AWS

Microsoft has patched a critical identity vulnerability in Entra ID rated a perfect 10 out of 10 for severity. The company acknowledged the bug is currently under active attack in the wild but declined to disclose the specific threat actors or the extent of the compromise. This disclosure highlights a high-severity identity management risk that is already being weaponized by adversaries.

• Entra ID identity flaw rated 10/10 CVSS is actively being exploited in the wild.
• Microsoft has released a patch but refuses to identify attackers or impact scope.
• Immediate patching of Entra ID components is critical for cloud identity security.
• Monitor for anomalous authentication patterns given the active exploitation status.

Security researcher Christopher Domas released skitter-creek-bath-salts, a tool that manipulates memory controller translation registers to bypass CPU privilege boundaries. This vulnerability allows unprivileged software to access protected memory regions, exposing a fundamental flaw in modern processor architectures. The exploit poses significant risks to cloud environments and confidential computing implementations.

• Unprivileged code can now access protected memory by tweaking DRAM controller registers.
• The exploit targets CPU privilege boundaries, undermining hardware-level isolation.
• Cloud and confidential computing deployments face heightened security risks.
• Researchers have released the tool for public testing and awareness.

Wiz researchers analyzed six neocloud providers offering S3-compatible object storage and found significant security gaps relative to Amazon S3. Although S3 is the industry standard, most compatible services fail to implement several critical AWS security controls. This discrepancy exposes users to higher risks when migrating workloads under the assumption of parity.

• S3 compatibility does not ensure equivalent security postures across providers.
• Six neoclouds examined lacked key AWS security protections identified by Wiz.
• Assuming parity between S3 and compatible services is a dangerous operational risk.
• Audit your vendor's security controls explicitly rather than relying on API compatibility.

AWS Security is facing criticism for prioritizing the quarantine of leaked credentials over more robust remediation strategies. The current approach is viewed as insufficient for effectively mitigating the risks associated with exposed secrets. This decision highlights a gap between current security protocols and the practical needs of preventing credential misuse.

• Quarantining alone is deemed insufficient for securing leaked credentials.
• AWS Security faces scrutiny for this limited remediation strategy.
• The approach may leave organizations vulnerable to credential misuse.
• Practitioners should look beyond quarantine for effective secret protection.

Alibaba Cloud is reducing reliance on Western silicon to accelerate its AI infrastructure, a move designed to protect and expand its already substantial profit margins. This strategic pivot comes as the company seeks sustained growth amid slowing performance in its core e-commerce business. The shift underscores a broader industry trend toward sovereign supply chains for high-performance computing.

• Alibaba prioritizes AI growth to offset stagnating e-commerce revenue streams.
• Reducing Western chip dependency aims to preserve high AI infrastructure margins.
• Supply chain sovereignty is becoming critical for large-scale cloud AI operations.
• Practitioners should monitor alternative silicon availability for future scaling.