#Cloud Security
All CosmicBytez Labs articles tagged #Cloud Security, across news, security advisories, how-to guides, and projects.
- News
Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory
CVE-2026-99999 (CVSS 9.3) lets a guest VM leak host memory via a kernel checksum bug; found via Vercel's $1M bounty, now patched upstream.
- News
Hackers Exploit Collabora RCE Flaw to Backdoor Nextcloud Servers
Attackers are exploiting CVE-2026-110447, a critical unauthenticated RCE in Nextcloud's Collabora Online CODE Server app, to plant PHP web shells.
- News
Yandex Confirms Service Outage as Drone Strikes Disable Three Data Centers
Drone strikes on three Yandex data centers cut Russian cloud connectivity to roughly 30%, knocking out storage, payments, and dozens of services.
- News
Ransomware Attack Disrupts Japan's IDCF Cloud Used by Government Clients
A ransomware attack on SoftBank-owned IDC Frontier's IDCF Cloud knocked out Japan's East Japan Region 1, disrupting 495 companies and government clients.
- News
JadePuffer AI Actor Compromises Azure Tenant in Destructive Cloud Attack
JadePuffer (Storm-3168), an agentic AI actor, used exposed credentials to wipe 100+ Azure storage accounts and other resources in minutes.
- News
Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes
Dell patched six critical CSM flaws, including two CVSS 10.0 bugs, letting attackers steal storage admin credentials and gain root on Kubernetes nodes.
- News
The State of Cybersecurity in 2026: Key Segments, Insights, and Innovations
A 2026 industry roundup maps 10 cybersecurity segments—from identity and cloud to AI-native SecOps—reshaping how defenders manage risk.
- Security
CVE-2023-54400: Fumasoft Fumeng Cloud Unauthenticated SQL Injection
Unauthenticated CVSS 9.8 SQL injection in Fumasoft Fumeng Cloud's AjaxMethod.ashx endpoint allows full database compromise via UNION-based SQLi.
- Security
CVE-2026-96587: Viidure Dashcam Android App Hardcodes Cloud Storage Credentials
Maximum-severity CVSS 10.0 flaw: Viidure's dashcam Android app hardcodes plaintext cloud storage keys, exposing firmware and binaries to tampering.
- News
JadePuffer: Agentic AI Threat Actor Hits Microsoft Azure, Destroys Cloud Resources in Minutes
JadePuffer (Storm-3168) used AI agents and leaked credentials to recon an Azure tenant, then deleted 100+ storage accounts in 7 minutes.
- News
JadePuffer-Linked Storm-3168 Hijacks Azure Identities to Destroy Cloud Resources
Microsoft says Storm-3168, linked to JadePuffer, used two hijacked Azure identities to destroy 100+ storage accounts in a 7-minute burst.
- News
JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources
Microsoft ties Storm-3168 to JADEPUFFER after two hijacked Azure service principals wiped 100+ storage accounts in a 7-minute burst.
- News
Cloudflare Fixes Containers Cross-Tenant Flaw Exposing Customer Data
A shared-disk flaw in Cloudflare Containers let Workers Paid customers recover residual data from other tenants before a fleet-wide fix on Sept. 19.
- Security
CVE-2026-95699: iSteamX Mobile App AWS IoT Policy Exposes Connected Device Data
A misconfigured AWS IoT policy in the iSteamX app let users reach wildcard MQTT topics, exposing other users' devices and profile data.
- News
MacSync Malware Uses Public iCloud Calendars to Deliver New Payloads
Kaspersky: MacSync's downloader now hides commands in public iCloud calendar event descriptions and adds a Finder-spoofing backdoor module.
- News
New Carbonato Malware Uses AI Agents to Hijack Exposed Docker Hosts
ThreatDown: Carbonato worms through unauthenticated Docker APIs, then installs an AI agent operators command over Telegram.
- News
New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups
Arista disclosed CVE-2026-93952, a CVSS 10.0 pre-auth privilege escalation in VeloCloud Orchestrator, already under active exploitation.
- News
Hackers Target Exposed Vite Dev Servers to Steal AWS, Azure Secrets
A mass-scanning campaign is exploiting CVE-2026-39364 in exposed Vite dev servers to harvest AWS and Azure credentials, .env files, and Terraform...
- News
New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing
A sub-$200 memory-bus interposer lets DDRop silently drop encrypted memory writes, defeating Intel TDX and AMD SEV-SNP confidential computing...
- News
Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data
Microsoft details passkey-themed social engineering that hijacks Microsoft 365 accounts, plus a 1M-email AI-driven CEO invoice fraud campaign.
- News
220 Million Traveler Records Exposed in Vietnam-Linked APIS Leak
An exposed Advance Passenger Information System database held 220 million passport and flight records spanning 2017-2026, researchers say.
- News
In Other News: Microsoft's Cloud Patches, Hacked Dropbox Accounts, Guardio's $1.1B Valuation
SecurityWeek's roundup: Microsoft patches 9 cloud service flaws, ~5,000 Dropbox accounts hit via a Lenovo ID flaw, and Guardio hits $1.1B valuation.
- Security
CVE-2026-82855: @hulumi/policies Cross-Resource Evidence Validation Bypass
hulumi/policies before 1.3.2 let attackers suppress guardrail violations using compliant evidence from an unrelated resource in the same stack.
- Security
CVE-2026-82856: @hulumi/policies GitHub OIDC Trust Policy Bypass
hulumi/policies before 1.3.2 missed set-qualified IAM operators, letting wildcard GitHub Actions OIDC conditions slip past guardrails.
- Security
CVE-2026-82857: hulumi Privilege Escalation via Weekly Integration IAM Policy
hulumi before 1.3.2 let attackers create persistent higher-privilege af-e2e-* roles in the sandbox account via a flawed IAM boundary.
- Security
Cloud Commander Path Traversal Enables Arbitrary File Access (CVE-2026-82460)
CVE-2026-82460 (CVSS 9.8) lets attackers read, write, move, or copy files outside Cloud Commander's root via REST and markdown endpoints.
- Security
CVE-2026-54523: Kyverno CEL Generator Bypasses Namespace Isolation
Critical Kyverno flaw lets a namespace-scoped policy invoke generator.apply() with an arbitrary namespace, creating RoleBindings in kube-system.
- News
Hackers Abuse npm Mirrors to Host Phishing Redirect Pages
Threat actors are planting malicious HTML packages on npm and its mirrors that impersonate Cloudflare CAPTCHAs, silently redirecting victims to attacker sites.
- News
24 npm Packages Abuse unpkg CDN to Host Fake Cloudflare CAPTCHA Phishing Pages
Attackers published 24 npm packages using the unpkg CDN as malware hosting infrastructure, serving ClickFix CAPTCHA lures to steal credentials.
- News
768 Live AWS Keys with Full Admin Access Found Across Public Repos, AI Training Data, and Docker Images
Truffle Security found 64,000 unique live AWS keys in public sources — 526 are root keys, 88% still authenticate, median age 5 years.
- News
9,300+ Leaked AWS Keys Still Active, Granting Full Corporate Account Control
Over 9,300 AWS access keys exposed publicly between 2022 and 2026 remain valid and active, giving attackers full control over corporate cloud accounts.
- News
Apollo Discloses Data Breach from Ongoing Wave of Attacks Hitting Financial Sector
Apollo Global Management confirms a July 2026 breach via IT helpdesk social engineering, exposing PII including SSNs in a coordinated wave targeting PE firms.
- Security
CVE-2026-67567: Critical Privilege Escalation in Multicloud Operators Subscription
A CVSS 9.9 flaw in multicloud-operators-subscription lets tenants bypass security controls via malicious HelmRelease CRs, enabling privileged Helm execution.
- News
CareCloud Data Breach Exposes 3.7 Million Patient Records
Healthcare IT firm CareCloud confirmed 3,756,469 patients had PHI exposed after a hacker spent eight hours inside its EHR environment.
- News
CISA Warns of Hackers Exploiting Critical MLflow Vulnerability
CVE-2026-64849 (CVSS 9.3): Active SSRF exploitation in MLflow lets attackers steal AWS cloud credentials via redirect bypass. Added to CISA KEV.
- News
CareCloud Data Breach Impact Grows to 3.7 Million Individuals
CareCloud's data breach has ballooned from an initial 350,000 to 3.7 million affected individuals, exposing sensitive healthcare and personal data.
- Security
CVE-2026-64849: MLflow SSRF Webhook Bypass Actively Exploited
Critical unauthenticated SSRF in MLflow's webhook system lets attackers redirect requests to steal AWS credentials. Upgrade to 3.15.0.
- Security
CVE-2026-71566: KubeVirt Auth Bypass via FakeFish Credential Ignore
CVSS 9.3 critical: KubeVirt's FakeFish BMC emulator ignores provided credentials, letting any user claim admin access.
- News
Fortune 500 Companies Hit in Azure Data Theft Campaign
Threat actor TheHatman exposed 3.5M+ enterprise records from McDonald's, Vodafone, and TCS via infostealer-driven Azure Entra ID credential theft.
- News
Hacker Claims 3.6 Million Azure Account Records Stolen from Major Companies
A threat actor is selling employee databases allegedly taken from Microsoft Azure infrastructure of multiple Fortune 500 firms via compromised credentials.
- Security
CVE-2026-18438: Templately WordPress Plugin RCE via File Upload
CVSS 8.8 flaw in Templately for WordPress lets authenticated subscribers execute arbitrary code via a filename validation bypass in file upload.
- News
Max Severity SAP Commerce Cloud Flaw Now Targeted in Attacks
A critical RCE vulnerability in SAP Commerce Cloud, patched just days ago, is already being actively exploited in the wild.
- News
Over 1,000 Charities Hit by Beacon CRM Data Breach
Over 1,000 UK charities affected after Beacon CRM suffered a data breach traced to an exposed AWS access key in public JS files.
- News
"City-Forum" Data-Theft Attacks Target Salesforce and ServiceNow Portals
A 17-month stealth campaign uses custom Go tooling to scrape enterprise data from misconfigured Salesforce and ServiceNow guest-user portals.
- News
SAP Commerce Cloud RCE Flaw Lets Unauthenticated Attackers Execute Arbitrary Code
CVE-2026-58231 scores CVSS 10.0 in SAP Commerce Cloud Data Hub Adapter — patch immediately as unauthenticated RCE with full system compromise is possible.
- News
TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign
New analysis traces the cloud threat actor TeamPCP to Redis cryptojacking campaigns active since 2020, revealing a six-year evolution from opportunistic...
- Security
AWS Research and Engineering Studio Symlink File Read Exposes Root-Accessible Secrets
An improper link resolution vulnerability in AWS Research and Engineering Studio (RES) allows authenticated users to replace their SSH key with a symlink,...
- News
Canadian Pleads Guilty to Snowflake Cloud Data-Theft Attacks
Connor Riley Moucka of Kitchener, Ontario pleaded guilty to orchestrating one of the largest cloud data-theft campaigns in history, stealing billions of...
- News
Snowflake Hacker Pleads Guilty Over Breaches Affecting at Least 100 Million People
Connor Riley Moucka pleaded guilty in Seattle federal court to computer fraud, wire fraud, and aggravated identity theft over the 2024 Snowflake...
- News
ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories
This week's threat landscape is defined by cheap leverage: an RCE that fires before the first prompt, a Samsung vulnerability requiring a single click, an...
- Security
CVE-2026-10059: Multicluster Engine ClusterCurator Token Escalation (CVSS 9.1)
A critical privilege escalation vulnerability in Red Hat's Multicluster Engine for Kubernetes allows a tenant administrator to exploit the ClusterCurator...
- Security
CVE-2026-10090: Red Hat ACM Helm Channel Privilege Escalation (CVSS 9.9)
A critical privilege escalation flaw in Red Hat Advanced Cluster Management for Kubernetes allows a namespace-scoped user to hijack cluster-admin...
- News
CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited
CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog on August 5, 2026 — a critical Langflow RCE, an Apache Tomcat encryption...
- Security
CVE-2026-18248: Fastify AWS Lambda Auth Bypass Allows Privilege Escalation
A critical vulnerability in @fastify/aws-lambda 6.4.0 allows attackers to spoof AWS API Gateway authorizer claims by sending crafted HTTP headers,...
- News
Biotech Giant Amgen Says Patient Data Stolen From Third-Party Cloud Systems
Amgen disclosed via SEC Form 8-K that threat actors accessed patient health information and proprietary company data through breaches of multiple...
- News
Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code
Three high-severity vulnerabilities in Hugging Face's Diffusers library allow crafted AI model repositories to silently execute arbitrary code when...
- News
Amgen Cloud Breach Exposes Patient Health Data and Proprietary Research
Pharmaceutical giant Amgen disclosed a material data breach affecting cloud environments operated by third-party service providers, with threat actors...
- News
'DangleGeddon': AI Could Weaponize Forgotten DNS Records at Global Scale
Security firm Silent Push coined 'DangleGeddon' to describe an AI-amplified attack scenario where forgotten DNS records pointing to deleted cloud...
- News
Microsoft Blames Massive Microsoft 365 Outage on Automated Maintenance Bug
Microsoft has revealed that a bug in its automated network maintenance request system caused Thursday's major global outage by mistakenly removing IP...
- Security
CVE-2026-56163: Critical Auth Bypass in Azure Kubernetes Service Allows Privilege Escalation
A CVSS 10.0 vulnerability in Microsoft Azure Kubernetes Service allows unauthenticated attackers to escalate privileges over the network due to missing...
- News
Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution
A design flaw in the Cursor AI code editor on Windows executes any file named git.exe found in the root of a cloned project directory — automatically,...
- News
Lessons Learned from CISA's Recent GitHub Leak
CISA has published a postmortem on a data leak in which a contractor exposed dozens of internal credentials — including AWS GovCloud keys — in a public...
- News
Lone Attacker Uses AI to Breach AWS Cloud Environment in 72 Hours
A single threat actor leveraged AI workflows, chained cloud misconfigurations, and stolen credentials to breach a large Amazon Web Services customer...
- Security
CVE-2026-15062: Critical SQL Injection in Snowflake Snowpark Python SDK
A critical-severity SQL injection vulnerability (CVSS 9.6) in the Snowflake Snowpark Python SDK allows authenticated low-privilege users to execute SQL...
- News
UK Cyber Pledge Draws Only a Handful of Top Firms Despite Ministerial Appeal
The UK government's voluntary Cyber Resilience Pledge attracted fewer than 15 of Britain's 350 largest listed companies despite eight months of direct...
- Security
CVE-2025-53827: ownCloud Updater Exposes Dangerous Method (CVSS 9.1)
A critical vulnerability in ownCloud Core's Updater component exposes a dangerous method to administrators, enabling potential remote code execution on...
- Security
CVE-2026-22874: Gitea SSRF Filter Bypass Exposes Cloud Credentials
Gitea versions through 1.26.2 use an incomplete IP filter that allows authenticated users to reach AWS Instance Metadata, Azure WireServer, and...
- Security
CVE-2026-45499: Azure OpenAI SSRF Enables Privilege Escalation — CVSS 9.9
A critical server-side request forgery vulnerability in Azure OpenAI rated CVSS 9.9 allows an authorized attacker to escalate privileges over the network,...
- News
FortiBleed Actors Collaborating With Inc, Lynx Ransomware Gangs
Threat actors who exploited the FortiBleed vulnerability to gain persistent access to thousands of Fortinet firewalls are now monetizing that access by...
- News
236,000 DCloud Uni-App Sites Powering Crypto Scams and Wallet Drainers
Infoblox researchers have uncovered over 236,000 websites built on the legitimate DCloud Uni-App framework being weaponized for investment scams,...
- News
Gamaredon Expands Ukraine Attacks with New Malware and Cloud Abuse
Russian FSB-linked APT group Gamaredon has mounted 35 distinct spear-phishing campaigns against Ukrainian targets in 2025, deploying an expanded malware...
- News
Chinese DCloud Uni-App Framework Powers 200,000+ Global Investment Scam Sites
Researchers at Infoblox documented how the legitimate DCloud Uni-App cross-platform development framework has been weaponized to power over 236,000 scam...
- News
Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks
Novee Security researchers have identified a critical exploitable CI/CD workflow pattern dubbed Cordyceps that enables attackers to hijack GitHub Actions...
- News
Data Exposure Flaws in Dify AI Platform Put 1 Million+ App Tenants at Risk
Security researchers discovered multi-tenant isolation failures in the Dify AI platform that allowed attackers to read private conversations from other...
- News
FFmpeg Fixes PixelSmash Flaw in Widely Used Video Decoder
FFmpeg has patched a critical vulnerability dubbed PixelSmash that could enable remote code execution on Jellyfin servers and denial-of-service conditions...
- News
Researchers Detail DifyTap Flaws in Dify That Could Expose AI Chats Across Tenants
Four vulnerabilities dubbed DifyTap were disclosed in the open-source AI workflow platform Dify, enabling attackers to silently read AI conversations from...
- News
FIFA Bug Exposes World Cup Streams to Remote Takeover
A security researcher discovered that FIFA's unenforced Microsoft Entra access controls could have allowed an attacker to hijack live World Cup broadcast...
- Security
CVE-2026-54420: LiteSpeed cPanel Plugin Symlink Escape on Shared Hosting
A high-severity symlink vulnerability in the LiteSpeed cPanel plugin (CVSS 8.5) allows users with FTP or web shell access to escape CloudLinux/CageFS...
- Security
CVE-2026-41005: Cloud Foundry UAA SAML Signature Bypass
A high-severity vulnerability (CVSS 9.0) in Cloud Foundry UAA allows attackers to bypass authentication by exploiting the incorrect treatment of XML...
- News
Aryon Security Raises $29 Million in Series A Funding
In the post-Mythos era, Aryon Security's platform helps organizations enforce security controls across multi-cloud environments as AI-generated...
- News
Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack
Microsoft's GitHub presence has become the latest target of the self-replicating Miasma supply chain worm, with 73 repositories across Azure, Azure-Samples…
- News
EU Unveils Tech Sovereignty Package to Cut Reliance on US and Chinese Suppliers
The European Commission has unveiled a sweeping technology sovereignty package combining a Chips Act 2.0, a Cloud and AI Development Act (CADA), an Open…
- Security
CVE-2026-41283: OpenStack Mistral Critical RCE Vulnerability (CVSS 9.9)
A critical unauthenticated remote code execution flaw in OpenStack Mistral through 22.0.0 allows attackers to execute arbitrary commands via exposed API…
- News
Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm
A new Mini Shai-Hulud supply chain campaign codenamed Miasma has compromised Red Hat's @redhat-cloud-services npm packages, deploying a self-propagating…
- News
Claude Mythos AI Finds 10,000 High-Severity Flaws in Widely
Anthropic has disclosed that Project Glasswing — its AI-powered vulnerability research initiative using the Claude Mythos system — has uncovered more than...
- News
Lawmakers Demand Answers as CISA Tries to Contain Data Leak
Members of Congress are demanding answers from CISA after a contractor intentionally published AWS GovCloud access keys and a trove of agency secrets on a...
- News
Looking Back, Looking Forward: Two Decades of Cybersecurity
Dark Reading editors mark 20 years of cybersecurity coverage by reflecting on the field's transformation — from perimeter-first defense to assume-breach...
- Security
CVE-2026-8507: Crypt::OpenSSL::PKCS12 Heap OOB Write — CVSS
A critical heap out-of-bounds write vulnerability in Crypt::OpenSSL::PKCS12 for Perl (versions through 1.94) can be triggered by parsing a malformed...
- News
In Other News: Big Tech vs Canada Encryption Bill, Cisco's
Other noteworthy stories this week: Big Tech firms push back against Canada's encryption legislation, Cisco releases a free AI security specification, and...
- News
Avada Builder WordPress Plugin Flaws Allow Site Credential
Two vulnerabilities in the Avada Builder plugin for WordPress, with an estimated one million active installations, allow hackers to read arbitrary files...
- Security
CVE-2026-34263 — SAP Commerce Cloud Unauthenticated RCE
A critical unauthenticated remote code execution vulnerability in SAP Commerce Cloud allows any unauthenticated user to upload malicious configurations...
- Security
CVE-2026-25199: Apache CloudStack Proxmox Extension Allows
A critical tenant isolation vulnerability in Apache CloudStack's Proxmox extension (CVSS 9.1) allows one tenant to access and control VM instances...
- Security
CVE-2026-42193: Plunk Email Platform SNS Webhook Forgery
A critical unauthenticated vulnerability in Plunk, the open-source AWS SES email platform, allows attackers to forge Amazon SNS webhook payloads without...
- Security
CVE-2026-33109: Azure Managed Instance for Apache Cassandra
A critical improper access control flaw in Azure Managed Instance for Apache Cassandra allows an authorized network attacker to execute arbitrary code,...
- News
AI Finds 38 Security Flaws in Electronic Health Record
Security researchers using AI-assisted analysis discovered 38 vulnerabilities in OpenEMR, an open-source electronic health record platform used by more...
- News
TeamPCP Hits SAP npm Packages With 'Mini Shai-Hulud' Supply
The threat actor TeamPCP has compromised multiple npm packages tied to SAP's cloud application development ecosystem in a new supply chain campaign dubbed...
- News
CISA Adds Actively Exploited ConnectWise and Windows Flaws
CISA has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog — CVE-2024-1708 affecting ConnectWise ScreenConnect...
- News
Hackers Exploit RCE Flaws in Qinglong Task Scheduler for Cryptomining
Threat actors are actively exploiting two authentication bypass vulnerabilities in the Qinglong open-source task scheduling tool to deploy cryptomining...
- Security
CVE-2026-21515: Azure IoT Central Elevation of Privilege
A critical CVSS 9.9 elevation of privilege vulnerability in Azure IoT Central allows an authenticated attacker to escalate privileges over a network by...
- Security
CVE-2026-24303: Microsoft Partner Center Privilege
A critical privilege escalation vulnerability in Microsoft Partner Center allows an authorized attacker to elevate their privileges over a network,...
- Security
CVE-2026-32210: Microsoft Dynamics 365 Online SSRF Enables
A critical server-side request forgery vulnerability in Microsoft Dynamics 365 (Online) allows an unauthenticated remote attacker to perform spoofing over...
- News
Cloud Platform Vercel Says Company Breached Through
Vercel has confirmed a security breach in which limited customer credentials were exposed after an employee's workstation was compromised through malware...
- Security
CVE-2026-32604: Spinnaker Clouddriver Remote Code Execution
A critical unauthenticated RCE vulnerability in Spinnaker's clouddriver service allows attackers to execute arbitrary commands on clouddriver pods,...
- Security
CVE-2026-32613: Spinnaker Echo Spring Expression Language
A critical code injection flaw in Spinnaker's Echo service allows unrestricted Spring Expression Language (SPeL) execution via artifact processing,...
- News
Next.js Creator Vercel Hacked
Vercel confirmed suffering a breach after a hacker claiming to be part of ShinyHunters offered to sell stolen data for $2 million, affecting the company...
- News
Vercel's Security Breach Started with Malware Disguised as
The Vercel security breach originated at Context.ai after an employee downloaded Lumma Stealer disguised as Roblox cheat software. The incident exposes...
- News
Vercel Confirms Breach as Hackers Claim to Be Selling
Cloud development platform Vercel has confirmed a security incident after threat actors claimed to have stolen internal databases, API keys, tokens, and...
- Security
KodExplorer fileGet Auth Bypass — Unauthenticated Remote
KodExplorer versions up to 4.52 contain an improper authentication flaw in the fileGet endpoint that allows remote attackers to access files without valid...
- Security
CVE-2026-5412: Juju Controller Facade Allows Low-Privilege
An authorization flaw in Juju's Controller facade allows any authenticated low-privilege user to call the CloudSpec API and extract the cloud provider...
- News
Snowflake Customers Hit in Data Theft Attacks After SaaS
Over a dozen companies have suffered data theft attacks after a SaaS integration provider was breached and authentication tokens stolen, enabling...
- News
CERT-EU: European Commission Hack Exposes Data of 30 EU
CERT-EU has attributed the European Commission cloud account compromise to the TeamPCP threat group, revealing the breach exposed sensitive data from at...
- Security
CVE-2026-26135: Azure Custom Locations SSRF Enables
A critical server-side request forgery vulnerability in Azure Custom Locations Resource Provider allows an authorized attacker to elevate privileges over...
- News
Healthcare Software Firm CareCloud Informs SEC of Potential
CareCloud has notified the U.S. Securities and Exchange Commission of a cyberattack that may have resulted in the unauthorized access and potential...
- News
Healthcare Tech Firm CareCloud Says Hackers Stole Patient
Healthcare IT company CareCloud has disclosed a cyberattack that resulted in the theft of sensitive patient data and caused an eight-hour network outage,...
- News
Cloudflare-Themed ClickFix Attack Drops Infiniti Stealer on Macs
A newly observed ClickFix campaign impersonates Cloudflare's CAPTCHA verification pages to deliver the Python-based Infiniti Stealer to macOS users via a...
- News
European Commission Investigating Breach After Amazon Cloud
The European Commission is investigating a security breach after a threat actor gained unauthorized access to its Amazon Web Services cloud environment...
- Newsletter
Mar 27 Digest: EU Commission AWS Breach, DarkSword iOS
The European Commission confirms a 350 GB AWS breach; the DarkSword iOS exploit chain goes public on GitHub threatening hundreds of millions of iPhones;...
- News
Supply Chain Attack Hits Widely-Used AI Package, Risking
Malicious versions of LiteLLM — a Python package with 3 million daily downloads present in roughly 36% of cloud environments — were quietly pushed to PyPI...
- News
Trivy Supply Chain Attack Targets CI/CD Secrets
The open-source Trivy security scanner was weaponized by threat actor TeamPCP in a supply chain attack that hijacked 75 release tags to deploy an...
- News
Cloud Security Startup Native Exits Stealth With $42
Native, founded by ex-AWS security leaders, has emerged from stealth with $42 million in backing from Ballistic Ventures and General Catalyst to build the...
- Security
CVE-2026-21994: Critical Unauthenticated RCE in Oracle Edge
A critical unauthenticated remote code execution vulnerability (CVSS 9.8) in Oracle's Edge Cloud Infrastructure Designer and Visualisation Toolkit allows...
- Security
CVE-2026-25534: Spinnaker SSRF via URL Validation Bypass
A critical SSRF vulnerability (CVSS 9.1) in Spinnaker's clouddriver and orca components bypasses the previous CVE-2025-61916 URL validation patch through...
- News
AI Flaws in Amazon Bedrock, LangSmith, and SGLang Enable
Security researchers disclosed critical flaws across three major AI platforms: Amazon Bedrock AgentCore's sandbox can be bypassed via DNS to exfiltrate...
- News
UNC6426 Weaponizes Old nx npm Compromise to Seize AWS Admin Access
Threat actor UNC6426 leveraged stolen credentials from last year's nx npm supply chain attack to achieve full AWS administrator access at a victim...
- Checklist
Microsoft 365 Tenant Security Checklist
Comprehensive security checklist for Microsoft 365 and Entra ID tenants — Conditional Access policies, MFA enforcement, audit logging, DLP configuration,...
- News
ShinyHunters Claims Mass Data Theft From 400 Firms via Salesforce Aura
Cybercrime group ShinyHunters claims to have exploited misconfigured Salesforce Experience Cloud instances to steal CRM data from approximately 400...
- News
North Korea's UNC4899 Breached Crypto Firm via AirDropped
North Korean threat actor UNC4899 compromised a cryptocurrency organization after a developer AirDropped a trojanized archive from a personal device to a...
- HOWTO
How to Secure GitHub Actions Workflows with OIDC, SHA
Harden your CI/CD pipeline by replacing long-lived secrets with OIDC short-lived tokens, pinning third-party actions to commit SHAs, enforcing...
- HOWTO
How to Configure Microsoft Sentinel Analytics Rules
End-to-end SOC guide for Microsoft Sentinel: build KQL-based scheduled and NRT analytics rules, wire automation rules for incident triage, and deploy...
- News
Cloudflare 2026 Threat Report: 230 Billion Daily Threats as
Cloudflare's inaugural threat intelligence report reveals its network blocks 230 billion cyber threats daily, with DDoS attacks doubling to 47.1 million...
- News
LexisNexis Confirms Cloud Breach Exposing 400K User
LexisNexis Legal & Professional confirms a data breach after threat actor FulcrumSec exploited an unpatched React2Shell vulnerability to exfiltrate 2.04...
- News
CrowdStrike 2026 Threat Report: eCrime Breakout Time Falls
CrowdStrike's 2026 Global Threat Report reveals that AI-enabled adversary operations surged 89% year-over-year, the average eCrime breakout time dropped...
- News
Google's $32 Billion Wiz Acquisition Clears Final Hurdle as
The European Commission grants unconditional antitrust approval for Google's $32 billion all-cash acquisition of cloud security firm Wiz — the largest...
- News
VoidLink: AI-Generated Cloud-Native Malware Framework
Researchers uncover VoidLink, an 88,000-line Zig-based malware framework built with AI assistance that targets AWS, Azure, GCP, and Kubernetes environments.
- HOWTO
AWS Security Hub: Centralized Security Findings
Implement AWS Security Hub for centralized security findings across accounts. Covers security standards, GuardDuty/Inspector integration, custom insights,...