Latest / MAG 7 Daily / Ep 19: An 8.1-severity bug let denied AWS callers run privileged cloud calls.

Transcript

Ep 19: An 8.1-severity bug let denied AWS callers run privileged cloud calls. · MAG 7 Daily

• 0:00
  An 8.1 severity bug led denied AWS callers run privilege cloud calls. This is MAG 7 Daily, episode
• 0:06
  19. At the top of the tape, that hole lives in sample glue between amazon connect and sales
• 0:12
  force service cloud voice. The function is called sf-execute-aws-service. Inside an app
• 0:18
  named amazon connect sales force lambda. And shattered.io walks through the bulletin. A caller
• 0:24
  could name the AWS operation they wanted. The function then ran that operation on its
• 0:29
  own privileged role and never checked the caller's own permission. Lambda colon invoke function
• 0:35
  was the only key required. After that, the role could do work the caller's policy had explicitly
• 0:40
  denied. The write-up calls it an identity bypass, a confused deputy. Saturday, Satya Nadella wrote
• 0:47
  that powerful models should be treated as insider threats. Bloomberg has him saying companies
• 0:52
  Germany should assume those models could be compromised, and should fit an emergency
• 0:56
  break so agentic systems cannot go rogue.
• 0:59
  TechCrunch has the line that it is time to step back and assess the trust architecture
• 1:03
  of AI.
• 1:05
  The Verge has him rejecting a stack of nested black boxes whose advice people simply accept.
• 1:10
  Microsoft also unveiled Microsoft Decision 1, TechMeme reports, it is a fast decision-scoring
• 1:17
  model trained on QN 3.5, the 9 billion parameter version.
• 1:21
  Microsoft says it will soon re-base that score on MAI, on OpenAI, and on other models.
• 1:28
  The financial time says NVIDIA is in talks to buy Reflection AI.
• 1:32
  The same report says the Trump administration hopes Reflection will rival cheap Chinese
• 1:37
  alternatives such as deepseek.
• 1:39
  Bloomberg, quoting a person familiar with the matter, describes a smaller conversation, more
• 1:44
  investment or computing power for a builder of open-weight models.
• 1:48
  Outlook is losing themes by co-pilot.
• 1:50
  Microsoft told administrators the retirement starts worldwide in mid-October 2026 and should
• 1:57
  be done by late-October on the new outlook for Windows, Android, iOS, Mac, and the web.
• 2:02
  A co-pilot license no longer lets you pick one of those themes and once you switch away
• 2:07
  you cannot come back.
• 2:09
  Whatever theme is already on screen stays until you change it.
• 2:12
  Auto-refresh themes stop refreshing and the current imagery stays put.
• 2:16
  XDA says the feature arrived in November 2024 and reads the cut as a shift toward the co-pilot
• 2:23
  app and taskbar search. Apple supplier Luckshare precision industry is in a U.S. patent investigation
• 2:29
  over data center power technologies. Bloomberg reports after a Saturday filing.
• 2:35
  ViCore made the infringement allegations. Luckshare says it expects no material impact.
• 2:39
  against that 8.1 alarm, the same shatter.io account says AWS quietly patched the sample in June
• 2:46
  2026. The advisory came out on September 22nd. Trackers and trade press did not pick it up until
• 2:53
  October 9th and 10th. It was a pre-built app in the serverless application repository, not Lambda as a
• 3:00
  service. The write-up also says the two severity scores on the bug disagree. Who is still exposed depends
• 3:06
  on whether a deployed copy of that connect to Salesforce app was updated after the June patch.
• 3:12
  A home security rumor now runs across the 7 only through Apple and Google,
• 3:16
  and October 13th is the date on Apple's New York invitation for an event called Welcome Home.
• 3:22
  Mac rumors still calls an Apple deal with ADT or rumor. Since around July,
• 3:27
  ADT has posted low-voltage technician listings in various US cities. People hired into those jobs say
• 3:33
  they have mostly shadowed other technicians, and that they signed a non-disclosure agreement.
• 3:38
  Those hires got iPhones for work, ADT's other technicians got Android phones.
• 3:43
  Some managers said the role is home automation and in-home installation.
• 3:48
  ADT meant to explain the job in September, then push that briefing to October.
• 3:53
  Mac rumors lines that slip up with Apple delaying the home hub until a revamped Siri was ready,
• 3:58
  and that Siri version launched last month.
• 4:00
  The hub in those reports is a tabletop unit with a speaker base, plus a wall-mounted
• 4:05
  unit.
• 4:06
  Third-party accessories, including gear from LG, are also expected.
• 4:10
  The reported features are accessory management, home security monitoring, photo faces and galleries,
• 4:16
  a calendar overview, music and FaceTime.
• 4:20
  ADT already signed a home security partnership with Google in 2023.
• 4:24
  MacRumors says ADT dropped some Nest features earlier this year.
• 4:28
  A few people familiar with the matter told the outlet the Google agreement either expired
• 4:33
  this year or expires next year and will not be renewed.
• 4:36
  If that is right, 2027 is when that contract would be clear.
• 4:41
  Mac rumors also says the whole chain could be a coincidence, and there is no term sheet
• 4:45
  in the piece.
• 4:46
  Looking back over this past week, three threads moved and then waited.
• 4:50
  For iPhone users in the EU, the best case heard for the Siri AI upgrade was still a five-month
• 4:56
  wait.
• 4:56
  Google's nuclear figure was upgrades and restarts, and the running total was more than
• 5:01
  1.5 gigawatts.
• 5:03
  Meta's Mew's assistant closed the week on this.
• 5:06
  One unpatched key is enough for local Mac software to hijack it.
• 5:11
  Microsoft expects the outlook theme retirement to begin in mid-October 2026, and to finish
• 5:16
  by late-October 2026.
• 5:19
  Apple has invited the media to that welcome home event in New York on Tuesday, October
• 5:23
  13, 2026.
• 5:24
  6.
• 5:25
  Before we go, that outlook theme retirement is the nearest dated change, starting mid-October
• 5:31
  and expected done by the end of the month.
• 5:33
  That's mag 7 daily for today.
• 5:35
  Nothing in this show is financial advice.
• 5:38
  I'm Patrick and Vancouver, see you tomorrow.
• 5:40
  If this show earns a place in your day, follow it in your podcast app so the next episode
• 5:45
  is waiting for you.
• 5:46
  Quick tip from the network.
• 5:48
  Try peptides weekly next.
• 5:50
  The week in peptide science, evidence first, and never dosing advice.
• 5:53
  advice. Every Narin Network show is free at NarinNetwork.com. If you follow more than one of
• 5:59
  our shows, Narin Daily stitches the whole network into one morning listen. Free with chapters
• 6:04
  at NarinNetwork.com Narin Daily. This episode used AI voice synthesis of my voice. Editorial
• 6:11
  selection and analysis are my own.