All news with #aws tag

Zero-day Campaign Targets Cisco ISE and Citrix Systems

🔒 Amazon Threat Intelligence disclosed an advanced APT campaign that weaponized zero-day vulnerabilities in Citrix NetScaler (Citrix Bleed 2, CVE-2025-5777) and Cisco Identity Services Engine (CVE-2025-20337). Attackers achieved pre-auth remote code execution via input-validation and deserialization flaws and deployed an in-memory web shell masquerading as the ISE IdentityAuditAction component. The implant registered as a Tomcat HTTP listener, used DES with nonstandard Base-64 encoding, required specific HTTP headers, and relied on Java reflection and bespoke decoding routines to evade detection.

AWS Network Load Balancer Adds QUIC Passthrough Mode

🚀 AWS announced that the Network Load Balancer (NLB) now supports QUIC in passthrough mode, enabling low-latency forwarding of QUIC traffic while preserving session stickiness via the QUIC Connection ID. This helps mobile applications maintain consistent connections when client IPs change during roaming between cellular towers or when switching between Wi‑Fi and cellular. You can enable QUIC on existing or new NLBs through the AWS Management Console, CLI, or APIs. QUIC support is available at no additional charge in all AWS commercial and AWS GovCloud (US) regions and is metered under existing UDP Load Balancer Capacity Unit entitlements.

Amazon EventBridge Adds SQS Fair Queue Target Support

🚀 Amazon EventBridge now supports sending events directly to Amazon SQS fair queues, improving message distribution across consumer groups and reducing noisy-neighbor effects in multi-tenant systems. You can choose a fair queue as an EventBridge target via the AWS Management Console, AWS CLI, or AWS SDKs and must supply a MessageGroupID, either as a static value or using a JSON path. Fair queues let multiple consumers process messages from the same tenant concurrently while keeping processing times consistent. Support for Fair Queue and FIFO targets is available in all AWS commercial and AWS GovCloud (US) Regions.

Amazon EC2 U7i-12tb Instances Launch in Stockholm Region

🚀 Amazon has made EC2 High Memory U7i instances with 12TB of DDR5 memory available in the Europe (Stockholm) Region. The u7i-12tb.224xlarge offers 896 vCPUs, up to 100 Gbps for both EBS and networking, and supports ENA Express for improved network performance. Powered by custom fourth‑generation Intel Xeon (Sapphire Rapids), these instances target mission‑critical in‑memory databases such as SAP HANA, Oracle, and SQL Server, enabling higher transaction throughput and faster data loading.

Amazon Kinesis Video Streams adds WebRTC multi-viewer

📹 Amazon Kinesis Video Streams now supports WebRTC-based multi-viewer streaming, enabling up to three concurrent viewers of a live feed without increasing device compute or bandwidth. The feature records session audio and video to the cloud for storage, playback, and analytics, and supports two-way audio so participants can communicate in real time. Developers can use the Kinesis Video Streams with WebRTC SDK across cameras, IoT devices, PCs, and mobile devices to build live and on-demand scenarios such as home security, remote proctoring, and robot control centers.

AWS Expands EC2 G6f NVIDIA L4 GPU Instances to More Regions

🚀 Amazon Web Services has expanded availability of EC2 G6f instances powered by NVIDIA L4 GPUs to Europe (Spain) and Asia Pacific (Seoul), improving access for graphics and visualization workloads. G6f instances support GPU partitions as small as one-eighth of a GPU with 3 GB of GPU memory, enabling finer-grained right-sizing and cost savings compared to single‑GPU options. Instances are offered in multiple sizes paired with third‑generation AMD EPYC processors, and are purchasable as On‑Demand, Spot, or via Savings Plans; customers should use NVIDIA GRID driver 18.4 or later to launch these instances.

ECS Service Connect: Cross-Account Support in GovCloud

🔗 Amazon ECS Service Connect now supports cross-account communication in AWS GovCloud through integration with AWS Resource Access Manager (AWS RAM). You can share the underlying AWS Cloud Map namespaces with individual accounts, Organizational Units (OUs), or your entire AWS Organization to register services from multiple accounts in a single namespace. The capability works for both Fargate and EC2 launch modes in GovCloud (US-West and US-East) and is available via Console, API, SDK, CLI, and CloudFormation, simplifying service discovery and reducing duplication.

What CISOs Should Know About Securing MCP Servers Now

🔒 The Model Context Protocol (MCP) enables AI agents to connect to data sources, but early specifications lacked robust protections, leaving deployments exposed to prompt injection, token theft, and tool poisoning. Recent protocol updates — including OAuth, third‑party identity provider support, and an official MCP registry — plus vendor tooling from hyperscalers and startups have improved defenses. Still, authentication remains optional and gaps persist, so organizations should apply zero trust and least‑privilege controls, enforce strong secrets management and logging, and consider specialist MCP security solutions before production rollout.

AWS ALB Adds JWT Verification for Service-to-Service Auth

🔐 Amazon Web Services added JWT Verification to the Application Load Balancer (ALB), enabling ALB to validate token signatures, expirations, and claims in request headers. The capability supports OAuth 2.0 flows including Client Credentials, letting teams offload M2M/S2S token validation to the ALB without changing application code. The feature is available in all ALB-supported AWS Regions.

Amazon ElastiCache M7g and R7g Graviton3 in GovCloud

🚀 Amazon Web Services has added Graviton3-based M7g and R7g ElastiCache node families to AWS GovCloud (US-East and US-West). These Graviton3 nodes deliver improved price‑performance versus Graviton2 — for example, running ElastiCache for Redis OSS on an R7g.4xlarge can yield up to 28% higher throughput, up to 21% improved P99 latency, and up to 25% greater networking bandwidth. To adopt, create a new cluster or upgrade via the AWS Management Console; consult pricing and the node-type documentation for regional availability and details.

Amazon EKS Independent Validation of Zero-Operator Access

🔒 AWS announced an independent affirmation of the Amazon EKS zero operator access design, validated by cybersecurity firm NCC Group. The review found no architectural gaps and confirmed that AWS personnel lack technical means to access or manipulate customer content in managed Kubernetes control planes or etcd backups. AWS highlights Nitro-based confidential compute, tightly scoped administrative APIs with multi-party change approval, mandatory logging and auditing, and envelope encryption for etcd as core protections. Customers retain visibility via cluster audit logs and remain responsible for securing worker node configurations outside managed modes.

AWS FIS Adds Partial-Failure Test Scenarios for AZs

🧪 AWS Fault Injection Service (FIS) introduces two new pre-built experiment scenarios to simulate partial, cross- and single-AZ disruptions. The AZ: Application Slowdown scenario simulates increased latency and degraded performance within a single Availability Zone to validate observability, alarms, and AZ evacuation playbooks. The Cross-AZ: Traffic Slowdown scenario simulates degraded traffic between AZs and lets you target subsets of traffic for realistic gray-failure testing. These scenarios are available in all Regions where AWS FIS is offered, including AWS GovCloud (US).

Amazon Connect Cases Adds Conditional Field Visibility

🔧 Amazon Connect Cases now supports conditional field visibility and dependent field options to streamline case layouts and reduce data-entry errors. Administrators can show fields only when relevant (for example, display a Return Reason field for return cases) and restrict choice lists based on other selections (e.g., limit Issue Type to hardware options when Issue Category is Hardware). The feature is available in multiple AWS regions.

Amazon CloudWatch Adds Network Load Balancer Access Logs

🔍 Amazon CloudWatch Logs now ingests Network Load Balancer (NLB) access logs as vended logs, enabling direct analysis within CloudWatch. You can run CloudWatch Logs Insights queries, create metric filters, and use Live Tail for real‑time traffic review to accelerate troubleshooting. NLB access logs are configurable from the NLB integrations tab, AWS CLI, or SDKs, and can also be delivered to Amazon Data Firehose or S3 with optional Apache Parquet conversion. Delivery to CloudWatch and Firehose is billed as vended logs; S3 delivery is free while Parquet conversion carries a per‑GB charge.

AWS Security Incident Response: Communication Preferences

🔔 AWS announced customizable communication preferences for Security Incident Response, letting teams select notification types such as case changes, membership updates, and organizational announcements. The update replaces a one-size-fits-all model so individuals receive only relevant updates and reduces notification noise. Settings include smart defaults and can be adjusted as roles evolve. The feature is available to all Security Incident Response customers at no additional cost via the console.

Amazon S3 Tables Gain Amazon CloudWatch Metrics Now

📊 Amazon CloudWatch metrics are now available for S3 Tables, providing visibility into storage, maintenance, and request activity. Metrics include daily storage and object counts, compaction bytes/objects processed, and minute‑level request measurements for operations, data transfer, errors, and latency. You can access these metrics via the CloudWatch console, AWS CLI, or CloudWatch API at the bucket, namespace, and individual table level; they are available in all Regions where S3 Tables is offered.

Amazon DCV Adds Support for EC2 Mac Apple silicon instances

🖥️ AWS announced Amazon DCV support for EC2 Mac instances powered by Apple silicon, enabling high-performance remote desktop access to macOS workloads in the cloud. Users can connect from Windows, Linux, macOS, or web clients and benefit from 4K resolution, multi-monitor support, and smooth 60 FPS streaming. Productivity features include time zone redirection and audio output, and the offering is available in all Regions that provide EC2 Mac instances.

AWS Site-to-Site VPN supports 5 Gbps bandwidth per tunnel

🔒 AWS Site-to-Site VPN now supports configurable tunnel bandwidth up to 5 Gbps, a 4x increase over the previous 1.25 Gbps limit. The update reduces the need to deploy complex protocols such as ECMP to aggregate tunnels, simplifying high-throughput hybrid connectivity for migrations, analytics, and disaster recovery. The capability is available in most commercial and GovCloud (US) Regions with a few regional exceptions.

Amazon: APT Exploits Cisco ISE and Citrix Zero‑Days

🔒 Amazon Threat Intelligence identified an advanced threat actor exploiting undisclosed zero-day vulnerabilities in Cisco Identity Services Engine (ISE) and Citrix products. The actor achieved pre-authentication remote code execution via a newly tracked Cisco deserialization flaw (CVE-2025-20337) and earlier Citrix Bleed Two activity (CVE-2025-5777). Following exploitation, a custom in-memory web shell disguised as IdentityAuditAction was deployed, demonstrating sophisticated evasion using Java reflection, Tomcat request listeners, and DES with nonstandard Base64. Amazon recommends limiting external access to management endpoints and implementing layered defenses and detection coverage.

AWS Builder Center launches Spaces for builder collaboration

💬 The AWS Builder Center introduces Spaces, a community collaboration feature that lets builders create and join topic-focused groups to share knowledge and collaborate on AWS solutions. Spaces supports three visibility modes — Public, Private, and Invite-Only — with membership controls, approval workflows, and invite capabilities. Members can post text and images, comment, react, and search discussions, while owners and admins self-moderate content. The feature includes moderation tools and multi-language support across 16 languages to keep conversations focused and accessible.