OffNet Newsroom

Daily topic roundup

AWS

Wednesday, October 07, 2026 · 5 stories, curated & summarized — click any story for the source.

Share this roundup on LinkedIn Full edition
AWS What's New awsdatabase

AWS Client VPN Adds Device Posture Assessment via Cedar Policies

AWS Client VPN now enforces device health checks before granting network access, integrating with providers like CrowdStrike, Jamf, and JumpCloud. Security signals such as encryption status and risk scores are evaluated using Cedar policies to ensure only compliant devices connect. This extends previous authentication methods by adding a layer of endpoint verification for AWS resources.

  • Integrate CrowdStrike, Jamf, or JumpCloud for automated device health checks.
  • Enforce compliance using Cedar policies for fine-grained access control.
  • Evaluate risk levels and encryption status before granting network access.
  • Combines with existing cert, SAML, or AD authentication for defense in depth.
HOW IT WORKSCedar Policy Access Flow1Connect via Client VPN2Query CrowdStrike or Jamf3Evaluate risk and encryption4Apply Cedar policy decision5Grant or deny access
Read at source →
AWS What's New awsdatabase ↺ since 10-04

AWS EKS adds support for Kubernetes 1.37 with Metrics API GA

Amazon EKS and EKS Distro now support Kubernetes version 1.37 for new clusters and upgrades via console, eksctl, or IaC tools. Key updates include the Metrics API graduating to general availability for pod and node resource monitoring. Dynamic Resource Allocation device taints and tolerations also reach GA status for better device management.

  • Create new EKS clusters or upgrade existing ones to Kubernetes 1.37 today.
  • Use the GA Metrics API for accurate CPU and memory metrics in HPA and kubectl top.
  • Leverage GA Dynamic Resource Allocation device taints for improved driver control.
  • Upgrade paths available through EKS console, eksctl CLI, and infrastructure-as-code.
CHECKLISTEKS 1.37 Action ItemsUpgrade clusters to Kubernetes 1.37Use GA Metrics API for monitoringLeverage GA Dynamic Resource AllocationUtilize console or eksctl for upgrades
Read at source →
InfoQ generaldevops ↺ since 10-05

Cloudflare Fixes Cross-Tenant Data Exposure in Containers

Cloudflare disclosed a vulnerability in its Containers and Sandboxes services where thin-provisioned storage pools failed to zero out reused blocks. This oversight allowed researchers to recover directory structures, database pages, and complete SQLite databases from other tenants across four continents. The company has patched the issue and stated there is no evidence of actual exploitation.

  • Thin-provisioned storage must enforce strict block zeroing to prevent data leakage between tenants.
  • SQLite databases are particularly vulnerable if not properly sanitized before block reuse.
  • Cloudflare confirmed no evidence of exploitation despite the severity of the exposure.
  • Auditing storage pool configurations is critical for multi-tenant container environments.
Read at source →
The Register general ↺ since 10-06

KVM guest-host escape flaw linked to Firecracker MicroVMs

A security researcher has identified a vulnerability in KVM that allows a guest to escape to the host environment. The issue appears to be specifically associated with Firecracker MicroVMs, which originated at AWS. This finding highlights potential risks in lightweight virtualization architectures that rely heavily on KVM for isolation.

  • Firecracker MicroVMs are the suspected source of this KVM escape flaw.
  • Guest-to-host escapes compromise the fundamental isolation of virtualization.
  • Verify if your fleet uses Firecracker and apply relevant vendor patches.
Read at source →
AWS What's New awsdatabase ↺ since 10-05

AWS Security Hub bundles GuardDuty Runtime Monitoring into Threat Analytics billing

AWS has integrated Amazon GuardDuty Runtime Monitoring into the AWS Security Hub Threat Analytics plan, consolidating billing for this capability. The feature inspects OS, network, and file activity to detect threats like container escapes and cryptomining across EC2, EKS, and Fargate environments. Customers with Security Hub enabled in a region will no longer see separate GuardDuty charges for Runtime Monitoring, as usage is now metered under a single Security Hub billing type.

  • Runtime Monitoring is now part of the Threat Analytics plan, simplifying cost attribution.
  • Separate GuardDuty bills for Runtime Monitoring are replaced by a unified Security Hub meter.
  • Coverage spans EC2 instances, EKS clusters, and ECS tasks on Fargate without extra charges.
  • Threat detection includes container escapes, privilege escalation, and cryptomining activities.
HOW IT WORKSUnified Threat Monitoring Flow1Inspect OS, network, and file activity2Detect container escapes and cryptomining3Assess across EC2, EKS, and Fargate4Bill via single Security Hub meter
Read at source →
↑