All news with #alibaba cloud tag

🛡️ Z.ai disabled components of its ZCode coding assistant after researchers discovered a default workflow that silently packaged and uploaded local code repositories to Alibaba Cloud without user consent. The company apologized, removed the feature in the v3.14.0 client, deleted associated cloud storage, and invited external security assessments. Z.ai also opened its codebase for review and asserted the data was not retained or used for model training.

🚀 Amazon SageMaker JumpStart now includes NVIDIA's Qwen3.6-35B-A3B-NVFP4 and Alibaba's Wan2.1-T2V-1.3B-Diffusers models, expanding available foundation models for AWS customers. Qwen3.6-35B-A3B-NVFP4 is a Mixture-of-Experts model optimized for agentic coding, multimodal and long-context reasoning, quantized to NVFP4 to reduce memory footprint while supporting very long context windows. Wan2.1-T2V-1.3B-Diffusers targets lightweight text-to-video generation, delivering 480p clips on consumer GPUs with modest VRAM requirements. Deployments are available via the SageMaker JumpStart model catalog or the SageMaker Python SDK.

🆕 Amazon SageMaker JumpStart now offers Meta's Muse-Glimmer-30B and Alibaba's Qwen 3.8-27B, expanding foundation model choices for enterprise deployments. Muse-Glimmer-30B targets autonomous agentic workflows with a ViT-G/14 perception encoder, 131K+ context, and selectable reasoning strength, while Qwen 3.8-27B provides strong multimodal reasoning and coding performance with a 262K context (scalable via YaRN). Customers can deploy either model from the SageMaker JumpStart catalog or using the SageMaker Python SDK.

🔍 Researchers disclosed two denial-of-service techniques, collectively dubbed CDN Tsunami, that exploit how major CDNs translate client-facing HTTP/3 into backend HTTP/1.1 requests, amplifying small attacker traffic to large origin load. The study tested Alibaba, Baidu, Cloudflare, CloudFront, Fastly, and Tencent, finding widespread susceptibility to a bandwidth amplification variant and partial susceptibility to a connection-amplification variant. Vendor mitigations are applied at CDN edges, and the work will be presented at a September 2026 symposium.

📣 Researchers report active exploitation of a critical remote code execution flaw in the FastJson Java library (versions 1.2.68–1.2.83). Observed attacks primarily target US organizations across finance, healthcare, retail and other sectors, and exploit Spring Boot fat-JAR deployments. Alibaba confirmed the issue but no patch is available; users are urged to enable SafeMode or migrate to non-affected builds.

🛡️ A single wrong variable in Alibaba's XQUIC library lets any remote client crash servers using default QPACK settings with ordinary HTTP/3 traffic. FoxIO researcher Sébastien Féry disclosed the XRING flaw on July 8 and showed a crash triggered by about 260 bytes of legal QPACK frames. All XQUIC releases through v1.9.4 are affected; no patch or CVE was available as of July 10. Operators can mitigate by setting SETTINGS_QPACK_MAX_TABLE_CAPACITY to 0 or disabling HTTP/3 until a fix ships.

🔔 AWS has added five new Qwen foundation models to SageMaker JumpStart, including Qwen3-Coder-Next, Qwen3-30B-A3B, Qwen3-30B-A3B-Thinking-2507, Qwen3-Coder-30B-A3B-Instruct, and Qwen3.5-4B. The models support agentic coding, extended reasoning, multimodal and multilingual workloads, and lightweight deployments. Customers can deploy them from SageMaker Studio or via the SageMaker Python SDK to accelerate development of coding agents and multimodal applications.

🔍 New analysis by Ontinue details VoidLink, a Linux-based command-and-control framework that generates implant binaries for credential theft, data exfiltration and stealthy persistence across cloud and enterprise hosts. The agent fingerprints AWS, GCP, Azure, Alibaba and Tencent environments and adapts its behavior, loading modular plugins for container escape and kernel-level stealth. Researchers identified unusual development artefacts — structured "Phase X:" labels, duplicated numbering, verbose debug logs and embedded documentation — that suggest parts of the implant were written or assisted by a large language model coding agent with limited human review.

🤖 Amazon Web Services added four Qwen3 open-weight foundation models to Amazon Bedrock as fully managed, serverless offerings. The lineup—Qwen3-Coder-480B-A35B-Instruct, Qwen3-Coder-30B-A3B-Instruct, Qwen3-235B-A22B-Instruct-2507, and Qwen3-32B—covers both dense and Mixture-of-Experts (MoE) architectures. The coder variants specialize in agentic coding, function calling, and tool use, while the 235B and 32B models provide general reasoning and efficient dense computation. These models are available now across multiple AWS regions, enabling developers to build advanced AI applications without managing infrastructure.