Autonomous AI Hacking and the Future of Cybersecurity

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/10/autonomous-ai-hacking-and-the-future-of-cybersecurity.html

AI agents are now hacking computers. They’re getting better at all phases of cyberattacks, faster than most of us expected. They can chain together different aspects of a cyber operation, and hack autonomously, at computer speeds and scale. This is going to change everything.

Over the summer, hackers proved the concept, industry institutionalized it, and criminals operationalized it. In June, AI company XBOW took the top spot on HackerOne’s US leaderboard after submitting over 1,000 new vulnerabilities in just a few months. In August, the seven teams competing in DARPA’s AI Cyber Challenge collectively found 54 new vulnerabilities in a target system, in four hours (of compute). Also in August, Google announced that its Big Sleep AI found dozens of new vulnerabilities in open-source projects.

It gets worse. In July Ukraine’s CERT discovered a piece of Russian malware that used an LLM to automate the cyberattack process, generating both system reconnaissance and data theft commands in real-time. In August, Anthropic reported that they disrupted a threat actor that used Claude, Anthropic’s AI model, to automate the entire cyberattack process. It was an impressive use of the AI, which performed network reconnaissance, penetrated networks, and harvested victims’ credentials. The AI was able to figure out which data to steal, how much money to extort out of the victims, and how to best write extortion emails.

Another hacker used Claude to create and market his own ransomware, complete with “advanced evasion capabilities, encryption, and anti-recovery mechanisms.” And in September, Checkpoint reported on hackers using HexStrike-AI to create autonomous agents that can scan, exploit, and persist inside target networks. Also in September, a research team showed how they can quickly and easily reproduce hundreds of vulnerabilities from public information. These tools are increasingly free for anyone to use. Villager, a recently released AI pentesting tool from Chinese company Cyberspike, uses the Deepseek model to completely automate attack chains.

This is all well beyond AIs capabilities in 2016, at DARPA’s Cyber Grand Challenge. The annual Chinese AI hacking challenge, Robot Hacking Games, might be on this level, but little is known outside of China.

Tipping point on the horizon

AI agents now rival and sometimes surpass even elite human hackers in sophistication. They automate operations at machine speed and global scale. The scope of their capabilities allows these AI agents to completely automate a criminal’s command to maximize profit, or structure advanced attacks to a government’s precise specifications, such as to avoid detection.

In this future, attack capabilities could accelerate beyond our individual and collective capability to handle. We have long taken it for granted that we have time to patch systems after vulnerabilities become known, or that withholding vulnerability details prevents attackers from exploiting them. This is no longer the case.

The cyberattack/cyberdefense balance has long skewed towards the attackers; these developments threaten to tip the scales completely. We’re potentially looking at a singularity event for cyber attackers. Key parts of the attack chain are becoming automated and integrated: persistence, obfuscation, command-and-control, and endpoint evasion. Vulnerability research could potentially be carried out during operations instead of months in advance.

The most skilled will likely retain an edge for now. But AI agents don’t have to be better at a human task in order to be useful. They just have to excel in one of four dimensions: speed, scale, scope, or sophistication. But there is every indication that they will eventually excel at all four. By reducing the skill, cost, and time required to find and exploit flaws, AI can turn rare expertise into commodity capabilities and gives average criminals an outsized advantage.

The AI-assisted evolution of cyberdefense

AI technologies can benefit defenders as well. We don’t know how the different technologies of cyber-offense and cyber-defense will be amenable to AI enhancement, but we can extrapolate a possible series of overlapping developments.

Phase One: The Transformation of the Vulnerability Researcher. AI-based hacking benefits defenders as well as attackers. In this scenario, AI empowers defenders to do more. It simplifies capabilities, providing far more people the ability to perform previously complex tasks, and empowers researchers previously busy with these tasks to accelerate or move beyond them, freeing time to work on problems that require human creativity. History suggests a pattern. Reverse engineering was a laborious manual process until tools such as IDA Pro made the capability available to many. AI vulnerability discovery could follow a similar trajectory, evolving through scriptable interfaces, automated workflows, and automated research before reaching broad accessibility.

Phase Two: The Emergence of VulnOps. Between research breakthroughs and enterprise adoption, a new discipline might emerge: VulnOps. Large research teams are already building operational pipelines around their tooling. Their evolution could mirror how DevOps professionalized software delivery. In this scenario, specialized research tools become developer products. These products may emerge as a SaaS platform, or some internal operational framework, or something entirely different. Think of it as AI-assisted vulnerability research available to everyone, at scale, repeatable, and integrated into enterprise operations.

Phase Three: The Disruption of the Enterprise Software Model. If enterprises adopt AI-powered security the way they adopted continuous integration/continuous delivery (CI/CD), several paths open up. AI vulnerability discovery could become a built-in stage in delivery pipelines. We can envision a world where AI vulnerability discovery becomes an integral part of the software development process, where vulnerabilities are automatically patched even before reaching production—a shift we might call continuous discovery/continuous repair (CD/CR). Third-party risk management (TPRM) offers a natural adoption route, lower-risk vendor testing, integration into procurement and certification gates, and a proving ground before wider rollout.

Phase Four: The Self-Healing Network. If organizations can independently discover and patch vulnerabilities in running software, they will not have to wait for vendors to issue fixes. Building in-house research teams is costly, but AI agents could perform such discovery and generate patches for many kinds of code, including third-party and vendor products. Organizations may develop independent capabilities that create and deploy third-party patches on vendor timelines, extending the current trend of independent open-source patching. This would increase security, but having customers patch software without vendor approval raises questions about patch correctness, compatibility, liability, right-to-repair, and long-term vendor relationships.

These are all speculations. Maybe AI-enhanced cyberattacks won’t evolve the ways we fear. Maybe AI-enhanced cyberdefense will give us capabilities we can’t yet anticipate. What will surprise us most might not be the paths we can see, but the ones we can’t imagine yet.

This essay was written with Heather Adkins and Gadi Evron, and originally appeared in CSO.

Т.Е. от Е.Т. – епизод 26

Post Syndicated from Тоест original https://www.toest.bg/t-e-ot-e-t-epizod-26/

Т.Е. от Е.Т. – епизод 26

Боклуци, Бойко, Дидо и ИТН – нещо още трябва ли ви? А, да, имаме и Виктория Бекъм към края, ама там не сме чели статията и не знаем какво става.

Следете видеорубриката на Елена Телбис за „Тоест“ и във Facebook, Instagram и TikTok.

[$] Gccrs after libcore

Post Syndicated from corbet original https://lwn.net/Articles/1040197/

Despite its increasing popularity, the Rust programming language is still
supported by a single compiler, the LLVM-based rustc. At the 2025 GNU Tools
Cauldron, Pierre-Emmanuel Patry said that a lot of people are waiting
for a GCC-based Rust compiler before jumping into the language. Patry, who
is working on just that compiler (known as “gccrs”), provided an update on
the status of that project and what is coming next.

[$] Last-minute /boot boost for Fedora 43

Post Syndicated from jzb original https://lwn.net/Articles/1041078/

Sudden increases in the size of Fedora’s initramfs
files have prompted the project to fast-track a proposal to increase
the default size of the /boot partition for new installs of
Fedora 43 and later. The project has also walked back a few
changes that have contributed to larger initramfs files, but the
ever-increasing size of firmware means that the need for more room is
unavoidable. The Fedora Engineering Steering Council (FESCo) has
approved a last-minute change
just before the final freeze for Fedora 43 to increase the
default size of the /boot partition from 1GB to 2GB; this
will leave plenty of space for kernels and initramfs images if a user
is installing from scratch, but it is of no help for users upgrading
from Fedora 42.

Announcing Amazon Quick Suite: your agentic teammate for answering questions and taking action

Post Syndicated from Esra Kayabali original https://aws.amazon.com/blogs/aws/reimagine-the-way-you-work-with-ai-agents-in-amazon-quick-suite/

Today, we’re announcing Amazon Quick Suite, a new agentic teammate that quickly answers your questions at work and turns those insights into actions for you. Instead of switching between multiple applications to gather data, find important signals and trends, and complete manual tasks, Quick Suite brings AI-powered research, business intelligence, and automation capabilities into a single workspace. You can now analyze data through natural language queries, find critical information across enterprise and external sources in minutes, and automate processes from simple tasks to complex multi-department workflows.

Here’s a look into Quick Suite.

Business users often need to gather data across multiple applications—pulling customer details, checking performance metrics, reviewing internal product information, and performing competitive intelligence. This fragmented process often requires consultation with specialized teams to analyze advanced datasets, and in some cases, must be repeated regularly, reducing efficiency and leading to incomplete insights for decision-making.

Quick Suite helps you overcome these challenges by combining agentic teammates for research, business intelligence, and automation into a unified digital workspace for your day-to-day work.

Integrated capabilities that power productivity 
Quick Suite includes the following integrated capabilities:

  • Research – Quick Research accelerates complex research by combining enterprise knowledge, premium third-party data, and data from the internet for more comprehensive insights.
  • Business intelligence – Quick Sight provides AI-powered business intelligence capabilities that transform data into actionable insights through natural language queries and interactive visualizations, helping everyone make faster decisions and achieve better business outcomes.
  • Automation – Quick Flows and Quick Automate help users and technical teams to automate any business process from simple, routine tasks to complex multi-department workflows, enabling faster execution and reducing manual work across the organization.

Let’s dive into some of these key capabilities.

Quick Index: Your unified knowledge foundation
Quick Index creates a secure, searchable repository that consolidates documents, files, and application data to power AI-driven insights and responses across your organization.

As a foundational component of Quick Suite, Quick Index operates in the background to bring together all your data—from databases and data warehouses to documents and email. This creates a single, intelligent knowledge base that makes AI responses more accurate and reduces time spent searching for information.

Quick Index automatically indexes and prepares any uploaded files or unstructured data you add to your Quick Suite, enabling efficient searching, sorting, and data access. For example, when you search for a specific project update, Quick Index instantly returns results from uploaded documents, meeting notes, project files, and reference materials—all from one unified search instead of checking different repositories and file systems.

To learn more, visit the Quick Index overview page.

Quick Research: From complex business challenges to expert-level insights
Quick Research is a powerful agent that conducts comprehensive research across your enterprise data and external sources to deliver contextualized, actionable insights in minutes or hours — work that previously could take longer.

Quick Research systematically breaks down complex questions into organized research plans. Starting with a simple prompt, it automatically creates detailed research frameworks that outline the approach and data sources needed for comprehensive analysis.

After Quick Research creates the plan, you can easily refine it through natural language conversations. When you are happy with the plan, it works in the background to gather information from multiple sources, using advanced reasoning to validate findings and provide thorough analysis with citations.

Quick Research integrates with your enterprise data connected to Quick Suite, the unified knowledge foundation that connects to your dashboards, documents, databases, and external sources, including Amazon S3, Snowflake, Google Drive, and Microsoft SharePoint. Quick Research grounds key insights to original sources and reveals clear reasoning paths, helping you verify accuracy, understand the logic behind recommendations, and present findings with confidence. You can trace findings back to their original sources and validate conclusions through source citations. This makes it ideal for complex topics requiring in-depth analysis.

To learn more, visit the Quick Research overview page.

Quick Sight: AI-powered business intelligence
Quick Sight provides AI-powered business intelligence capabilities that transform data into actionable insights through natural language queries and interactive visualizations.

You can create dashboards and executive summaries using conversational prompts, reducing dashboard development time while making advanced analytics accessible without specialized skills.

Quick Sight helps you ask questions about your data in natural language and receive instant visualizations, executive summaries, and insights. This generative AI integration provides you with answers from your dashboards and datasets without requiring technical expertise.

Using the scenarios capability, you can perform what-if analysis in natural language with step-by-step guidance, exploring complex business scenarios and finding answers faster than before.

Additionally, you can respond to insights with one-click actions by creating tickets, sending alerts, updating records, or triggering automated workflows directly from your dashboards without switching applications.

To learn more, visit Quick Sight overview page.

Quick Flows: Automation for everyone
With Quick Flows, any user can automate repetitive tasks by describing their workflow using natural language without requiring any technical knowledge. Quick Flows fetches information from internal and external sources, takes action in business applications, generates content, and handles process-specific requirements.

Starting with straightforward business requirements, it creates a multi-step flow including input steps for gathering information, reasoning groups for AI-powered processing, and output steps for generating and presenting results.

After the flow is configured, you can share it with a single click to your coworkers and other teams. To execute the flow, users can open it from the library or invoke it from chat, provide the necessary inputs, and then chat with the agent to refine the outputs and further customize the results.

To learn more, visit the Quick Flows overview page.

Quick Automate: Enterprise-scale process automation
Quick Automate helps technical teams build and deploy sophisticated automation for complex, multistep processes that span departments, systems, and third-party integrations. Using AI-powered natural language processing, Quick Automate transforms complex business processes into multi-agent workflows that can be created merely by describing what you want to automate or uploading process documentation.

While Quick Flows handles straightforward workflows, Quick Automate is designed for comprehensive and complex business processes like customer onboarding, procurement automations, or compliance procedures that involve multiple approval steps, system integrations, and cross-departmental coordination. Quick Automate offers advanced orchestration capabilities with extensive monitoring, debugging, versioning, and deployment features.

Quick Automate then generates a comprehensive automation plan with detailed steps and actions. You will find a UI agent that understands natural language instructions to autonomously navigate websites, complete form inputs, extract data, and produces structured outputs for downstream automation steps.

Additionally, you can define a custom agent, complete with instructions, knowledge, and tools, to complete process-specific tasks using the visual building experience – no code required.

Quick Automate includes enterprise-grade features such as user role management and human-in-the-loop capabilities that route specific tasks to users or groups for review and approval before continuing workflows. The service provides comprehensive observability with real-time monitoring, success rate tracking, and audit trails for compliance and governance.

To learn more, visit the Quick Automate overview page.

Additional foundational capabilities
Quick Suite includes other foundational capabilities that deliver seamless data organization and contextual AI interactions across your enterprise.

Spaces – Spaces provide a straightforward way for every business user to add their own context by uploading files or connecting to specific datasets and repositories specific to their work or to a particular function. For example, you might create a space for quarterly planning that includes budget spreadsheets, market research reports, and strategic planning documents. Or you could set up a product launch space that connects to your project management system and customer feedback databases. Spaces can scale from personal use to enterprise-wide deployment while maintaining access permissions and seamless integration with Quick Suite capabilities.

Chat agents – Quick Suite includes insights agents that you can use to interact with your data and workflows through natural language. Quick Suite includes a built-in agent to answer questions across all of your data and custom chat agents that you can configure with specific expertise and business context. Custom chat agents can be tailored for particular departments or use cases—such as a sales agent connected to your product catalog data and pricing information stored in a space or a compliance agent configured with your regulatory requirements and actions to request approvals.

Additional things to know
If you’re an existing Amazon QuickSight customer – Amazon QuickSight customers will be upgraded to Quick Suite, a unified digital workspace that includes all your existing QuickSight business intelligence capabilities (now called “Quick Sight”) plus new agentic AI capabilities. This is an interface and capability change—your data connectivity, user access, content, security controls, user permissions, and privacy settings remain exactly the same. No data is moved, migrated, or changed.

Quick Suite offers per-user subscription-based pricing with consumption-based charges for the Quick Index and other optional features. You can find more detail on the Quick Suite pricing page.

Now available
Amazon Quick Suite gives you a set of agentic teammates that helps you get the answers you need using all your data and move instantly from answers to action so you can focus on high value activities that drive better business and customer outcomes.

Visit the getting started page to start using Amazon Quick Suite today.

Happy building
— Esra and Donnie

Ubuntu 25.10 released

Post Syndicated from jzb original https://lwn.net/Articles/1041405/

Ubuntu
25.10, “Questing Quokka”, has been released. This release includes
Linux 6.17, GNOME 49, GCC 15, Python 3.13.7,
Rust 1.85, and more. This release also features Rust-based
implementations of sudo and coreutils; LWN covered the switch to the
Rust-based tools in March. The 25.10 version of Ubuntu flavors
Edubuntu, Kubuntu, Lubuntu, Ubuntu Budgie, Ubuntu Cinnamon, Ubuntu
Kylin, Ubuntu MATE, Ubuntu Studio, and Xubuntu have also
been released.

Serverless ICYMI Q3 2025

Post Syndicated from Julian Wood original https://aws.amazon.com/blogs/compute/serverless-icymi-q3-2025/

Welcome to the 30th edition of the AWS Serverless ICYMI (in case you missed it) quarterly recap. At the end of a quarter, we share the most recent product launches, feature enhancements, blog posts, videos, live streams, and other interesting things that you might have missed!

In case you missed our last ICYMI, check out previous ICYMI posts.

Figure 1: Serverless calendar Q3 2025

Figure 1: Serverless calendar Q3 2025

GOTO Serverless Bengaluru

The Asia Serverless and GenAI Tour comprised 24 events across five countries. Cities included New Delhi, Bengaluru, Singapore, Manila, Bangkok, Perth, Melbourne, and Sydney. The GOTO Serverless conference in Bengaluru, India, formed the centerpiece with additional Developer Days, executive roundtables, user groups, cloud clubs, and specialized workshops. Thank you to all the developers who joined us on this incredible journey across Asia!

AWS Lambda

AWS Lambda now offers console to IDE integration and remote debugging capabilities that streamline the developer workflow from browser to Visual Studio Code and its clones. These enhancements reduce context switching and help developers debug Lambda functions directly in their preferred IDE environment.

The console to IDE feature provides an Open in Visual Studio Code button, enabling developers to move quickly from viewing their function in the browser to editing it in their IDE. AWS automatically handles setup, including the AWS Toolkit installation. Developers can also install dependencies and make code changes, which can automatically sync back to the cloud console. Watch the video to see how it works:

Remote debugging allows you to reduce debugging time from hours to minutes while simplifying local environment setups. You can set breakpoints and debug Lambda functions running in the actual cloud environment with complete access to Amazon VPC resources and AWS Identity and Access Management (AWS IAM) execution roles. The debugging connection uses AWS IoT Secure Tunneling Service, and AWS automatically cleans up debugging configuration after completion. Watch the video to see how it works:

Lambda now integrates with LocalStack directly in the AWS Toolkit for Visual Studio Code. This simplifies local testing of serverless applications involving multiple AWS services. You can now deploy serverless applications to LocalStack using the same commands, debug Lambda functions with one-click setup, and test end-to-end event-driven workflows locally before deploying to the cloud.

Lambda response streaming now supports a maximum response payload size of 200 MB, 10 times higher than before. Response streaming helps build applications that progressively stream response payloads back to clients, improving performance for latency-sensitive workloads by reducing time to first byte (TTFB) performance.

AWS Lambda Hackathon

The AWS Lambda Hackathon, challenged developers to build serverless applications solving real-world business problems using Lambda. With 3,732 participants and 331 project submissions, the competition showcased innovative serverless solutions across diverse domains.

Figure 2: AWS Lambda Hackathon

Figure 2: AWS Lambda Hackathon

We announced winners on July 22, 2025, with $15,000 in total prizes awarded:

  • First Place ($6,000): ForestShield: AWS Deforestation Detection by Younes Laaroussi is a serverless forest monitoring system that tracks deforestation in real-time.
  • Second Place ($4,000): Smart Meeting Assistant by Eduard-David Jitareanu lets you upload audio recordings to create and manage Jira tasks automatically.
  • Third Place ($3,000): Drone SoundAware by Ian Brumby allows drone operators to plan, assess, and optimize flight routes while reducing noise impact on communities.
  • Honorable Mentions ($500):
    • OutScan by Sheldon Aristide is an AI-powered, serverless genomic radar analyzing viral mutations in real-time to detect pandemic threats.
    • Buzz CSV by Damien Pace transforms Excel files into actionable insights through natural language queries.
    • Smart Clip AI by Alexander Bolaño turns long videos into short, high-impact clips.
    • VA Rating Assistant by Chris Lassiter helps you upload medical documents and uses AI to identify potential VA disability claims and ratings, helping veterans access benefits faster and more accurately.

Amazon ECS

Amazon ECS now offers Managed Instances, a new compute option that combines EC2 flexibility with fully managed infrastructure. The functionality automatically handles instance provisioning, scaling, and maintenance while allowing you to use the full range of EC2 capabilities. Key features include:

  • Automated security patching every 14 days with configurable maintenance windows
  • Intelligent task placement and resource optimization across instances
  • Support for custom instance attributes including GPU, CPU architecture, and network performance requirements
  • Built on Bottlerocket OS with automated security updates
  • Deep integration with EC2 pricing options
  • Default cost-optimized instance selection with option for custom specifications

Watch the video to learn more.

Amazon ECS now enables built-in blue/green deployments. This reduces the need for custom deployment tooling while making containerized application releases safer and more reliable. The new capability provisions the new application version (green) alongside the existing version (blue), allowing validation before routing production traffic. ECS also introduced deployment lifecycle hooks powered by Lambda functions that integrate custom validation steps multiple stages of deployment. Watch the video to learn more.

Amazon S3

Amazon S3 Vectors is now available in preview. This is a cloud object store with native support for storing vector datasets and with sub-second query performance for AI applications. Vector buckets is a new bucket type with dedicated APIs for storing, accessing, and querying vector data without infrastructure provisioning.

Figure 3: Amazon S3 Vectors

Figure 3: Amazon S3 Vectors

Amazon S3 Metadata now supports metadata for all your S3 objects. This allows you to analyze and query metadata for your entire S3 storage footprint. S3 Metadata live inventory tables gives you a fully managed Apache Iceberg table, including existing objects. This provides a fully managed snapshot of all objects and metadata, refreshed within 1 hour of changes. S3 Metadata journal tables offer a near-real-time view of object-level changes.

S3 also now supports a preview in the AWS Console for S3 Tables, making it easier to understand data structure and content without writing SQL. S3 Batch Operations now supports bulk target selection for managing buckets through the console. S3 also now supports conditional deletes in S3 general purpose buckets, allowing safer deletion operations.

Amazon EventBridge

Amazon EventBridge now provides enhanced logging capabilities with detailed information about successes, failures, and status codes. This new observability feature provides visibility into the complete event journey, showing when events are published, matched against rules, delivered to subscribers, or encounter failures. You can send logs to Amazon CloudWatch Logs, S3, or Amazon Data Firehose.

Generative AI with serverless

Discover how to effectively build AI agents on AWS Serverless shows how to use Amazon Bedrock AgentCore, Lambda, and ECS to build production-ready agentic AI systems. The blog explains how to use the Strands Agents SDK, which is a framework for building AI agents. The post includes storing session state, implementing authentication using Amazon Cognito and Amazon API Gateway, integrating tools through MCP, and establishing observability using OpenTelemetry.

Figure 4: Agentic loop

Figure 4: Agentic loop

A series on serverless generative AI architectural patterns (part1, part2) explores non-real-time generative AI scenarios. These include buffered asynchronous request-response using Amazon SQS queues, multimodal parallel fan-out using EventBridge or Amazon SNS, and non-interactive batch processing using AWS Step Functions or AWS Glue.

Kiro: Spec-driven AI development

AWS introduced Kiro, an agentic AI-powered IDE now available in preview. It is built on the open-source Code OSS platform (the same foundation as VS Code) so you can use your existing extensions. Kiro brings a spec-driven approach to software development that bridges the gap between rapid prototyping and production-ready code. Kiro emphasizes structured development. It breaks down developer prompts into comprehensive requirements, system design documents, and task lists before writing any code. You can download Kiro for macOS, Windows, and Linux from the Kiro website.

Amazon Bedrock AgentCore

Amazon Bedrock AgentCore is now available in preview, offering a set of services that help developers quickly and securely deploy AI agents at scale. AgentCore supports frameworks including CrewAI, LangGraph, LlamaIndex, and Strands Agents, and works with any model in or outside Amazon Bedrock.

AgentCore includes seven modular services:

  • AgentCore Runtime provides sandboxed low-latency serverless environments with up to 8-hour runtime support
  • AgentCore Memory manages both short-term and long-term memory with built-in policies
  • AgentCore Observability offers step-by-step visualization with OpenTelemetry support
  • AgentCore Identity provides a secure token vault for OAuth 2.0 and API keys.
  • AgentCore Gateway transforms APIs and Lambda functions into agent-ready tools with a unified MCP interface
  • AgentCore Browser enables managed web automation
  • AgentCore Code Interpreter provides safe code execution environments.

Amazon Bedrock

Amazon Bedrock continues to expand its foundation model selection with new models now generally available. Qwen models bring four fully managed open-weight models which excel at sophisticated coding tasks, multi-tool agentic workflows, and adaptive reasoning through hybrid thinking modes. DeepSeek-V3.1 delivers performance improvements on certain benchmarks while maintaining cost efficiency through its mixture-of-experts architecture.

Amazon SNS

Amazon SNS now supports three additional message filtering operators: wildcard matching, anything-but wildcard matching, and anything-but prefix matching. SNS also now supports message group IDs in standard topics, enabling fair queue functionality for subscribed SQS standard queues.

Serverless Compute Blog Posts

July

August

September

Serverless Office Hours weekly livestream

July

August

September

Videos

The Serverless landing page has more information. The Lambda resources page contains case studies, webinars, whitepapers, customer stories, reference architectures, and even more Getting Started tutorials.

You can also follow the Developer Advocacy team members who work on Serverless to see the latest news, follow conversations, and interact with the team.

And finally, visit ServerlessLand for all your serverless needs.

Security updates for Thursday

Post Syndicated from jake original https://lwn.net/Articles/1041404/

Security updates have been issued by AlmaLinux (gnutls, kernel, kernel-rt, and open-vm-tools), Debian (chromium, python-django, and redis), Fedora (chromium, insight, mirrorlist-server, oci-seccomp-bpf-hook, rust-maxminddb, rust-prometheus, rust-prometheus_exporter, rust-protobuf, rust-protobuf-codegen, rust-protobuf-parse, rust-protobuf-support, turbo-attack, and yarnpkg), Oracle (iputils, kernel, open-vm-tools, redis, and valkey), Red Hat (perl-File-Find-Rule and perl-File-Find-Rule-Perl), SUSE (expat, ImageMagick, matrix-synapse, python-xmltodict, redis, redis7, and valkey), and Ubuntu (fort-validator and imagemagick).

Introducing REACT: Why We Built an Elite Incident Response Team

Post Syndicated from Chris O’Rourke original https://blog.cloudflare.com/introducing-react-why-we-built-an-elite-incident-response-team/

Cloudforce One’s mission is to help defend the Internet. In Q2’25 alone, Cloudflare stopped an average of 190 billion cyber threats every single day. But real-world customer experiences showed us that stopping attacks at the edge isn’t always enough. We saw ransomware disrupt financial operations, data breaches cripple real estate firms, and misconfigurations cause major data losses.

In each case, the real damage occurred inside networks.

These internal breaches uncovered another problem: customers had to hand off incidents to separate internal teams for investigation and remediation. Those handoffs created delays and fractured the response. The result was a gap that attackers could exploit. Critical context collected at the edge didn’t reach the teams managing cleanup, and valuable time was lost. Closing this gap has become essential, and we recognized the need to take responsibility for providing customers with a more unified defense.

Today, Cloudforce One is launching a new suite of incident response and security services to help organizations prepare for and respond to breaches.

These services are delivered by Cloudforce One REACT (Respond, Evaluate, Assess, Consult Team), a group of seasoned responders and security veterans who investigate threats, hunt adversaries, and work closely with executive leadership to guide response and decision-making.

Customers already trust Cloudforce One to provide industry-leading threat intelligence, proactively identifying and neutralizing the most sophisticated threats. REACT extends that partnership, bringing our expertise directly to customer environments to stop threats wherever they occur. In this post, we’ll introduce REACT, explain how it works, detail the top threats our team has observed, and show you how to engage our experts directly for support.

Our goal is simple: to provide an end-to-end security partnership. We want to eliminate the painful gap between defense and recovery. Now, customers can get everything from proactive preparation to decisive incident response and full recovery—all from the partner you already trust to protect your infrastructure.

It’s time to move beyond fragmented responses and into one unified, powerful defense.

How REACT works

REACT services consist of two main components: Security advisory services to prepare for incidents and incident response for emergency situations.


A breakdown of the Cloudforce One incident readiness and response service offerings.

Advisory services are designed to assess and improve an organization’s security posture and readiness. These include proactive threat hunting, backed by Cloudflare’s real-time global threat intelligence, to find existing compromises, tabletop exercises to test response plans against simulated attacks, and both incident readiness and maturity assessments to identify and address systemic weaknesses.

The Incident Response component is initiated during an active security crisis. The team specializes in handling a range of complex threats, including APT and nation-state activity, ransomware, insider threats, and business email compromise. The response is also informed by Cloudflare’s threat intelligence and, as a network-native service, allows responders to deploy mitigation measures directly at the Cloudflare edge for faster containment.

For organizations requiring guaranteed availability, incident response retainers are offered. These retainers provide priority response, the development of tailored playbooks, and ongoing advisory support.

Cloudflare’s REACT services are vendor-agnostic in their scope. We are making REACT available to both existing Cloudflare customers and non-customers, regardless of their current technology stack, and regardless of whether their environment is on-premise, public cloud, or hybrid.

What makes Cloudflare’s approach different?

Our new service provides significant advantages over traditional incident response, where engagement and data sharing occur over separate, out-of-band channels. The integration of the service into the platform enables a more efficient and effective response to threats.

The core differentiators of this approach are:

  • Unmatched threat visibility. With roughly 20% of the web sitting behind Cloudflare’s network, Cloudforce One has unique visibility into emerging attacks as they unfold globally. This lets REACT accelerate their investigations and quickly correlate incident details with emerging attack vectors and known adversary tactics.

  • Network-native mitigation. The service is designed for network-native response. This allows the team, with customer authorization, to deploy mitigations directly at the Cloudflare edge, such as a WAF rule or Secure Web Gateway policy. This capability reduces the time between threat identification and containment. All response actions are tracked within the dashboard for full visibility.

  • Service delivery by proven experts. Cloudforce One is composed of seasoned threat researchers, consultants, and incident responders. The team has a documented history of managing complex security incidents, including nation-state activity and sophisticated financial fraud.

  • Vendor-agnostic scope. While managed through the Cloudflare dashboard, the scope of the response is vendor-agnostic. The team is equipped to conduct investigations and coordinate remediation across diverse customer environments, including on-premise, public cloud, and hybrid infrastructures.

Key Threats Seen During Engagements So Far

Analysis of security engagements by the REACT team over the last six months reveals three prevalent and high-impact trends. The data indicates that automated defenses, while critical, must be supplemented by specialized incident response capabilities to effectively counter these specific threats.

High-impact insider threats 

The REACT team has seen a significant number of incidents driven by insiders who use trusted access to bypass typical security controls. These threats are difficult to detect as they often combine technical actions with non-technical motivations. Recent scenarios observed are:

  • Disgruntled or current employees using their specialized, trusted access to execute targeted, destructive attacks.

  • Financially motivated insiders who are compensated by external actors to exfiltrate data or compromise internal systems.

  • State sponsored operatives gain trusted, privileged access via fraudulent remote work roles to exfiltrate data, conduct espionage, and steal funds for illicit regime financing.

Ransomware

The REACT team has observed that ransomware continues to be a primary driver of high-severity incidents, posing an existential threat to nearly every sector. Common themes observed include:

  • Disruption of core operations in the financial sector via hostage-taking of critical systems. 

  • Paralysis of business functions and compromise of client data in the real estate industry, leading to significant downtime and regulatory scrutiny.

  • Broad impact across all industry verticals. 

Stopping these attacks demands not only robust defenses but also a well-rehearsed recovery plan that cuts time-to-restoration to hours, not weeks.

Application security and supply chain breaches

The REACT team has also seen a significant increase in incidents originating at the application layer. These threats typically manifest in two primary areas: vulnerabilities within an organization’s own custom-developed  (‘vibe coded’) applications, and security failures originating from their third-party supply chain:

  • Vibe coding: The practice of providing natural language prompts to AI models to generate code can produce critical vulnerabilities which can be exploited by threat actors using techniques like remote code execution (RCE), memory corruption, and SQL injection.

  • SaaS supply chain risk: A compromise at a critical third-party vendor that exposes sensitive data, such as when attackers used a stolen Salesloft OAuth token to exfiltrate customer support cases from their clients’ Salesforce instances.

Integrated directly into your Cloudflare dashboard

Starting today, Cloudflare Enterprise customers will find a new “Incident Response Services” tab in the Threat intelligence navigation page in the Cloudflare dashboard. This dashboard integration ensures that critical security information and the ability to engage our incident response team are always at your fingertips, streamlining the process of getting expert help when it matters most.


Screenshot of the Cloudforce One Incident Response Services page in the Cloudflare dashboard

Retainer customers will benefit from a dedicated Under Attack page, which allows customers to contact Cloudforce One team during an active incident. In the event of an active incident, a simple “Request Help” button in our “Under Attack” page will immediately page our on-call incident responders to get you the help you need without delay.


Screenshot on the Under Attack button in the Cloudflare dashboard


Screenshot of the Emergency Incident Response page in the Cloudflare dashboard

For proactive needs, you can also easily submit requests for security advisory services through the Cloudflare dashboard: 


Confirmation of the successful service request submission

How to engage with Cloudforce One 

To learn more about REACT, existing Enterprise customers can explore the dedicated Incident Response section in the Cloudflare dashboard. For new inquiries regarding proactive partnerships and retainers, please contact Cloudflare sales.

If you are facing an active security crisis and need the REACT team on the ground, please contact us immediately.

Братовчедски сделки в Европарламента

Post Syndicated from Анахит Хачикян original https://www.toest.bg/bratovchedski-sdelki-v-evroparlamenta/

Братовчедски сделки в Европарламента

Какво правиш, когато знаеш, че братовчед ти е крадец? Гризе ли те съвестта да го разобличиш, или се опитваш да го прикриеш за доброто на семейството? Ами ако и ти си участвал в кражбите на братовчеда? Приблизително така се държат българските евродепутати в Брюксел по отношение на политическата ситуация в България. Изборът между даването на международна гласност на проблемите в страната и придържането към максимата What happens here, stays here (каквото се случва тук, си остава тук) по отношение на националната политика, е

труден и деликатен не само за българските евродепутати, а и за всички държави членки на ЕС.

Първият вариант се основава на очакването някой отвън да се намеси и да скръцне със зъби, макар и с риск да има наказания и ощетяващи България последствия. Вторият почива на поддържането на вътрешнополитическото статукво. Решаващ фактор е дали една партия е в правителството, или в опозиция и какво ще спечели на вътрешната сцена, ако причини буря в европейски води, но също и дали съответната политическа група в Европейския парламент (ЕП) има изгода да подкрепи и впише такива действия в общата си стратегия, или не ѝ е до това в момента.

Писмото на „Обнови Европа“ до Европейската комисия (ЕК) да спре част от плащанията за България предоставя възможност за наблюдаване на такава ситуация в лабораторни условия. На 23 септември Валери Хайер, председателка на групата на либералите в ЕП, отправи искане до европейските комисари Валдис Домбровскис (икономика), Рафаеле Фито (кохезия и реформи) и Пьотър Серафин (бюджет и борба с измамите) да замразят второто плащане за България по Плана за възстановяване и устойчивост. Сред мотивите, изложени от Хайер, са следните:

  • използването на Антикорупционната комисия за политически цели, например задържането на кмета на Варна Благомир Коцев;
  • възпрепятстването на разследвания на Европейската прокуратура;
  • контролирането на службите за сигурност и съдебните органи от частни мрежи, свързани с Делян Пеевски;
  • многобройните законодателни инициативи, които улесняват всички тези злоупотреби.

Кой стои зад искането на Хайер?

В „Обнови Европа“ членуват трима български евродепутати: Никола Минчев и Христо Петров от „Продължаваме промяната“ (ПП) и Илхан Кючук от Алианса за права и свободи (АПС). Двамата български представители от ПП бяха мобилизирали европейските си партньори още през лятото, дни след ареста на Коцев, с демонстрация в Брюксел, както и с писмо на председателката на Европейската либерална партия Свеня Хан с искане за спешна среща с еврокомисаря по правосъдие и върховенство на закона Майкъл Макграт.

Освен това либералите вече две поредни парламентарни сесии настояват безуспешно за внасяне на темата за върховенството на закона в България за обсъждане в пленарната зала, но не получават подкрепа от останалите големи политически групи.

Темата се замита под килима,

тъй като има други важни битки в момента, а и ситуацията в България по същество не е нова. Само през последните пет години е имало една специална резолюция, посветена изцяло на правовата държава и основните права в България през 2020 г., и два подробни доклада – от мисии на Комисията по бюджетен контрол през 2022 г. и на Комисията по граждански свободи, правосъдие и вътрешни работи през 2023 г. Всичко това – без да броим ежегодните мониторингови доклади на Европейската комисия.

Констатациите се повтарят. Всяко поредно правителство получава сходни критики, свързани с върховенството на закона и съдебната реформа. И дори когато необходимите законодателни инициативи са предприети, заключението е, че прилагането им или е половинчато и няма осъдени, или е избирателно и някои са (неоснователно) преследвани, а други остават доживотно недосегаеми.

Можеше ли писмото на Хайер да получи по-голяма подкрепа?

Българските евродепутати от ГЕРБ–СДС, БСП и ИТН представляват трите правителствени партии, които нямат интерес да подкрепят европейските критики срещу България. Същото поведение се наблюдаваше и по време на гласуването на резолюцията за правовата държава в България през 2020 г. Тогавашните правителствени партии ГЕРБ–СДС и ВМРО гласуваха против резолюцията, докато опозиционните БСП и ДСБ я подкрепиха, а ДПС се въздържа.

Ако проследим поведението на политическите групи в ЕП, към които тези български партии са принадлежали по време на онзи вот, ще получим усещане за дежавю: ЕНП и групата „Европейски консерватори и реформисти“, в която членуват ГЕРБ и ВМРО, бяха против, Групата на левицата подкрепи резолюцията, а „Обнови Европа“, където е ДПС, се въздържа.

Братовчедски сделки в Европарламента
Братовчедски сделки в Европарламента

Гласуването през 2020 г. Източник: MEP Watch

Така европейските политически групи в ЕП затвърждават статуквото на национално ниво.

От една страна, защото държат на националните си партии и са солидарни с тях, от друга – ако са на власт в съответната страна, не искат да я изпускат, защото така са по-силни в европейски план – както в ЕП, така и в Европейския съвет и Съвета на ЕС, където се вземат големите решения. Това беше една от причините ЕНП дълго време да толерира Виктор Орбан и партията му „Фидес“ въпреки антиевропейските му позиции. Докато накрая чашата преля и членството на евродепутатите от „Фидес“ първо беше замразено през 2019 г., а после Орбан сам напусна ЕНП, за да избегне изключването си.

Паралелно с писмото на Хайер, Радан Кънев от „Демократична България“, член на ЕНП, предупреди своята група – най-силната в Европарламента – че ситуацията в България подкопава не само политическата система в страната, но и авторитета на ЕНП и Урсула фон дер Лайен заради липсата на реакция. Той сравни положението в България с това в Унгария и Грузия по степен на зависимост от проруски влияния и олигархични мрежи. Сънародниците му от ГЕРБ обаче, които членуват в същата група (Андрей Ковачев, Ева Майдел, Андрей Новаков, Емил Радев), както и от СДС (Илия Лазаров) явно не споделят същите позиции. В крайна сметка ЕНП запази мълчание и за ареста на варненския кмет, и за цялостната картина в България.

Да бъдеш опозиционна партия обаче, не означава, че винаги ще си солидарен с критиките към твоето правителство в ЕП.

Изследване на Рамона Коман от 2022 г. показва, че по отношение на правовата държава политическите групи в крайната десница се въздържат от изказвания или открито се дистанцират от темата. Това се корени в суверенистките им виждания за ненамеса на Брюксел в политиката на държавите членки.

Тримата евродепутати от „Възраждане“ – Петър Волгин, Рада Лайкова и Станислав Стоянов, които членуват в „Европа на суверенните нации“ – са пример за точно такова поведение. Всъщност Стоянов и Лайкова, подкрепени от други членове на своята група, внесоха предложение за резолюция за политическите репресии и основните права в България през март 2025 г. Но тя не беше в подкрепа на необходимостта от съдебни реформи, а срещу… въвеждането на еврото.

За разлика от ЕП, ЕК има повече инструменти за действие, а и носи пряка отговорност как се харчат парите на европейските данъкоплатци.

И наистина замрази част от второто плащане на България по Плана за възстановяване и устойчивост заради нереформираната Антикорупционна комисия. Екипът на Урсула фон дер Лайен се разграничи от писмото на Хайер и арестуването на Коцев и посочи неизпълнените ангажименти от българска страна като основание за замразеното плащане. Но този коментар прилича на спора за кокошката и яйцето. Не е ли задържането на кмета на Варна най-красноречивата илюстрация на проблема с въпросната Антикорупционна комисия и поредното доказателство, че докато основите гният отвътре, нито едно пребоядисване няма да спаси от рухване целия дом?

Изразеното мнение е лично и не представлява позицията на Европейския парламент.

The collective thoughts of the interwebz