 384 vCPUs, 3 TiB of memory, and 22.8 TB of local NVMe, with RDS automatically placing tempdb on instance store to lower latency and reduce snapshot size by excluding tempdb files.

FSx for Lustre reduced entry costs for Intelligent‑Tiering file systems by lowering minimum provisioned throughput capacity and metadata IOPS by 75%—from 4,000 MBps to 1,000 MBps and from 6,000 to 1,500 IOPS. The change enables smaller starting footprints for workloads that mix hot and cold data without requiring consistent SSD-level performance, while preserving elastic tiering behavior as access patterns evolve.

Networking And Hybrid Connectivity Simplified

Cloud WAN now supports BGP communities on Direct Connect attachments, extending routing-policy signals previously limited to VPN and Connect attachments. Enterprises can tag routes on-premises to convey routing intent, have Cloud WAN evaluate tags for filtering and path preference, and propagate communities back to on-prem routers. The capability reduces overlay workarounds and manual policy duplication, improving consistency and lowering misconfiguration risk across hybrid networks.

Google Cloud and Lumen announced a preview of last-mile partner Cross-Cloud Interconnect for dedicated Layer 3 private connectivity to Google Cloud. Building on open interconnect APIs and automated provisioning, the service targets private clouds, on-prem data centers, retail and branch sites, and other cloud locations. Google says the approach replaces lengthy manual steps—such as cross-connect orders and BGP failover coordination—with provisioning in minutes, launching initially in us-east4 with plans to expand.

Resilience, Threats, And Patch Watch

AWS Backup extended logically air-gapped (LAG) vault support to archive Amazon EBS snapshots to the Amazon EBS Snapshots Archive tier. Administrators can configure archiving via console, CLI, or SDK, preserving vault immutability and encryption while transitioning rarely accessed backups to lower-cost storage and retaining the option to restore directly from the archive.

AWS Backup also added resource modifiers for Amazon EKS restores, enabling YAML-defined transformations of Kubernetes resource definitions during recovery. This addresses cross-account and cross-Region restores where source-specific references (for example, IAM role ARNs or registry URIs) previously required manual rework, improving reliability and reducing recovery time.

Microsoft detailed how post-training supply-chain attacks can implant backdoors in coding and terminal agents via dataset or model poisoning. Experiments showed high activation rates when benign-looking triggers appear, leading agents to invoke unsafe tools despite normal task performance. The research emphasizes checkpoint and dataset provenance, deployment-specific evaluation with production harnesses and schemas, and strict tool permissioning to mitigate backdoor risks.

Red Hat Quay vulnerabilities (CVE-2026-123710, CVE-2026-110697) allow attackers with registry access to add persistent trusted keys, read and overwrite private images, and steal robot account tokens. Fixes are available across multiple Quay branches and deployment models, with mitigations including blocking the /keys endpoint, auditing for anomalous key events, removing unknown service keys, restricting namespace creation patterns, rotating impacted tokens, and installing patched versions.

Citrix released patches for a dozen high-severity issues across NetScaler ADC, NetScaler Gateway, NetScaler Console, and Secure Access Client, including an authentication bypass (CVE-2026-120869) and privilege-escalation flaws (CVE-2026-118268, CVE-2026-118269). While no active exploitation was reported, administrators are urged to apply the specified minimum builds to mitigate risks spanning DoS, authentication bypass, and local privilege escalation.

Fortinet reported an active campaign abusing exposed Microsoft SQL Server instances and weak credentials to deploy cryptomining and remote-access malware. Attackers scan for TCP/1433, brute-force logins, enable xp_cmdshell, and fetch loaders that install a Monero miner and a Gh0st RAT variant, with persistence via scheduled tasks. Recommended mitigations include reducing exposure, enforcing strong credentials, limiting xp_cmdshell, and updating detection signatures.

CSO Online covered Unit 42’s analysis of a China-based intrusion campaign that leveraged the Cairn AI penetration-testing framework and Chinese language models to automate multi-stage operations across dozens of targets. The campaign achieved unauthorized access at multiple organizations, created persistent admin accounts, harvested credentials, accessed unauthenticated cloud storage, and manipulated trusted records, illustrating how automation can shift intrusion economics and complicate attribution.