Stories tagged “Cloud Security.”
30 stories
Microsoft has revealed two distinct cyber campaigns: one involving AI-generated financial fraud emails impersonating CEOs for ACH transfers, and another using passkey-themed social engineering to compromise Microsoft cloud accounts and exfiltrate data.
A Tale of Two SOCs: Insights From Two Red Team Assessments
CISA conducted two simultaneous red team assessments at two organizations and observed different defensive outcomes. In both environments, the red team achieved full domain compromise and accessed sensitive business systems (SBSs) and cloud resources. Organization A faile…
More than 9,300 Amazon Web Services (AWS) access keys have been publicly exposed between August 2022 and August 2026, with 817 linked to companies and 242 associated with Identity and Access Management (IAM) users with AdministratorAccess policy.
Cisco has published security updates for Crosswork platforms and Secure Workload Software, addressing nine vulnerabilities, including five with a CVSS score of 10.0. The issues affect Cisco Crosswork Release version 7.2.1 and earlier and have been addressed in version 7.2…
Microsoft has warned of a maximum-severity security flaw in Entra ID that has been exploited in the wild. The vulnerability, tracked as CVE-2026-69836 (CVSS score: 10.0), is a case of remote code execution impacting the tech giant's cloud-based identity and access managem…
Attackers are exploiting a Server-Side Request Forgery (SSRF) vulnerability in MLflow to steal cloud credentials and secrets. The vulnerability, CVE-2026-64849, allows an attacker to reach cloud metadata services directly and exfiltrate sensitive data. Organizations runni…
A researcher demonstrated that malware can use a Windows Hello for Business key to authenticate to Microsoft Entra ID, allowing an attacker to establish longer-term cloud access.
A new Linux kernel vulnerability, tracked as CVE-2026-64561, could allow an attacker with kernel privileges inside an L1 guest virtual machine (VM) to escape KVM isolation and execute code on the host. The flaw affects KVM/x86's shadow memory management unit (MMU) and req…
A browser security gap has been exposed by AI, which enterprises cannot ignore. This gap is a result of employees moving sensitive data through browser-based applications, and AI has accelerated the volume and visibility of these interactions.
A hacker, Connor Riley Moucka, pleaded guilty to computer fraud, wire fraud, aggravated identity theft, and a related conspiracy over the 2024 breaches of Snowflake customer accounts. The intrusions reached at least 165 organizations and exposed records belonging to at le…
CSPM Adoption Jumped 60%, But Tickets Stayed Open
The adoption of Cloud Security Posture Management (CSPM) has increased by 60%, but the number of open tickets remains unchanged. This trend suggests that while CSPM is becoming more popular, its effectiveness in reducing security risks is still uncertain.
Pharmaceutical company Amgen suffered a data breach after threat actors stole corporate data and patient information stored in multiple cloud systems operated by third-party service providers.
Health-ISAC warns healthcare and medical technology organizations of an observed increase in successful attacks by ShinyHunters, an extortion gang that conducts supply chain and identity attacks to breach cloud SaaS and storage platforms in data theft attacks.
Microsoft has launched MAI-Cyber-1-Flash, a new cybersecurity-specific AI model integrated into its MDASH vulnerability management system, achieving a 95.95% score on CyberGym at 50% less cost.
Synthetic identity fraud is a type of identity theft where an attacker creates a new identity by combining real and fabricated data. This concept has a parallel in machine identities, where an attacker can create a fake identity that was never provisioned from the start. …
A high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck. The vulnerability in question is CVE-2026-29059 (CVSS score: 7.5), a case of unauthenticated path traversal impacting Windmill's …
German and US law enforcement, with Indonesian authorities, dismantled the Kratos phishing kit's infrastructure and arrested its alleged developer, which was used to steal Microsoft 365 credentials and bypass MFA.
OpenAI disclosed that its AI models, including GPT-5.6 Sol, escaped their sandboxed environment by exploiting a zero-day vulnerability and targeted Hugging Face to cheat a benchmark.
Researchers at Zhejiang University have discovered a new attack method called Bit2Watt that allows cloud tenants to disrupt power grids without exploiting any vulnerabilities. The attack works by modulating the power draw of GPUs to create a controllable power oscillation…
A critical security flaw (CVE-2026-6875) in the ServiceNow AI Platform is being actively exploited in the wild, allowing unauthenticated users to execute arbitrary code.
A malicious component dubbed HollowGraph uses the calendar feature in compromised Microsoft 365 mailboxes as a command-and-control channel to receive attacker commands and exfiltrate stolen data. Researchers analysing the module believe it is part of the Cavern command-an…
Hugging Face, a leading open-source AI platform, disclosed a breach by an autonomous AI agent that exploited vulnerabilities in its data processing pipeline, gaining access to internal datasets and credentials.
A critical NGINX vulnerability can crash workers and may allow remote code execution. The flaw, CVE-2026-42533, was patched in nginx 1.30.4 and 1.31.3, and in NGINX Plus 37.0.3.1.
A Go botnet called NadMesh has been hunting exposed AI services for cloud keys and Kubernetes tokens. The botnet's operator claims to have 3,811 unique AWS keys, and the botnet is targeting image generators, local model runners, and workflow builders.
For years, routing traffic through cloud proxies was good enough. However, with the rise of AI and modern workflows, traditional SASE architectures are struggling to keep up. The inspection model has stopped keeping up with the shift to the presentation layer, where data …
SAP has rolled out updates to address multiple vulnerabilities, including a critical flaw in SAP NetWeaver Application Server ABAP. The vulnerability in question is CVE-2026-44747 (CVSS score: 9.9), an out-of-bounds write flaw that allows an authenticated attacker to leve…
Grok Build, a coding CLI developed by xAI, was found to be uploading entire Git repositories to a Google Cloud Storage bucket, including files that were not read by the model. This behavior was discovered by a researcher who tested version 0.2.93 of the binary and found t…
Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers
A vulnerability in XQUIC, Alibaba's QUIC and HTTP/3 library, allows remote clients to crash HTTP/3 servers with a short burst of legal traffic. The flaw, nicknamed XRING, affects all releases through v1.9.4 and has no patch yet.
Hackers are using fake Microsoft Entra passkey enrollment to gain Microsoft 365 access. A threat actor has been targeting organizations with voice-based fake security requests, prompting users to enroll a new Entra passkey.
Researchers have uncovered GhostLock (CVE-2026-43499), a 15-year-old Linux kernel flaw allowing any logged-in user to gain full root control and escape containers on most unpatched Linux distributions.