Topic
131 articles
MicrosoftMicrosoft addresses a critical privilege escalation flaw in Azure Arc Connected Machine Agent (CVE-2026-83711) exposing Hybrid Instance Metadata Service tokens.
AWS CloudAWS patches a critical vulnerability in IAM Identity Center (CVE-2026-78520) allowing manipulated SAML XML comments to bypass role assignment boundaries.
AWS CloudAWS resolves security flaw CVE-2026-75210 in S3 Express One Zone storage class, addressing a session token reuse bug across high-performance compute enclaves.
Cyber AttackA major electric vehicle manufacturer files SEC Form 8-K Item 1.05 after threat actors breach cloud telematics, accessing vehicle GPS coordinates and remote commands.
AWS CloudAWS issues advisory CVE-2026-71215 for Lambda Custom Runtimes, addressing a Firecracker microVM memory reclamation flaw that exposed ephemeral STS tokens.
GoogleGoogle fixes critical flaw CVE-2026-69210 in Cloud IAM Workload Identity Federation where improper validation of OIDC audience claims allowed cross-tenant service account hijacking.
AWS CloudAWS patches CVE-2026-68115 in Amazon Bedrock Agent Runtime where unvalidated context memory serialization allowed cross-agent jailbreaks and tool invocation hijacking.
MicrosoftA high-severity memory corruption flaw in Azure Kubernetes Service's Cilium eBPF dataplane allows unprivileged pods to compromise Linux worker nodes.
Deep DiveThe Reserve Bank of India mandates continuous automated compliance monitoring and sovereign data localization for all banking cloud workloads.
GoogleA security flaw in Google Cloud Run's internal metadata proxy allows server-side request forgery to steal workload identity IAM tokens.
AWS CloudA security vulnerability in AWS IAM Identity Center's SCIM protocol implementation could allow token bypass during automated user and group provisioning.
Data BreachCloudflare Security releases an advisory addressing a vulnerability in Workers KV edge namespace routing allowing potential cross-tenant cache token retrieval.
MicrosoftMicrosoft MSRC publishes a security bulletin detailing an identity impersonation flaw in Azure Container Apps Dapr sidecars allowing cross-service token spoofing.
RansomwareSEC Form 8-K filing reveals an extortion syndicate encrypted corporate cloud servers hosting diagnostic telemetry and proprietary firmware repositories for hospital medical devices.
GoogleGoogle Cloud Security discloses a vulnerability in Cloud Armor WAF Adaptive Protection allowing attackers to bypass rate limiting via multiplexed HTTP/2 frames.
AWS CloudAWS Security Bulletins disclose a privilege escalation vulnerability in the Amazon EKS Pod Identity Agent allowing compromised pods to replay IAM credentials.
Threat IntelHashiCorp releases critical security bulletin for CVE-2026-50123 in Vault Enterprise, resolving a memory leak flaw in the Transit secrets engine exposing cryptographic keys.
AWS CloudAWS resolves high-severity vulnerability CVE-2026-46210 in IAM Identity Center where cached SCIM bearer tokens allowed cross-directory role synchronization bypass.
GoogleGoogle Cloud releases emergency advisory for CVE-2026-45129, resolving an internal metadata server proxy flaw in Cloud Run allowing cross-container token leakage.
VulnerabilityDefense aerospace contractor files SEC Form 8-K disclosing a material cyber incident involving compromised enterprise OAuth application tokens and telemetry theft.
Threat IntelCloudflare security advisory details a rule engine normalization defect enabling request smuggling and WAF inspection bypass.
Gov / DefenseCERT-In security advisory mandates multi-cloud redundancy, immutable backup vaults, and 6-hour incident disclosure across Indian financial institutions.
AWS CloudSEC Form 8-K disclosures reveal a surge in material cyber incidents driven by cloud identity theft and automated data lake exfiltration.
AWS CloudAWS Security Bulletin details an authorization validation defect in S3 Multi-Region Access Point endpoints permitting IAM privilege escalation.