Tag
26 results in the archive.
Two critical vulnerabilities in the Xen hypervisor allow malicious virtual machines to read and write memory of other VMs, including dom0, posing significant security risks in virtualized environments.
Northflank suffered a security breach resulting in unauthorized use of customers' AI API keys, posing risks to AI asset security.
Hackers breached Onamae Desktop Cloud, infecting up to 26,739 servers with malware, risking disruption to hosted customer infrastructure.
Zeabur disclosed a second security breach within two months resulting in leaked plaintext credentials and theft of over 3.2 million environment variables affecting more than 321,000 accounts.
Attackers use stolen ConnectWise Cloud Backup credentials to access 173 Microsoft 365 tenants affecting multiple managed service providers.
A critical Linux kernel vulnerability known as PwnEscape (CVE-2026-99999) allows guest virtual machines to read host memory, affecting cloud environments including Vercel live sandboxes.
UK fashion retailer ASOS confirmed a data breach after attackers sent unauthorized push notifications via its mobile app, alleging access to customer data in its Snowflake environment.
OpenAI disclosed that its AI agents unintentionally uploaded user-provided images to third-party image hosting services, raising concerns about data privacy in AI systems.
Microsoft details Storm-3168's use of compromised Azure service principals for reconnaissance, resource deletion, and credential theft, posing significant cloud security risks.
A mass-scanning campaign targets internet-exposed Vite development servers to steal cloud credentials linked to AWS and Azure environments.
Microsoft disclosed campaigns where attackers exploited third-party email systems for large-scale financial scam phishing and used passkey-themed social engineering techniques to compromise cloud accounts.
IDScan confirmed that hackers accessed customer data on its cloud platform, exposing over 153 million driver’s license scans with sensitive personal identity information.
Attackers exploit passkey-themed social engineering to bypass MFA and leverage Microsoft Graph for access to SharePoint, OneDrive, and email data, impacting cloud and identity security.
A 2026 Cloud Security Index revealed unique risk profiles in AWS, Azure, and Google Cloud through misconfiguration data from 3,000 organizations, challenging traditional multi-cloud security strategies.
JetBrains suffered a breach after attackers exploited an unpatched TeamCity vulnerability to access Cadence and extract AWS credentials.
Attackers breached Coder's Cloudflare infrastructure to push malicious Terraform modules that embed credential-stealing code, threatening developer credentials.
An unauthenticated remote code execution vulnerability in Langflow is exploited to steal sensitive OpenAI and AWS credentials, posing substantial risks to cloud and AI security.
CISA's red team assessments identified significant detection and response weaknesses in IT, cloud, and OT environments, revealing misconfigured Active Directory and excessive cloud permissions.
Over 9,300 AWS access keys leaked between 2022 and 2026 remain active, exposing corporate accounts to unauthorized access risks.
A threat actor is selling employee databases stolen from Microsoft Azure infrastructure of multiple Fortune 500 companies using compromised credentials, exposing sensitive account records and presenting an enterprise security risk.
Two malicious LiteLLM packages on PyPI in March contained credential-stealing code that potentially exposed over 2,100 organizations by capturing cloud and system secrets.
A Canadian individual admitted guilt in a data theft scheme targeting Snowflake cloud accounts, compromising sensitive data from at least 165 organizations and pursuing extortion.
Amgen reported a cloud data breach involving unauthorized access to patient health data and proprietary corporate information via third-party cloud systems.
A critical vulnerability in Azure Cosmos DB enabled attackers to escape the Gremlin query sandbox and gain full read/write access to multiple customer databases.
A crafted SVG submitted to Bing image search can execute commands as NT AUTHORITY\SYSTEM on Microsoft’s production servers, impacting multiple hosts with critical security implications.
The NadMesh Go botnet targets exposed AI services to harvest over 3,800 unique AWS keys, threatening cloud and Kubernetes environments.