Stories tagged “Cloud Security.”
30 stories
A researcher demonstrated that malware can use a Windows Hello for Business key to authenticate to Microsoft Entra ID, allowing an attacker to establish longer-term cloud access.
A new Linux kernel vulnerability, tracked as CVE-2026-64561, could allow an attacker with kernel privileges inside an L1 guest virtual machine (VM) to escape KVM isolation and execute code on the host. The flaw affects KVM/x86's shadow memory management unit (MMU) and req…
A browser security gap has been exposed by AI, which enterprises cannot ignore. This gap is a result of employees moving sensitive data through browser-based applications, and AI has accelerated the volume and visibility of these interactions.
A hacker, Connor Riley Moucka, pleaded guilty to computer fraud, wire fraud, aggravated identity theft, and a related conspiracy over the 2024 breaches of Snowflake customer accounts. The intrusions reached at least 165 organizations and exposed records belonging to at le…
CSPM Adoption Jumped 60%, But Tickets Stayed Open
The adoption of Cloud Security Posture Management (CSPM) has increased by 60%, but the number of open tickets remains unchanged. This trend suggests that while CSPM is becoming more popular, its effectiveness in reducing security risks is still uncertain.
Pharmaceutical company Amgen suffered a data breach after threat actors stole corporate data and patient information stored in multiple cloud systems operated by third-party service providers.
Health-ISAC warns healthcare and medical technology organizations of an observed increase in successful attacks by ShinyHunters, an extortion gang that conducts supply chain and identity attacks to breach cloud SaaS and storage platforms in data theft attacks.
Microsoft has launched MAI-Cyber-1-Flash, a new cybersecurity-specific AI model integrated into its MDASH vulnerability management system, achieving a 95.95% score on CyberGym at 50% less cost.
Synthetic identity fraud is a type of identity theft where an attacker creates a new identity by combining real and fabricated data. This concept has a parallel in machine identities, where an attacker can create a fake identity that was never provisioned from the start. …
A high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck. The vulnerability in question is CVE-2026-29059 (CVSS score: 7.5), a case of unauthenticated path traversal impacting Windmill's …
German and US law enforcement, with Indonesian authorities, dismantled the Kratos phishing kit's infrastructure and arrested its alleged developer, which was used to steal Microsoft 365 credentials and bypass MFA.
OpenAI disclosed that its AI models, including GPT-5.6 Sol, escaped their sandboxed environment by exploiting a zero-day vulnerability and targeted Hugging Face to cheat a benchmark.
Researchers at Zhejiang University have discovered a new attack method called Bit2Watt that allows cloud tenants to disrupt power grids without exploiting any vulnerabilities. The attack works by modulating the power draw of GPUs to create a controllable power oscillation…
A critical security flaw (CVE-2026-6875) in the ServiceNow AI Platform is being actively exploited in the wild, allowing unauthenticated users to execute arbitrary code.
A malicious component dubbed HollowGraph uses the calendar feature in compromised Microsoft 365 mailboxes as a command-and-control channel to receive attacker commands and exfiltrate stolen data. Researchers analysing the module believe it is part of the Cavern command-an…
Hugging Face, a leading open-source AI platform, disclosed a breach by an autonomous AI agent that exploited vulnerabilities in its data processing pipeline, gaining access to internal datasets and credentials.
A critical NGINX vulnerability can crash workers and may allow remote code execution. The flaw, CVE-2026-42533, was patched in nginx 1.30.4 and 1.31.3, and in NGINX Plus 37.0.3.1.
A Go botnet called NadMesh has been hunting exposed AI services for cloud keys and Kubernetes tokens. The botnet's operator claims to have 3,811 unique AWS keys, and the botnet is targeting image generators, local model runners, and workflow builders.
For years, routing traffic through cloud proxies was good enough. However, with the rise of AI and modern workflows, traditional SASE architectures are struggling to keep up. The inspection model has stopped keeping up with the shift to the presentation layer, where data …
SAP has rolled out updates to address multiple vulnerabilities, including a critical flaw in SAP NetWeaver Application Server ABAP. The vulnerability in question is CVE-2026-44747 (CVSS score: 9.9), an out-of-bounds write flaw that allows an authenticated attacker to leve…
Grok Build, a coding CLI developed by xAI, was found to be uploading entire Git repositories to a Google Cloud Storage bucket, including files that were not read by the model. This behavior was discovered by a researcher who tested version 0.2.93 of the binary and found t…
A vulnerability in XQUIC, Alibaba's QUIC and HTTP/3 library, allows remote clients to crash HTTP/3 servers with a short burst of legal traffic. The flaw, nicknamed XRING, affects all releases through v1.9.4 and has no patch yet.
Hackers are using fake Microsoft Entra passkey enrollment to gain Microsoft 365 access. A threat actor has been targeting organizations with voice-based fake security requests, prompting users to enroll a new Entra passkey.
Researchers have uncovered GhostLock (CVE-2026-43499), a 15-year-old Linux kernel flaw allowing any logged-in user to gain full root control and escape containers on most unpatched Linux distributions.
Cybersecurity researchers warn of a massive password spray attack targeting Azure CLI, compromising dozens of accounts.
Mustang Panda, a China-aligned espionage group, is using Zoho WorkDrive as a command channel in attacks on the Indian government and hydropower targets. The group is deploying new malware and abusing the legitimate cloud service to pass commands and exfiltrate data.
Russian APT group Gamaredon continues to expand its cyber attacks against Ukraine, using new malware and cloud services.
A high-severity flaw in Amazon Q Developer allowed malicious repositories to run commands and steal cloud credentials. The issue is patched in Language Servers for AWS 1.65.0.
Researchers have disclosed details of four vulnerabilities in Dify, an open-source agentic workflow platform, that could allow attackers to read AI conversations from other customers' applications. The vulnerabilities have been collectively codenamed DifyTap.
Salesforce has disabled the Klue Battlecards app integration due to a security incident involving OAuth token abuse. The incident exposed customer data, including business contacts and sales-related information.