AWS released Part 1 of a two-part guide showing how to build a post-quantum software supply chain using ML-DSA signatures (NIST FIPS 204) across AWS KMS, AWS Private CA, and IAM Roles Anywhere. The guide covers signing binaries, container images, and SBOMs, and is positioned as the first full cloud-provider walkthrough for post-quantum signing, from root-of-trust creation to policy enforcement. It responds to upcoming mandates: the NSA's CNSA 2.0 requiring exclusive quantum-resistant signatures by 2030, and the EU Cyber Resilience Act taking full effect in December 2027.
AWS published a follow-up security guide explaining how organizations can enforce which ML-DSA (post-quantum signature) parameter sets are allowed across their AWS environment. It covers using Service Control Policies (SCPs) at the organization or OU level and IAM permission boundaries to block creation and use of non-approved ML-DSA variants (e.g., blocking ML-DSA-44 while allowing ML-DSA-65/87). The guide also covers AWS Private CA and certificate controls, and discusses the trade-off between deny-lists (default-allow for new variants) and allow-lists (default-deny, requiring policy updates for new approved algorithms).
AWS published a joint engineering write-up with Postman describing how Agent Mode, Postman's AI-native interface for API testing and documentation, was built to run in production at scale. Rather than model quality, the team found that tool sprawl and missing context were the biggest obstacles to reliable agent behavior. The post details architectural patterns including dynamic tool scoping, schema-based query access, dedicated context handlers, and how Amazon Bedrock provides model flexibility, cross-Region inference, data residency controls, and prompt caching.
AWS published a case study on Amazon Bedrock AgentCore payments, a managed feature that lets AI agents autonomously pay for services like model inference, one request at a time, using the x402 payment protocol. Incarna used it to let its agents pay BlockRun, a multi-provider inference router, for each individual model call, settling in USDC on the Base blockchain. AWS says Incarna cut integration time from a scoped two to three months down to three days and about 200 lines of code. During the beta, agents processed over 1,000 payments ranging from $0.001 to $0.05 per call.
Cisco Talos' CAIRN research classifies a new malware archetype, 'A3: AI-Analysis Evasion,' where malicious code embeds natural-language text designed to manipulate language models used in automated malware triage. Talos traced the technique across four malware families (FRUITSHELL, PLOTSAFE, HOLLOWCLAD, MANTLEMAZE) and 84 samples from January 2025 to July 2026, showing it spreading from a simple copy-pasted comment to templated, multi-model-targeted 'template spraying' and fake intimidation messages. Controlled testing with a panel of five local LLMs found the simplest direct-instruction technique shifted model verdicts toward 'benign' in roughly 35% of runs, while more elaborate tricks had little effect or backfired by increasing suspicion.
Cisco Talos' Vulnerability Discovery & Research team disclosed a set of vulnerabilities across Adobe Photoshop, Apple macOS, Foxit Reader, and Microsoft Windows, all of which have already been patched by their respective vendors. The flaws range from privilege escalation and information disclosure to remote code execution and use-after-free bugs. Snort rule sets are available to detect exploitation attempts of these issues.
AWS describes a new two-stage access control architecture for Retrieval Augmented Generation (RAG) in Amazon Quick and Amazon Bedrock Knowledge Bases. Instead of relying only on periodically synced access control lists (ACLs), the system now verifies permissions in real time against the authoritative data source (e.g. Google Drive, SharePoint, Confluence) at query time, before passing content to the LLM. AWS says this closes security gaps caused by stale or incorrectly mapped permissions between sync cycles. Mondelēz International, with over 35,000 employees, is cited as a customer using this approach.
Anthropic has launched Claude Haiku 5.5 (claude-haiku-5-5), positioned as its most capable Haiku model for high-volume, latency-sensitive work. It supports a 1 million token context window, up to 128k max output tokens, and adaptive thinking controlled via a new effort parameter. The model is available on the Claude API, Amazon Bedrock, Claude Platform on AWS, Google Cloud, and Microsoft Foundry. Anthropic warns that code written for the previous Haiku 4.5 model may break on the new version.
Z.ai's GLM 5.3, a 753-billion-parameter mixture-of-experts model optimized for coding and long-horizon agentic tasks, is now available as a fully managed model on Amazon Bedrock. It builds on GLM 5 with improved coding benchmark results, standout cybersecurity capabilities (CyberGym score of 84.5), and deeper Bedrock integration including OpenAI-compatible APIs, prompt caching, cross-Region inference and service tiers. AWS also demonstrates using GLM 5.3 with the open-source Strix agent for authorized penetration testing of your own applications.
GitHub has published ReviewBench, a research-preview benchmark designed to compare AI code review agents on a common, auditable standard. The dataset draws on 219 real public pull requests across 19 languages and 187 repositories, chosen to mirror the language and size distribution found across 103.9 million GitHub pull requests. Ground truth comes from a blended pool of human reviewers, static analysis tools, and multiple frontier LLMs, cross-checked by senior engineers who agreed with the benchmark's labels 96.6% of the time. GitHub says it has already used ReviewBench internally to track its own Copilot code review (CCR) product, and that offline benchmark movement reliably predicted the direction of later production A/B tests.
CISA added two Zammad vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation. CVE-2026-102489 is a session fixation flaw and CVE-2026-102490 involves improper privilege management in the Zammad helpdesk/customer service platform. Federal agencies must remediate under Binding Operational Directive 26-04, and CISA urges all organizations to prioritize these fixes.
AWS researchers describe a system that models telecom networks as a continuously updated graph ('digital twin') and uses AI agents to run a cascade of graph algorithms (decomposition, clustering, centrality ranking) to pinpoint root causes of failures. The approach was demonstrated with NTT DOCOMO at Mobile World Conference, reportedly cutting root cause analysis from hours to minutes on commercial networks. Agents also consult an incident knowledge base and runbooks, and can escalate autonomy from advisory to supervised to full remediation over time.
CISA added CVE-2026-104286, a path traversal vulnerability in Fortinet FortiMail, to its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation in the wild. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize patching this vulnerability on internet-exposed assets, especially where it could grant full control of the system. CISA also recommends all organizations, not just federal agencies, prioritize remediation of KEV-listed flaws.
GitHub Security Lab built an open-source 'Taskflow Agent' that uses custom AI prompt workflows to audit code for vulnerabilities, and used it to find and report over 24 vulnerabilities in Android applications. Two detailed examples show the agent finding a location-tracking flaw in the OsmAnd navigation app and an account-takeover chain in the Wikipedia Android app via a deeplink parsing bug. The team notes LLMs are strong at finding complex logic vulnerabilities and understand API behavior well, but struggle to correctly judge severity and often produce false positives, so findings still require human review. The taskflows are open source and can be run on any GitHub repository via a Copilot-powered codespace script, though running them consumes premium model requests and can take hours.
CERT-EU has updated its advisory on critical vulnerabilities in Microsoft SharePoint Server, confirming active exploitation of CVE-2026-50522 (CVSS 9.8), a deserialisation flaw allowing remote code execution. This is part of a wider series of recently patched critical bugs — CVE-2026-32201, CVE-2026-45659, CVE-2026-56164 and CVE-2026-58644 — affecting on-premise SharePoint Server instances, some exploitable without authentication.
On 9 September 2026, Check Point released emergency hotfixes for two critical vulnerabilities (CVE-2026-85102 and CVE-2026-85103), both with CVSS 9.8, affecting Security Gateway, Security Management Server, and Spark Firewall deployments using Remote Access VPN or Site-to-Site VPN. Both flaws allow unauthenticated remote attackers to execute arbitrary code on affected appliances. CERT-EU urges immediate patching, prioritising internet-facing and perimeter devices.
Citrix disclosed 8 vulnerabilities affecting customer-managed NetScaler ADC and NetScaler Gateway, including 2 critical unauthenticated RCE flaws with CVSS 9.5 that Citrix confirms are being actively exploited. CERT-EU urges immediate patching and compromise assessment for internet-facing appliances. Other flaws include HTTP request smuggling, memory overflow bugs leading to RCE/DoS, a policy bypass, and a TCP ISN prediction issue.
AWS released a step-by-step walkthrough showing how to give Claude Desktop (on Amazon Bedrock) live internet access through Amazon Bedrock AgentCore Gateway, closing the gap left by the model's training cutoff. The setup wires AWS IAM Identity Center SSO through Amazon Cognito as a SAML-to-OAuth federation layer, issuing JWTs that the AgentCore Gateway validates on every request. The Web Search capability itself is MCP-compatible and runs on an internal Amazon web index covering tens of billions of documents, so no query traffic leaves AWS and no third-party API key is needed. The feature is currently limited to three AWS Regions: us-east-1 (N. Virginia), eu-west-1 (Ireland), and ap-northeast-1 (Tokyo).