AWS has introduced a new S3 bucket namespace pattern (prefix-accountid-region-an) that prevents bucketsquatting attacks by binding bucket names to specific AWS accounts and regions. This recommended protection addresses a decade-long vulnerability where predictable bucket naming allowed attackers to register deleted buckets and access sensitive data.
Hugging Face introduces Storage Buckets, an AI-native object storage service using Xet's content-defined chunking for deduplication, offering per-TB pricing with built-in CDN and designed to streamline ML workflows without Git overhead.
Researcher discovered a subdomain takeover technique by exploiting an improperly configured S3 bucket that allowed unauthenticated write access via AWS CLI. By uploading a malicious _redirect.html file with proper ACL permissions, the attacker could execute arbitrary content on the victim subdomain without exploiting a traditional subdomain takeover vulnerability.