All news with #network security tag

✈️ Delta Air Lines is investigating an unauthorized Wi‑Fi network that briefly appeared aboard Flight 591 from Las Vegas to Atlanta, carrying passengers who attended DEF CON 34. The carrier said the incident did not affect passenger safety or aircraft systems and that cabin crew disabled Wi‑Fi for about 30 minutes while authorities investigate. Federal law enforcement and aviation regulators will be involved in the probe.

🔒 ClusterNetworkPolicy (CNP) is a new cluster-scoped network policy API added to GKE to let administrators enforce deterministic, non-bypassable network guardrails across namespaces. CNP introduces a hierarchical tier model—admin, network policy, and baseline—with top-to-bottom evaluation and an explicit Pass action to delegate final decisions. Built with the Kubernetes SIG-Policy WG and implemented with Cilium, CNP is open source and intended to improve scalability, compliance, and portability of network security controls in multi-tenant clusters.

🛡️ Amazon VPC IPAM now supports BGP route protection monitoring and delegated RPKI management for BYOIP prefixes, enabling centralized monitoring of RPKI validity, ROA strength, and route overlap across accounts and regions. Administrators can detect invalid or missing ROAs, identify potential hijacks via overlap detection, and differentiate strict versus permissive ROA configurations. With Delegated RPKI, after a one-time setup with ARIN, RIPE, APNIC, or LACNIC, IPAM automates ROA creation, renewal, and management for both BYOIP and on-premises prefixes. The capability is available in all commercial AWS Regions except AWS GovCloud (US) and the China regions.

🔒 Researcher Malcolm Stagg disclosed NatJack, a class of attacks that manipulates NAT connection state to hijack TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables. Presented at Black Hat USA 2026, the work found vulnerable behaviors across multiple implementations including Windows and Linux, with two CVEs assigned: CVE-2026-56181 and CVE-2026-63913. Mitigations include applying vendor updates, segregating untrusted workloads, encrypting internal traffic, and employing IP Source Guard where possible.

🛡️ At Black Hat USA 2026, researcher Malcolm Stagg disclosed NatJack, a class of attacks that manipulates NAT connection tracking tables to hijack TCP connections, poison DNS, and cause DoS without needing IP spoofing or Layer 2 access. Testing across 32 products revealed vulnerabilities in every implementation examined. Vendor responses varied from patches and CVEs to arguments that the issues reflect design limitations rather than security flaws. Stagg recommended monitoring NAT tables, enabling source IP protections, segmenting untrusted traffic, and disabling loose connection tracking modes as mitigations.

🔒 Amazon OpenSearch Service now supports network access controls for OpenSearch UI applications, enabling administrators to restrict access to approved networks using IAM condition keys like aws:SourceVpce, aws:SourceVpc, and aws:SourceIp. You can enforce restrictions via identity-based policies, VPC endpoint policies, and organization-wide resource control policies (RCPs), which can block off-network users before authentication. This feature is available in all Regions where OpenSearch UI is offered.

🔒 AWS reintroduces explicit forward proxy functionality within Network Firewall, allowing customers to use existing firewall policies across both proxy and transparent modes. The feature supports managed rule groups, active threat defense, Geo-IP, URL/category filtering, and container attribute rules for Amazon EKS and ECS. Available in a no-source-preservation deployment during public preview in US East (Ohio), the preview is free and intended for testing and validation.

🔒 PAN-OS 12.2 Ceres introduces Advanced Virtual Patching, Advanced IP Defense, and AI-powered Network Security Agents to confront Frontier AI–driven threats, surging traffic, and cryptographic upheaval. The release emphasizes near-zero exposure windows by using AI to discover vulnerabilities and deploy network-level protections instantly, while integrating with industry partners and Project Lightwell. These innovations aim to protect critical OT, healthcare, and IoT environments without downtime and to automate routine admin tasks via Strata Cloud Manager.

🔒 The Five Eyes’ CI Fortify guidance urges critical infrastructure operators to be able to isolate operational technology deliberately and sustain services during a crisis. The advisory rates VLANs and MPLS as insufficient long-term segregation and cautions against trusting carrier services or native OT encryption. It warns that software-defined controls are convenient but not equivalent to physical separation, and that isolation introduces its own operational risks requiring planning and testing.

🔒 Zero Networks has introduced Least Agency Enforcement, a network-layer capability to implement OWASP’s emerging Least Agency principle for enterprise AI. Built on the company’s identity-based micro-segmentation platform, it restricts which systems AI agents can contact, what resources they can access, and when human approval is required. The feature uses automated policy generation and just-in-time MFA to block lateral movement and sensitive actions even after an agent authenticates.

🛰️ Cloudflare has added isolation and access controls to its global Media over QUIC (MoQ) network by introducing a provisioning API that creates isolated relays (scopes) and issues publish/subscribe tokens. The relays are available across Cloudflare’s network within seconds with no servers to deploy and support draft-14 and draft-16 MoQ transport features; the beta is free to use. Tokens are scoped, revocable, and manageable via API or dashboard, and Cloudflare is documenting the control-plane model as an IETF Internet-Draft for broader interoperability.

🔍 AWS Direct Connect now provides visibility into Border Gateway Protocol (BGP) routes exchanged between AWS and your on-premises routers for private, transit, and public virtual interfaces (VIFs). You can view accepted and advertised routes, including prefix, address family, AS path, community values, and installation timestamp, via the Direct Connect console or the ListVirtualInterfaceRoutes API. Filters let you narrow results by prefix, AS path, community, or address family, helping troubleshoot routing, validate BGP policies, and monitor hybrid connectivity. The feature is available in all AWS commercial Regions and AWS China Regions.

🔧 AWS Transit Gateway now supports Policy-Based Routing (PBR), allowing forwarding decisions based on packet attributes such as source and destination IPs, ports, and protocol instead of destination alone. PBR reduces the need for complex multi-VPC architectures and extra routing hops by enabling administrators to attach policy tables to Transit Gateway attachments and define ordered rule sets. Rules classify traffic and direct matches to specified route tables using first-match-wins logic, supporting traffic steering, inspection, and environment isolation. PBR is available in all commercial AWS Regions where Transit Gateway is offered and can be configured via the Console, CLI, or SDK with no additional charge beyond standard Transit Gateway fees.

🔐 AWS Glue's REST API connector now supports VPC connections, filter pushdown, and partitioning to improve secure, efficient ingestion from REST endpoints. With VPC support you can reach private subnets, VPNs, or AWS PrivateLink without exposing traffic publicly. Filter pushdown converts query predicates into API-native parameters to reduce transferred data, and partition support enables parallel reads across Spark workers for faster ingestion. These features are available in all AWS commercial regions.

🛡️ This post shows how AWS DevOps Agent accelerates root-cause analysis for AWS Network Firewall issues by correlating CloudWatch alarms, firewall logs, route tables, and CloudTrail events. It walks through three reproducible failure scenarios—domain deny list, stateless rule priority inversion, and asymmetric cross-AZ routing—deployed via an AWS CDK app. The CDK stack includes a sample workload, test endpoint, status page, and a webhook pipeline so alarms trigger investigations and the agent returns mitigation plans for operator review.

📘 Cloudflare examines the BGP ORIGIN attribute, a mandatory path attribute intended to signal how a route was injected into BGP. Their experiments show widespread modification of ORIGIN values—predominantly to IGP—by many networks, including Tier-1s, altering route selection and diverting traffic for commercial advantage. The report describes methodology, measurements across IPv4/IPv6, and the resulting routing and economic impacts.

📢 AWS has expanded 100 Gbps dedicated Direct Connect capacity at the Cirion data center in Lima, Peru. This location now supports private connections to all public AWS Regions (excluding China), AWS GovCloud, and AWS Local Zones, and is the first in Peru to offer 100 Gbps with MACsec encryption. Direct Connect provides private, physical links between AWS and customer data centers, offices, or colocation environments to deliver more consistent network performance than the public internet.

⚠️ Stadiums hosting the 2026 World Cup face massive cybersecurity challenges as tens of thousands of unmanaged fan devices join venue networks alongside payment systems, displays and operations platforms. Real-time visibility, network segmentation and identity-centric Zero Trust controls are essential to keep fan devices isolated from critical systems. SIEM, endpoint management and automated patching help accelerate detection and response, ensure compliance and reduce the risk of disruptive attacks during matches.

🔒 A multinational cybersecurity advisory warns that Russian government-sponsored actors are exploiting poorly configured routers and legacy protocols to steal device configurations and credentials. Attackers scan for devices using SNMPv1/v2, default community strings, and vulnerable Cisco features like Smart Install, then exfiltrate config files to attacker-controlled servers. Agencies recommend migrating to SNMPv3, disabling legacy protocols and Cisco Smart Install, enforcing strong passwords and MFA, blocking SNMP at firewalls, updating software, and retiring EOL devices.

🦑 A decades-old bug in the Squid proxy can leak HTTP request data, a flaw dubbed "Squidbleed." This post mixes a lighthearted squid image with serious security discussion, noting the vulnerability's age and potential impact on privacy. The author also invites readers to discuss other current security news not yet covered.