🥖 Palate Cleanser

Busy week!

On Saturday, AWS unplugged the European Sovereign Cloud from the rest of AWS on purpose. For several hours it ran without the AWS global backbone and sent its traffic over European ISPs instead, to show it can keep running without depending on anything outside the EU. No word yet on how it went. If you are still deciding whether you need it, Tom De Blende's explainer has the security bits.

Two critical bugs in PHP (CVE-2026-109618 and CVE-2026-109619) made the internet catch on fire. I had this idea that PHP was dead, but Plerion has a lot of customers running it on web-facing assets. Details leaked on 20 October, so PHP shipped the fix a day early on 21 October, and the bugs got their own branded website. AWS's honeypots caught someone trying to exploit it on 17 October, four days before disclosure, so look back from then, not from the patch. It's weird how much of the early advice was wrong. The CVSS 10.0 that did the rounds is 9.2 in PHP's own notice, and the most repeated mitigation, turning off session.upload_progress, only covers one path of the other CVE, not the main one. On AWS, the bulletin says to update your Elastic Beanstalk platforms, rebuild Lightsail instances from the new blueprints, and redeploy any Lambda that runs PHP in a custom runtime.

Cloud Village finally uploaded its DEF CON 34 talks. The AWS ones:

• New AWS IAM Attack Paths and the Framework to Exploit Them by Seth Art - the talk behind Chef's Selection #1, including three new privilege escalation paths in AWS Batch.
• The Hidden Cost of Agentic Connectivity by David Fiser - nearly 6,000 MCP servers exposed to the internet (up from 492), and a demo of going from a command injection in one on EC2 to its instance role.
• Nebula - 5 years, still kicking *aaS by Bleon Proko - a cloud C2 framework whose agent talks to its operator through files in an S3 bucket.

fwd:cloudsec is the bestest cloud security conference. The conference is run by volunteers, practitioners from across the industry, and they are looking for people to help make fwd:cloudsec North America 2027 happen. If you're keen, fill in this form.

And if you've ever wanted to ask AWS security something, Shannon Brazil, who went from incident responder in AWS CIRT to running the AWS Security Communication team, did an ask me anything on Twitter. Some of the answers are worth a scroll.

This issue is also available to share online. Got feedback? Tell us here.