If you just remember one thing from this briefing…
AWS's own AI-agent platform defaulted to full admin access for anyone, if no identity provider was set.
On 2 October AWS patched Loom, its AI-agent platform: an unconfigured identity provider made the backend
return a fixed super-admin identity to any unauthenticated caller (CVSS 10.0). It is September's AEPD
pattern again — untrusted access, no human gate — but this time the gap was the vendor's own default.
Ask this week: which agent platform still assumes an identity provider nobody configured?
Priority2 Oct
AWS ships emergency fixes across its AI-agent and ML platforms
Two bulletins fixed four flaws. In Loom, an unconfigured identity provider let unauthenticated callers
in as super-admin (CVE-2026-103956, CVSS 10.0); two SSRF bugs exposed tokens, fixed in 1.7.0. In
SageMaker Unified Studio, a command-injection flaw (CVE-2026-104019, CVSS 9.3) let one project member
steal another's credentials.
So what: patch Loom to 1.7.0 and confirm SageMaker Unified Studio runs a
supported, patched line — both needed no prior access.
Priority30 Sep
Entra Connect Sync's hard stop hits hybrid estates still on old builds
Microsoft's back-end hardening change took effect on 30 September: any Entra Connect Sync instance below
version 2.5.79.0 stops synchronising entirely. Microsoft calls it a hardening requirement, not a
retirement — sync resumes once upgraded — but there is no grace period for the outage itself.
So what: confirm your sync version now — anything below 2.5.79.0 has already
stopped, silently breaking directory sync until upgraded.
Priority4 Oct
Citrix NetScaler flaw hits CISA's KEV; federal deadline already passed
CISA added CVE-2026-88779 to its KEV catalogue on 4 October after Citrix confirmed active exploitation;
the federal deadline was 7 October. Confirmed impact is denial of service; remote code execution is
still unconfirmed. Fixed in NetScaler 14.1-73.41, 13.1-64.28 and matching FIPS builds — some SAML
setups need a second upgrade.
So what: if NetScaler fronts remote access or SSO, patch now and check the
SAML build — exploitation followed disclosure within days.
Watch1 Oct
Azure retires three AI services; AWS and Google stay quiet this fortnight
Anomaly Detector, Metrics Advisor and Personalizer retired on 1 October, alongside Translator's S2-S4
discount tiers. None had a direct Azure AI Foundry replacement at retirement. AWS and Google Cloud
published no comparable platform or pricing changes in this window.
So what: any workload still calling these APIs is already unsupported — assess
a replacement now rather than waiting for a failure to force it.
