Topic
4 articles
CyberSecureToday covers Serverless across 4 articles published between 22 Sep 2026 and 11 Oct 2026.
The coverage includes 4 vulnerability advisories. 4 advisories are rated critical or high severity.
Stories on Serverless most often intersect with Cloud Security, vm2 and Node.js, with Technology, Cloud & SaaS the most affected sector. The most recent story, “AWS Lambda MicroVM Isolation Flaw Exposed STS Session Keys Across Invocations”, was published 11 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.
AWS CloudAWS issues advisory CVE-2026-71215 for Lambda Custom Runtimes, addressing a Firecracker microVM memory reclamation flaw that exposed ephemeral STS tokens.
Threat IntelA critical sandbox escape in vm2 allows sandboxed scripts in Node.js 24+ to reach the node:test runner and invoke run() with arbitrary execArgv CLI flags.
Crypto / Web3A critical sandbox escape in vm2 allows untrusted NodeVM scripts to invoke OpenSSL engine loading via crypto.setEngine, executing arbitrary native code on the host.
Threat IntelCloudflare and OpenNext patch high-severity flaw CVE-2026-3125, where path normalization bypasses allow attackers to trigger SSRF and extract private Next.js cache assets.