Topic

Cloud Security: news, advisories and analysis

101 articlesUpdated 29 Oct 2026

CyberSecureToday covers Cloud Security across 101 articles published between 8 Sep 2026 and 29 Oct 2026. The coverage includes 81 vulnerability advisories, 8 incident or breach reports and 9 analysis or guidance pieces. 77 advisories are rated critical or high severity, and 13 involve flaws listed in CISA's Known Exploited Vulnerabilities catalog.

Stories on Cloud Security most often intersect with AWS, IAM and Privilege Escalation, with Technology, Cloud & SaaS the most affected sector. The most recent story, “Broadcom VMware ESX Vulnerability Exploited in Wild Attacks”, was published 29 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ThreatsCloud & SaaSBreaking
Broadcom VMware ESX Vulnerability Exploited in Wild Attacks
CVE-2026-41709 in Broadcom VMware ESX (Security Vulnerability) allows remote attackers to trigger active system exploitation. Patch: Vendor security patch
CST Editorial Desk29 Oct 202610 min read
ThreatsCloud & SaaSBreaking
Google Brotli Vulnerability Exploited in Wild Attacks
CVE-2026-111497 in Google Brotli (Security Vulnerability) allows remote attackers to trigger active system exploitation. Patch: Version 1.2.0.
CST Editorial Desk28 Oct 202610 min read
ThreatsCloud & SaaSBreaking
Adobe Commerce and Magento Unrestricted File Upload Flaw Exploited in Wild Attacks
CVE-2026-48356 in Adobe Commerce and Magento (Unrestricted File Upload) allows remote attackers to trigger active system exploitation. Patch: Vendor securi
CST Editorial Desk28 Oct 202610 min read
ThreatsCloud & SaaSCritical
Collabora Online – Built-in CODE Server OS Command Injection Flaw Exploited in Wild Attacks
CVE-2026-110447 in Collabora Online – Built-in CODE Server (OS Command Injection) allows remote attackers to trigger active system exploitation. Patch: Ver
CST Editorial Desk24 Oct 202610 min read
ThreatsCloud & SaaS
Siemens Software Center Vulnerability Exploited in Wild Attacks
CVE-2026-110936 in Siemens Software Center (Security Vulnerability) allows remote attackers to trigger active system exploitation. Patch: Vendor security p
CST Editorial Desk21 Oct 202610 min read
ThreatsCloud & SaaSHigh
SingCERT Issues Critical Alert as CARBONATO Botnet Exploits Exposed Docker Remote APIs Across Cloud Workloads
SingCERT issues an urgent warning as the CARBONATO botnet actively scans Singapore cloud subnets, hijacking exposed unauthenticated Docker Remote APIs for container escapes.
Aisha Noor21 Oct 202613 min read
ThreatsCloud & SaaS
Plex Media Server Server-Side Request Forgery Flaw Exploited in Wild Attacks
CVE-2026-96655 in Plex Media Server (Server-Side Request Forgery) allows remote attackers to trigger active system exploitation. Patch: Version 1.43.3.1086
CST Editorial Desk21 Oct 202610 min read
ThreatsCloud & SaaSCritical
Plex Media Server Input Validation Flaw Exploited in Wild Attacks
CVE-2026-96654 in Plex Media Server (Input Validation) allows remote attackers to trigger active system exploitation. Patch: Vendor security patch release.
CST Editorial Desk21 Oct 202610 min read
ThreatsCloud & SaaSHigh
EG Secure Solutions SiteGuard Server Edition OS Command Injection Flaw Exploited in Wild Attacks
CVE-2026-106931 in EG Secure Solutions SiteGuard Server Edition (OS Command Injection) allows remote attackers to trigger active system exploitation. Patch
CST Editorial Desk21 Oct 202610 min read
ThreatsCloud & SaaSHigh
Plex Media Server Vulnerability Exploited in Wild Attacks
CVE-2026-96656 in Plex Media Server (Security Vulnerability) allows remote attackers to trigger active system exploitation. Patch: Version 1.43.3.10861 and
CST Editorial Desk21 Oct 202610 min read
ThreatsCloud & SaaSHigh
AWS Amplify CLI Prototype Pollution Flaw in Velocity Template Engine Enabled Local Code Execution
A prototype chain traversal flaw in AWS Amplify's velocity template engine allowed attackers with malicious VTL files to execute arbitrary local commands.
Aisha Noor18 Oct 202614 min read
Cyber AttackCloud & SaaS
ConnectWise Cloud Backup Credential Leak Weaponized to Hijack Microsoft 365 Tenants
A compromised vendor credential in ConnectWise Cloud Backup allowed threat actors to abuse OAuth application tokens across hundreds of Microsoft 365 customer tenants.
Aisha Noor17 Oct 202610 min read
ThreatsCloud & SaaSCritical
Microsoft Patches Maximum-Severity CVSS 10.0 Privilege Escalation Flaw CVE-2026-96207 in Partner Center Cloud Service
Microsoft resolves a maximum-severity privilege escalation flaw (CVE-2026-96207, CVSS 10.0) in Partner Center that exposed delegated customer tenants to unauthorized administrative control.
CST Editorial Desk17 Oct 20268 min read
ThreatsCloud & SaaSCritical
Mage OSS Critical Authentication Bypass Flaw CVE-2026-111823 Exposes Enterprise ETL Data Pipelines to Remote Takeover
A critical vulnerability in Mage OSS (CVE-2026-111823, CVSS 9.8) enables unauthenticated attackers to forge OAuth sessions and seize administrative control of cloud data pipelines.
CST Editorial Desk17 Oct 20269 min read
InsightsBanking & Fintech
RBI Cyber Security Framework Mandates 6-Hour Breach Reporting and Cloud Audits
The Reserve Bank of India enforces updated CSFB directives mandating 6-hour breach disclosure to CERT-In, third-party cloud audits, and zero-trust banking security.
Priya Raman15 Oct 20269 min read
ThreatsCloud & SaaSHigh
AWS Systems Manager (SSM) Agent OS Command Injection Flaw CVE-2026-87911 Patched
AWS resolves a high-severity OS command injection flaw in AWS Systems Manager Agent (CVE-2026-87911) affecting multi-step Run Command document execution.
CST Editorial Desk14 Oct 20268 min read
ThreatsCloud & SaaSHigh
Google Cloud Workload Identity Federation OIDC Token Bypass Flaw CVE-2026-19410 Remediated
Google Cloud updates authentication libraries for CVE-2026-19410 where improper audience validation allowed external OIDC tokens to impersonate IAM service accounts.
Aisha Noor14 Oct 20268 min read
ThreatsCloud & SaaSHigh
AWS IAM Identity Center Flaw Left Revoked Session Tokens Active
AWS resolves an access control flaw in IAM Identity Center and AWS CLI session handling (CVE-2026-82856) where revoked STS tokens remained temporarily active.
CST Editorial Desk14 Oct 20268 min read
ThreatsCloud & SaaSHigh
Azure Arc Connected Machine Agent Local Privilege Escalation Flaw CVE-2026-83711 Enables Host Compromise
Microsoft addresses a critical privilege escalation flaw in Azure Arc Connected Machine Agent (CVE-2026-83711) exposing Hybrid Instance Metadata Service tokens.
Aisha Noor13 Oct 20268 min read
NewsCloud & SaaSCritical
AWS IAM Identity Center SAML Canonicalization Flaw Enables Cross-Account Administrative Role Assumption (CVE-2026-78520)
AWS patches a critical vulnerability in IAM Identity Center (CVE-2026-78520) allowing manipulated SAML XML comments to bypass role assignment boundaries.
CST Editorial Desk13 Oct 20268 min read
ThreatsCloud & SaaSCritical
AWS S3 Express One Zone Flaw Allowed Session Token Reuse Across Enclaves
AWS resolves security flaw CVE-2026-75210 in S3 Express One Zone storage class, addressing a session token reuse bug across high-performance compute enclaves.
CST Editorial Desk12 Oct 20268 min read
Cyber AttackCloud & SaaS
Electric Vehicle Maker Discloses Unauthorized Access to Global Fleet Telematics Platform
A major electric vehicle manufacturer files SEC Form 8-K Item 1.05 after threat actors breach cloud telematics, accessing vehicle GPS coordinates and remote commands.
Priya Raman12 Oct 20268 min read
ThreatsCloud & SaaSCritical
AWS Lambda MicroVM Isolation Flaw Exposed STS Session Keys Across Invocations
AWS issues advisory CVE-2026-71215 for Lambda Custom Runtimes, addressing a Firecracker microVM memory reclamation flaw that exposed ephemeral STS tokens.
CST Editorial Desk11 Oct 20268 min read
ThreatsCloud & SaaSCritical
Google Cloud Workload Identity Flaw Enabled Cross-Organization Service Account Impersonation
Google fixes critical flaw CVE-2026-69210 in Cloud IAM Workload Identity Federation where improper validation of OIDC audience claims allowed cross-tenant service account hijacking.
CST Editorial Desk11 Oct 20268 min read