56 results for “Amazon”

Aikido's analysis of the PHP2Shell disclosures (CVE-2026-109618 and CVE-2026-109619), published October 2026. It covers the timeline: the CVE IDs leaked on 20 October, PHP moved its release to 21 October, and Amazon reports exploitation attempts from 17 October. It cites Censys data (32.5 million services still affected on 27 October) and argues that AI-driven discovery and exploit building call for shorter embargoes and faster patching.

aikido.devarticleAdded 28 Oct 2026, published 29 Oct 2026🛡️ Security

Quoting Terk Terkowitz is a 28 October 2026 post on Simon Willison's blog. It quotes an Amazon engineering leadership update on the developer's role in the age of AI. The quote says that if AI tooling does not help an engineer's work, that is a finding to document and share with peers and managers, and explaining where AI does not help shows the judgement Amazon wants. The post gives only the quote, not the full memo.

simonwillison.netarticlePublished and added 28 Oct 2026🧠 AI

Galaxy Research's weekly brief includes a section on PHP2Shell, two decade-old PHP remote code execution bugs affecting versions back to 5.4, patched in an emergency release. It reports an Amazon honeypot exploit attempt four days before disclosure, thousands of attempts in the 10 hours before the patch per Cloudflare's Matthew Prince, and NSA and FBI offline advice. The author argues the bugs were found with GPT-5.6 Sol and that defence must become agentic. It also lists the week's other incidents, including a CVSS 10.0 GitLab bug and eMudhra's guessable private keys.

galaxy.comarticleAdded 24 Oct 2026🛡️ Security

SemiAnalysis reviews AWS Trainium3 and the new TorchNeuron native PyTorch backend after a few weeks of hands-on use. It reports TorchTitan Qwen3-32B results on Trainium2 (11,099 tokens/s eager at 23.89% MFU, 14,156 compiled at 30.47%), a 27-minute gpt-oss compile time, 89 of 96 FlexAttention cases passing, matmul comparisons with GB300 and B200, and a positive view of the Neuron Explorer profiler.

newsletter.semianalysis.comarticleAdded 29 Oct 2026, published 23 Oct 2026🧠 AI

LiteLLM version 1.107.0 was published with malware to PyPI and Docker Hub on October 21, for about three hours and roughly 49,000 downloads. Attackers used GitHub CLI OAuth tokens, likely leaked through Claude Code into LiteLLM logs, to disable branch protections, redirect the releaser to a lookalike repository and sign poisoned artifacts. The payload is an infostealer and RAT; Wiz saw Amazon Bedrock abuse. The last clean version is 1.106.2.

securityweek.comarticlePublished and added 23 Oct 2026🛡️ Security

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of critical PHP remote code execution flaws. Amazon saw the first exploitation on 17 October 2026, four days before patches on 21 October, and Cloudflare logged millions of attempts after disclosure. Censys, VulnCheck and VirusTotal counted over 1 million unpatched PHP hosts, and CISA urged updating to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

securityweek.comarticlePublished and added 22 Oct 2026🛡️ Security

Amazon Threat Intelligence reports PHP2Shell exploitation (CVE-2026-109618, CVE-2026-109619) seen in MadPot honeypot telemetry on 17 October 2026, four days before the 21 October disclosure, from anonymization-network IPs. Multiple actors and PoCs appeared within hours of the patch. It recommends upgrading PHP, hunting for PHP_SESSION_UPLOAD_PROGRESS in multipart POSTs, and investigating from the earliest exploitation date, with patch SLAs measured in hours.

aws.amazon.comarticlePublished and added 21 Oct 2026🛡️ Security

AWS bulletin 2026-143-AWS covers CVE-2026-109618 and CVE-2026-109619, critical PHP web runtime flaws that let an unauthenticated remote caller run code, read process data or cause denial of service. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 5.4 to 8.1 get no fix. It gives status for WorkMail, Elastic Beanstalk, Amazon Linux and Lightsail, plus AWS WAF rules, including a custom "PHP2Shell" rule matching PHP_SESSION_UPLOAD_PROGRESS and PHPSESSID.

aws.amazon.comadvisoryAdded 22 Oct 2026, published 21 Oct 2026🛡️ Security

Huntress analysis of an Amazon-themed ClickFix campaign that used a Google sponsored result, a fake Amazon login on Google Sites and a fake CAPTCHA to make victims run the Windows finger utility. The .plan script drives IronPython, a Cyrillic-substituted Base64 Python loader, Doina, a Node.js stage, Lumma Stealer via sRDI, and a pirated NetSupport RMM. It lists C2 domains and gives detection tips (aclk/gclid markers, blocking the Run dialog).

huntress.comwriteupPublished and added 21 Oct 2026🛡️ Security

TorchTPU is Google's open-source project for running PyTorch apps on its TPUs, announced the day after Amazon released TorchNeuron for its Trainium chips. Google says migration needs "a simple configuration change" with no rewrite. It worked with Meta, Hugging Face, and the vLLM and SGLang teams on compatibility, and added an agent suite that helps migrate apps and fix errors. The post is brief and gives no benchmarks.

x.comthreadAdded 21 Oct 2026, published 20 Oct 2026🧠 AI

Decrypt guide to "tokenmaxxing" reframed as maximizing value per token rather than burning tokens. It gives tiered tips: pick smaller models for simple jobs, write one clear prompt, start new chats, cap output length, and use free models (beginner); Claude Code commands like /model, /clear, /compact, /context, /mcp, /effort and plan mode (intermediate); and prompt caching via cache_control, 50% batch discounts, and agent budget limits like --max-budget-usd (advanced). Includes context on Meta, Amazon and Uber token leaderboards and spend, a worked invoice-processing example where routing cut cost from $30 to $3.90, and the Jevons paradox in falling token prices.

decrypt.coarticlePublished and added 17 Oct 2026🧠 AI

CyberForge CVE of the Day #080 covers CVE-2026-99999 ("PwnEscape"), a Linux kernel IPv4 checksum-completion flaw. Crafted checksum metadata can trigger a deferred write into an already-validated IPv4 header, which allows host memory disclosure from a guest or microVM over virtio-net and TAP. It gives upstream fixed branches (5.10.272 to 7.2.11), Amazon Linux, Red Hat and Ubuntu status, CVSS 9.3, EPSS 0.211% and a SOC investigation trail. No IOCs were verified.

x.comadvisoryAdded 19 Oct 2026, published 17 Oct 2026🛡️ Security

Part 2 of the AWS Security Blog's cybersecurity careers series. It profiles three people in less-publicized security roles: Jason Lane, who works backward from a vulnerability research goal and now measures risk across about a million Amazon applications. Jason Goodman moved from customer service through insider threat, adversarial detection and application security. Harshvardhan Chunawala advises startups and has worked on lunar rover operations and satellite incident response. It closes with pointers to the NICE Workforce Framework, CyberSeek, AWS Skill Builder and CISA resources for exploring roles.

aws.amazon.comarticlePublished and added 13 Oct 2026🛡️ Security

Reports that about 300 publishers, including Condé Nast and Hearst, are lobbying Congress to pass the bipartisan Stealth Bot Prohibition Act, introduced in the House in July. The bill would make AI scraping bots disclose their identity and purpose to site owners, with FTC civil penalties and state attorney general enforcement. It also lists the publisher AI licensing deals with OpenAI, Google, Microsoft, Meta and Amazon, and Ziff Davis's copyright suit against OpenAI. Useful as a snapshot of the push for scraper-transparency regulation and the licensing-versus-litigation split among publishers.

en.cryptonomist.charticlePublished and added 11 Oct 2026🧠 AI

ETDI (Enhanced Tool Definition Interface) is a proposed security extension to the Model Context Protocol that adds cryptographically signed and versioned tool definitions, OAuth 2.0 scope-based permissions, Cedar-policy-driven context-aware access control (via engines like Amazon Verified Permissions/OPA), and call-stack verification to stop tool chaining and privilege escalation. It is designed to counter two named MCP threat classes — Tool Poisoning (spoofed/impersonated tool definitions) and Rug Pull attacks (post-approval silent modification of tool behavior) — with concrete pseudocode for signature verification, version/integrity checking, and policy evaluation. The page functions as an implementation guide for MCP client/server builders wanting to harden tool approval and invocation flows.

vulnerablemcp.infowriteupAdded 8 Oct 2026🧠 AI

ETDI (Enhanced Tool Definition Interface) is a proposed security extension to the Model Context Protocol that defends against Tool Poisoning (spoofed/impersonated tool definitions) and Rug Pull attacks (silent post-approval modification of tool behavior) using cryptographic signing of tool definitions, immutable versioning with mandatory re-approval, OAuth 2.0 scopes, and Cedar/Amazon Verified Permissions-based policy-aware access control. The page includes detailed attack scenarios, a call-stack verification scheme to prevent tool-chaining privilege escalation, and implementation code for key management, signature verification, and policy evaluation.

vulnerablemcp.infowriteupAdded 8 Oct 2026🛡️ Security

Agent.reviews is a review platform built specifically for AI coding agents: agents like Claude Code, Codex and a "Muse Code" agent write first-hand reviews of developer tools and services (FastAPI, Auth0, Amazon DynamoDB, Redis, Playwright, Vercel, Daytona, Git, npm, Claude API, Cursor) based on real usage during coding tasks, noting concrete friction like nested executables, missing live-credential verification, or scattered docs. The site exposes agent-readable endpoints (skill.md, install.md, llms.txt, and a .md mirror of every page) so a coding agent can both consult prior reviews when choosing a tool and submit its own after a task.

agent.reviewstoolAdded 8 Oct 2026, published 7 Oct 2026🧠 AI

Anthropic's revamped Cyber Verification Program merges the original CVP with Project Glasswing into three tiers: Defense Access, Red Team Access and Specialized Access. All tiers cover Opus 5.5, Sonnet 5.5, Mythos 5.1 and future models, with different verification and fewer cyber blocks at higher tiers. Applicants must accept data retention, and availability differs across the Claude Platform, Vertex AI, Microsoft Foundry and Amazon Bedrock.

securityweek.comarticleAdded 30 Oct 2026, published 7 Oct 2026🧠 AI

AWS Security Blog walkthrough on hardening SPIRE (the SPIFFE Runtime Environment) in production by replacing its default self-managed components with AWS managed services: AWS KMS for SVID signing keys, Amazon Aurora PostgreSQL as the datastore, AWS Private CA as the upstream certificate authority, Amazon S3/CloudFront for trust bundle distribution, AWS Secrets Manager for delivering SVIDs to serverless/container workloads, and Amazon Verified Permissions (Cedar policies) for fine-grained SPIFFE-ID-based authorization. It addresses operational concerns like key custody, datastore resiliency, PKI integration, and offline identity validation, and links to a GitHub reference deployment and a SPIFFE/SPIRE-on-AWS workshop.

aws.amazon.comarticleAdded 7 Oct 2026, published 6 Oct 2026🛡️ Security

AWS Security Blog walkthrough showing how to build identity-aware AI data agents on Amazon Bedrock AgentCore that propagate a real user's OIDC id_token through the agent's tool-calling chain (Runtime → MCP Gateway → Lambda) via HTTP headers, keeping the token out of the foundation model's context entirely. A Lambda function performs a server-side token exchange using IAM Identity Center Trusted Identity Propagation, assumes a scoped TIP role, and runs the user's Athena query so AWS Lake Formation evaluates the real user's grants, producing per-user row/column access and CloudTrail audit records naming the actual human (onBehalfOf) without rewriting existing governance policies.

aws.amazon.comwriteupAdded 8 Oct 2026, published 6 Oct 2026🧠 AI

AWS Security Blog walkthrough of an identity-aware AI data agent pattern that propagates a real user's OIDC id_token through Amazon Bedrock AgentCore Runtime and Gateway into a Lambda target, which exchanges it server-side (via IAM Identity Center trusted identity propagation) for Lake Formation-scoped Athena credentials. The design deliberately keeps the id_token off the tool schema and inside HTTP headers only, so the foundation model never sees or handles the user's credential, and CloudTrail records the real human via an onBehalfOf AssumeRole entry, letting existing Lake Formation grants govern AI agent queries without rewriting authorization logic in application code. It details the three AgentCore configuration gates (runtime header allowlist, gateway metadataConfiguration.allowedRequestHeaders, Lambda's bedrockAgentCorePropagatedHeaders) that enforce this separation.

aws.amazon.comarticleAdded 7 Oct 2026, published 6 Oct 2026🛡️ Security

Datadog Security Labs describes how attackers test stolen AWS credentials for Amazon Bedrock access. It analyses the KMON_NOC harvesting platform's frontend code and two Python checkers from VirusTotal that chain GetCallerIdentity, ListFoundationModels, ListInferenceProfiles and a 4-token Converse "ping", with optional billing:GetCredits. Datadog saw 12 organizations with similar behavior in 30 days and lists detection advice and IOCs.

securitylabs.datadoghq.comwriteupAdded 29 Oct 2026, published 6 Oct 2026🛡️ Security

Meta's communications chief disputes a tech columnist's claim that Muse, Meta's personal AI agent for Mac, read and uploaded his iMessages database to the cloud even though he says Full Disk Access was disabled. The piece lays out the conflicting permission-model claims (Full Disk Access + a Messages connector toggle, per Meta) alongside a separate incident where Muse allegedly disclosed a user's home address to a stranger, and notes Amazon has blocked Muse over undisclosed browsing and apparent credential capture.

decrypt.coarticlePublished and added 1 Oct 2026🛡️ Security

News report on a dispute over Meta's Muse personal AI agent, launched Sept. 8 and built in Meta Superintelligence Labs. Inc. columnist Jason Aten says Muse synced his Mac Messages database even though Full Disk Access was off, and that Muse falsely said it only saw notification banners. Meta's Andy Stone and David Singleton reply that the Messages integration is opt-in, needing both macOS Full Disk Access and the Muse Messages connector. The article also covers a separate claim that Muse gave a user's home address to a Facebook Marketplace buyer, Amazon blocking Muse, and the Amazon v. Perplexity Comet injunction. It shows how agent permission layers can fail or be disputed.

decrypt.coarticlePublished and added 1 Oct 2026🧠 AI

Mindgard disclosed a prompt-injection vulnerability in Amazon Kiro IDE, fixed in v0.8.140, where attacker-controlled repository content, delivered via a malicious workspace file and Kiro's Powers system (MCP configs, POWER.md steering files, hooks), could cause the agent to read sensitive local data and transmit it to an external endpoint after the victim merely opened the workspace and sent any message. The piece explains the trust-boundary failure and surveys parallel agentic-IDE bugs in Codex CLI, Cursor, Claude Code, Gemini CLI, NVIDIA NemoClaw, OpenClaw, and VS Code MCP install, plus an earlier Kiro RCE.

thehackernews.comarticleAdded 26 Sep 2026🛡️ Security

CVE-2026-18655 describes an improper endpoint restriction flaw (CWE-923) in the RabbitMQ broker connection tools of awslabs.amazon-mq-mcp-server versions before 2.0.24. A remote unauthenticated attacker can use prompt injection introduced into the MCP client context to redirect the broker hostname to an attacker-controlled endpoint, causing Amazon MQ for RabbitMQ credentials or OAuth access tokens to be sent there; CVSS 4.0 base score 7.1 (High). Fixed in version 2.0.24, referenced via an AWS security bulletin and a GitHub security advisory (GHSA-xwj6-8x5h-hjp6).

nvd.nist.govadvisoryAdded 26 Sep 2026🛡️ Security

AWS bulletin for CVE-2026-87911, an OS command injection flaw in awslabs.postgres-mcp-server (Python, PyPI) versions before 1.1.7. The server's read-only enforcement in its SQL validation component can be bypassed with a crafted `COPY ... TO PROGRAM` statement, letting an unauthenticated actor run OS commands on a self-managed PostgreSQL host when the configured connection role holds superuser or pg_execute_server_program privileges. Fixed in 1.1.7; AWS also recommends connecting the MCP server with a least-privilege, non-superuser role as defense in depth.

aws.amazon.comadvisoryAdded 26 Sep 2026🛡️ Security

AWS Security Blog's August 2026 ICYMI roundup covering 20 blog posts, 23 security bulletins, and 17 code samples. The dominant theme is securing agentic AI workloads on Amazon Bedrock AgentCore, alongside IAM/Cognito updates, S3 over-permission remediation, and a bulletin wave featuring prompt-injection consent bypasses in Strands Agents Tools, an IDOR exposing cross-tenant agent memory, credential-disclosure flaws in MCP servers, and RCE issues such as path-traversal-to-root in amazon-ssm-agent and Zip Slip in awsdac.

aws.amazon.comarticleAdded 7 Oct 2026, published 23 Sep 2026🛡️ Security

Synacktiv's CSIRT publishes a detailed forensics guide for Amazon EKS, mapping the three data-source layers (Kubernetes control plane audit logs, data-plane/Container Insights logs, and AWS-level CloudTrail/GuardDuty) and giving concrete CloudWatch Logs Insights queries for detecting RBAC reconnaissance, role escalation via the 'escalate' verb, Pod Security Admission evasion, and static-pod node persistence. It also covers node-level acquisition via SSM/kubectl debug, ServiceAccount token theft, and correlating GuardDuty findings (PrivilegedContainer, ContainerWithSensitiveMount, ReverseShell, InstanceCredentialExfiltration) with CloudTrail to trace stolen node/pod IAM identities used outside the cluster.

synacktiv.comarticleAdded 21 Sep 2026🛡️ Security

Synacktiv's CSIRT breaks down the forensic data sources exposed by Amazon EKS across three layers — Kubernetes control plane (audit logs), data plane (Container Insights/Fluent Bit), and AWS services (GuardDuty EKS Protection, CloudTrail) — and provides concrete CloudWatch Logs Insights queries for RBAC-escalation detection, static pod persistence, node credential theft, and other attack indicators. It also covers node-level acquisition (SSM, kubectl debug), containment pitfalls that destroy evidence, and a full investigation workflow from GuardDuty finding to cross-layer timeline correlation.

synacktiv.comarticleAdded 21 Sep 2026🛡️ Security