Tag

Cloud Security

All articles tagged with #cloud security

cyber-security3 days ago•26 min saved

Entra ID RCE Flaw Prompts Cloud Security Scrutiny as Patch Goes Server‑Side

Microsoft disclosed a critical remote code execution vulnerability in Entra ID (CVE-2026-69836) caused by deserialization of untrusted data (CWE-502) that could allow unauthenticated attackers to run arbitrary code on the identity service. Microsoft has deployed a server-side patch with no customer action required; initial reports of in‑the‑wild exploitation are now clarified as not currently active. Security teams should still review Entra ID sign-in logs, tighten conditional access, and monitor privileged roles across the Microsoft ecosystem.

via CyberSecurityNews|

#cloud-security #cve-2026-69836 #cyber-security

technology1 month ago•3 min saved

Long-standing Linux kernel flaw lets guest VMs break out to hosts on Intel and AMD

Hyunwoo Kim disclosed CVE-2026-53359, a 16-year-old Linux kernel use-after-free in KVM/x86 shadow MMU that enables guest-to-host VM escape on both Intel and AMD CPUs. A successful exploit can grant root on the host and potentially take over all VMs on a multi-tenant machine or crash the host kernel; patch 81ccda30b4e8 was applied in June 2026. Administrators should ensure patched kernels on KVM/x86 hosts, especially in cloud environments, as the risk is real for Google Cloud and AWS users. A PoC and write-up exist, though full public exploitation is not released yet, and attackers could chain with other flaws like Dirty Frag.

via BleepingComputer|

#cloud-security #kernel #kvm

business3 months ago•3 min saved

Zscaler slides after outlook misses; analysts trim targets but praise strong NRR

Zscaler (ZS) stock fell about 25% after FY27 ARR and revenue guidance missed expectations, with higher capital expenditures weighing on free cash flow margins. While many analysts lowered price targets, they remained constructive on the name due to robust net revenue retention, though concerns persist about competition from Palo Alto Networks and Netskope and slower new-logo growth in the SASE space.

via Seeking Alpha|

#business #cloud-security #earnings-guidance

business3 months ago•78 min saved

Datadog lifts full-year outlook as cloud security demand accelerates

Datadog raised its annual forecast citing robust demand for cloud security, with the upbeat guidance fueling a sharp rise in its stock price.

via Yahoo Finance|

#business #cloud-security #datadog

technology3 months ago•2 min saved

Entra ID Agent Role Flaw Allows Service Principal Takeover, Patch Deployed

A built-in Entra ID role called Agent ID Administrator could let attackers take ownership of arbitrary service principals, enabling privilege escalation and potential tenant compromise. Microsoft issued a patch across cloud environments on April 9 to block ownership changes by the Agent ID Administrator on non-agent principals, mitigating the risk. Security researchers urge ongoing monitoring of sensitive role usage, ownership changes, secure handling of privileged service principals, and auditing credential creation on service principals to reduce exposure from this loophole.

via The Hacker News|

#cloud-security #cybersecurity #identity-and-access-management

technology5 months ago•6 min saved

Cloud breaches pivot to new flaws as credential abuse wanes

Google’s threat intelligence shows cloud intrusions are increasingly driven by exploiting freshly disclosed third-party software flaws, shrinking the window to weaponize exploits to days. Weak credentials have declined as an attack vector while remote code execution flaws like React2Shell (CVE-2025-55182) and XWiki (CVE-2025-24893) are frequently exploited. Attacks often begin via phishing or stolen identities, with Iran-, China-, and North Korea–linked campaigns maintaining long-term access to steal data, crypto, and credentials. OpenID Connect abuse, supply-chain incidents, and insider threats also feature prominently, underscoring the need for automated, rapid incident response as cloud threats accelerate into 2026.

via BleepingComputer|

#apt #cloud-security #data-exfiltration

technology6 months ago•25 min saved

Identity as the Perimeter: The Hidden Gate in Cyber Breaches

A sponsored Visual Capitalist infographic (in partnership with Unit 42 by Palo Alto Networks) outlines how cyberattackers breach systems by exploiting identity. Identity-based techniques drive about 65% of initial access, with social engineering and credential misuse leading the way, and 90% of recent investigations showing identity weaknesses as material. Once inside, over-privileged identities and token abuse enable rapid lateral movement, making identity the practical perimeter. Defenses recommended include phishing-resistant MFA (passkeys/FIDO2), rotating machine credentials, shorter sessions, just-in-time elevation for admins, and cross-cloud identity telemetry to detect unusual access chains.

via Visual Capitalist|

#cloud-security #cyberattacks #cybersecurity

security6 months ago•6 min saved

Researchers uncover 27 attack scenarios targeting cloud password managers

Swiss researchers disclosed 27 attack scenarios across Bitwarden, LastPass, Dashlane and 1Password that could let attackers view or modify vaults, challenging the science of end-to-end encryption and exploiting issues in onboarding, key escrow, and item-level encryption. A notable attack demonstrated is ‘malicious auto-enrolment’ against Bitwarden, which could allow a server-controlled attacker to hijack a vault during organization onboarding. Vendors are patching (Bitwarden, LastPass, Dashlane) while 1Password defends its SRP-based design. The paper recommends stronger authentication, key separation and ciphertext integrity. Users should check remediation status with providers and ask for audits.)

via Infosecurity Magazine|

#cloud-security #cryptography #end-to-end-encryption

security6 months ago•4 min saved

Researchers expose 25 recovery attacks against leading cloud password managers

A joint ETH Zurich/USI study identifies 25 distinct password-recovery/related attacks across major cloud password managers (Bitwarden, Dashlane, LastPass; with 1Password also noted for some flaws). Attacks span four categories: exploiting key escrow in account recovery, weaknesses in item-level encryption and metadata, vulnerabilities in sharing features, and downgrades due to legacy code. In total, 12 attacks hit Bitwarden, 7 LastPass, and 6 Dashlane; 1Password was linked to item-level and sharing flaws as known limitations. Vendors have issued patches or mitigations (e.g., Dashlane removing legacy crypto, Bitwarden remediation, LastPass hardening, 1Password using SRP), and there’s no evidence these issues have been exploited in the wild.

via The Hacker News|

#cloud-security #cryptography #password-managers

security7 months ago•13 min saved

VoidLink: A Cloud-Native Linux Malware Framework Targets Cloud and Containers

Check Point Research details VoidLink, a modular, cloud-first Linux malware framework designed for long-term access in cloud and container environments. Written in Zig, it features a two-stage loader, an in-memory plugin system with 37 default plugins, a web-based C2 dashboard, and adaptive stealth that tailors behavior after detecting cloud providers (AWS, GCP, Azure, Alibaba, Tencent). It supports multiple command-and-control channels (HTTP/HTTPS, DNS, ICMP) and even a potential mesh network, plus rootkit capabilities (LD_PRELOAD, eBPF, LKM) depending on kernel version, anti-analysis and self-deletion measures, and a broad plugin ecosystem for post-exploitation tasks. The framework appears to be under active development—likely commercial—raising the need for defenders to harden Linux, cloud, and container environments; as of publication, no real-world infections had been observed.

via Check Point Software|

#cloud-security #container-security #linux-malware

technology8 months ago•5 min saved

Palo Alto Networks and Google Cloud Secure $10 Billion AI and Cloud Deal

Palo Alto Networks and Google Cloud have expanded their partnership to enhance AI security across cloud and hybrid environments, integrating Palo Alto's Prisma AIRS with Google Cloud's AI services to protect AI workloads, improve security management, and streamline deployment, while also migrating Palo Alto's internal workloads to Google Cloud to optimize performance and reliability.

via Google Cloud Press Corner|

#ai-infrastructure #ai-security #cloud-security

technology10 months ago•1 min saved

Tips to Prevent Cloud Account Lockouts

The article warns about the risks of being locked out of cloud storage accounts like Google, Dropbox, iCloud, and OneDrive, highlighting the importance of security measures to prevent losing access to valuable data, as illustrated by a Reddit story of a user losing 30 years of photos and work.

via WIRED|

#account-lockout #cloud-security #dropbox

business11 months ago•1 min saved

Netskope IPO Surges 18% in Market Debut

Netskope's IPO in 2025 raised over $900 million with a valuation of $7.3 billion, and its stock surged 18.4% on its first trading day, reflecting strong investor interest in cybersecurity and cloud security solutions.

via Investor's Business Daily|

#business #cloud-security #cybersecurity

technology1 year ago•3 min saved

Whistleblower Alleges DOGE Exposed Social Security Data

A whistleblower has alleged that the Department of Government Efficiency improperly stored sensitive personal data of over 300 million Americans, including Social Security numbers, on a vulnerable cloud server, violating laws and creating significant security risks, with potential for widespread identity theft and other harms.

via NBC News|

#cloud-security #data-breach #government-data

privacy-and-security1 year ago•1 min saved

Whistleblower Warns of Major Social Security Data Security Threats

A whistleblower has revealed that the Department of Government Efficiency uploaded a massive, unsecured Social Security database to the cloud, risking sensitive personal information of over 300 million Americans, raising concerns about identity theft and data security, despite official assurances of safety.

via Axios|

#cloud-security #data-breach #privacy-and-security