Loading story…
AWS said Shield Advanced is shifting its application-layer automatic mitigation into the AWS WAF Anti-DDoS managed rule group, starting with automatic additions in Count mode for eligible web ACLs between July 27 and August 7, 2026. The new AWS WAF-based protection is designed to improve Layer 7 DDoS response with faster profiling and mitigation, support for Block, Count, and Challenge actions, lower web ACL capacity use from 150 WCU to 50 WCU, and richer visibility through dashboards, labels, and CloudWatch and AWS WAF metrics.
AWS said existing Shield Advanced automatic mitigation will remain active during the transition, but the legacy application-layer feature will be retired on January 1, 2027. Customers that do not migrate by then will lose automatic Layer 7 DDoS protection, while eligible configurations may be auto-upgraded beginning October 1, 2026 and receive temporary fee and WCU waivers during the evaluation period through September 30, 2026. AWS also warned customers using infrastructure-as-code and AWS Firewall Manager to update policies and definitions so application-layer protections continue after the migration.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
AWS said Shield Advanced application-layer automatic mitigation will sunset on 2027-01-01. Customers that have not migrated by that date will lose automatic Layer 7 DDoS mitigation.
AWS announced that beginning on 2026-07-27 it would start automatically adding the AWS WAF Anti-DDoS managed rule group in Count mode to eligible Shield Advanced web ACLs as part of a phased migration of Layer 7 DDoS protection. The rollout was described as occurring between July 27 and August 7, 2026, while existing Shield Advanced automatic mitigation remains active during the transition.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourceaws.amazon.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AWS said **AWS Certificate Manager (ACM)** will phase out email validation for public certificates in 2027 and is directing customers to move to **DNS validation**. The change follows a **CA/Browser Forum** decision to end email-based domain validation for publicly trusted certificates by **March 15, 2028**. Under AWS's timeline, email validation will no longer be offered in new AWS Regions starting **January 1, 2027**, and ACM will stop accepting new requests for email-validated public certificates in all Regions on **March 31, 2027**. AWS will stop renewing existing email-validated public certificates on **September 30, 2027**, making migration necessary for affected customers. To reduce disruption, AWS is updating the `UpdateCertificateOptions` API so organizations can switch certificates from email to DNS validation in place without changing the certificate ARN or dependent resources; after the change, customers must add an ACM-provided **CNAME** record within 72 hours to complete validation and enable automatic renewal. AWS said **HTTP validation** will remain available only for certificates used with **Amazon CloudFront**, while recommending DNS validation for most deployments.
Aug 16, 2026
AWS introduced **AWS DevOps Agent**, an AI-powered operations assistant designed to help DevOps and SRE teams investigate **AWS Network Firewall** connectivity incidents by analyzing telemetry and configuration data across AWS environments. The agent uses AWS APIs to review firewall logs, **VPC Flow Logs**, route tables, firewall policies, and recent **AWS CloudTrail** activity to identify likely root causes and recommend mitigations, aiming to speed diagnosis of outages and misconfigurations. AWS highlighted several troubleshooting scenarios, including blocked traffic caused by a domain deny list, packet drops tied to stateless rule priority conflicts, and asymmetric routing across Availability Zones. The service can also correlate incidents with recent infrastructure or application changes by integrating with repositories and CI/CD platforms such as **GitHub**, **GitLab Self-Managed**, **AWS CloudFormation**, **AWS CDK**, **Amazon ECR**, and **Terraform**, while alerting workflows can be tied into **Amazon CloudWatch**, **Amazon SNS**, **AWS Lambda**, and **AWS Secrets Manager** to support automated investigation and stronger deployment guardrails.
Jul 27, 2026
AWS expanded **Security Hub** beyond its own cloud to add native visibility into **Microsoft Azure**, marking the service’s first direct monitoring of infrastructure outside AWS. The update lets Security Hub discover Azure virtual machines, container images, Function Apps, and identities, then evaluate them for misconfigurations, internet exposure, and vulnerable software. AWS said the Azure assessments align with the **CIS Microsoft Azure Foundations Benchmark**, giving organizations a standardized baseline for multicloud posture management. AWS also introduced new AI-focused security capabilities, including **GuardDuty AI Protection** for Amazon Bedrock and SageMaker and AI-powered investigations in Security Hub. The AI protections are designed to detect threats such as anomalous model use, prompt injection attempts, and cost-harvesting abuse tied to stolen credentials, while the investigations feature uses up to 90 days of related activity to generate confidence-scored findings, **MITRE ATT&CK** mappings, and remediation guidance. AWS said the expansion is aimed at unifying security operations across multicloud environments while improving visibility into both cloud infrastructure and AI assets.
Jul 14, 2026