AWS FIXES 1-CLICK APACHE AIRFLOW SESSION HIJACK

Summary from the TLDR InfoSec newsletter

AWS fixed a flaw in its Managed Workflows for Apache Airflow (MWAA) service that allowed attackers to hijack MWAA sessions via an XSS attack on AWS-hosted sites. This vulnerability was possible because many AWS services utilize the same domain suffix, so browser cookie protections fail. AWS and Microsoft (which had similar issues) have registered domains associated with various vulnerable services to the Public Suffix List to prevent these attacks.