Cloud security Latest News, Reports & Analysis

Malicious code turned up in developer packages and extensions that looked harmless. The rest of the week isn’t much more reassuring. Apparently, keeping things secure is a problem on both sides of the fence. The crooks have trust problems of their own. The activity impacted 817 repositories across 327 GitHu…

• For software with deterministic execution paths, that is a tractable problem.
• A new endpoint threat leads to a new detection tool, a new identity attack brings another monitoring system, while a new SaaS risk adds another source of alerts.
• Hackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia, the FBI and agencies in 6 other countries said on October 8.
• Check your expanding identity attack surface Identity has become the new perimeter, and attackers know it.

AI coding agents are already inside engineering organizations. A practitioner’s guide to log visibility, incident readiness, and threat hunting across the major version control services. How default keys, unauthenticated MCP sessions, and custom code guardrails expose cloud AI infrastructure to root-level remote code execution and IAM theft. Wiz Research analyzes NordStellar data to map the credentials targeted by infostealer families and assess their potential impact across cloud, code, and AI environments. Find, validate, https://www.montsec.info/what-i-can-teach-you-about-14/ and fix complex business logic flaws with an AI code scanner backed by Wiz Research, operationalized within your existing security program. DDrop is a low-cost physical hardware attack that can alter memory-write operations in confidential-computing servers while data remains encrypted.

Non-human identities (NHIs) — service accounts, API keys, OAuth tokens, SSH keys, RPA bots, cloud workload credentials and AI agents — are the fastest-growing, least-governed attack surface in the modern enterprise. If the credential is valid, the attacker can simply use it, and the session will look like ordinary activity. An agent does not follow a fixed code path.

How can I contribute or suggest content for the newsletter?

• Inside the multi-agent pipeline and feedback loops that turned a bucket scanner into a context engine.
• A Marketplace With No Bouncer In 2012, Google ran Bouncer, an automated scanner that checked Android apps for malware before they reached users.
• According to new research from CrowdStrike, 80% of modern cyberattacks are identity-driven , leveraging compromised credentials.
• The rest of the week isn’t much more reassuring.

Identity sprawl across cloud and SaaS environments has grown past what manual reviews can realistically handle, service accounts and non-human identi… Most identity governance and administration (IGA) programs still run on manual certifications, static role models, and quarterly reviews that go stale the day someone signs off on them. Thus, comparing the first half of 2026 to the same period in 2025 shows that AI-related incidents in development environments have nearly tripled. In 2025, there were 68 AI-related incidents recorded across major DevOps platforms according to the 2026 DevOps Threats Unwrapped Report . They are participating in the agent’s decision loop.

Scan for Good: Using AI to discover and fix high-priority exposures across public services and critical infrastructure

The server can be reached from another machine only when an operator sets it to listen on a routable address, rather than the localhost it uses by default. The stealer malware is designed to harvest credentials across local files, CI environments, Kubernetes, and Vault sources. It describes the hacking in the present tense but provides no date for any theft and does not specify how many organizations were breached.

Hackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia, the FBI and agencies in 6 other countries said on October 8. The U.S. Federal Bureau of Investigation (FBI) and Department of Justice (DoJ) have announced the disruption of malicious tools used by a China-linked advanced persistent threat group known as Flax Typhoon. A Market Stalled at the Starting Line Despite years of investment in identity and access management, the market’s overall security maturity has hit a wall. ⚡ Threat of the Week Atlassian Flaw Exploited in the Wild — Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian… This week’s full recap is worth a read, especially the bits that didn’t make the big headlines.

Security teams face https://unisto-petrostal.ru/en/obzor-sed-iz-tatarstana-sistema-praktika-ili-svyazi.html an uphill battle in understanding the tools already inside their environment, their capabilities, and their risks. It may cause protected virtual machines to use stale or manipulated data and can affect Intel and AMD platforms, including some attestation mechanisms. In some cases, it can even undermine the mechanisms used to prove that a virtual machine is secure and trustworthy. By exploiting this weakness, an attacker could cause a protected virtual machine to continue using older, manipulated data without realizing anything is wrong.

Wiz Research telemetry reveals why the majority of high-severity findings lack a path to compromise Attackers are chaining these vulnerabilities to bypass authentication and gain administrative control. Analyzing model input and output logs in an AI-native detection pipeline to understand and uncover malicious AI agent behavior Eliminate hidden CI/CD risks and unmaintained dependencies with hardened, signed, and CVE-scanned charts for seamless Kubernetes deployment.

“Antino is a Rust-compiled Windows backdoor that supports host reconnaissance, shell and PowerShell execution, file transfer, in-memory shellcode loading and persistence,” security https://theasu.ca/blog/is-learning-ai-worth-it-a-comprehensive-guide-to-mastering-artificial-intelligence-and-its-endless-possibilities researcher Ashley Shen said . Since then, attacks linked to the intrusion set have expanded to target 16 entities across eight Asian countries. The threat actor was first detected in September 2025 in connection with a spear-phishing campaign directed against Taiwan’s academic, think tank, and civil society policy community. Some attacks are getting more capable. There are actively exploited bugs in the mix, cleaner intrusion paths, smarter automation, and a long patch list waiting behind them.

What to Look for in an Insider Risk Management Platform

It executed in the user’s own context, with the user’s own permissions, as a deliberate action the user performed with their own hands. The instructions told the user to press Windows+R, paste what had already been copied to their clipboard, and hit Enter. $4.88M Global average cost of a data breach — IBM Cost of a Data Breach 2024 The scope of the problem The numbers are striking. But for most enterprises, the greater risk has already shifted. Services trust other services built across years of acquisitions, migrations, technical debt, and operational compromise.

• Transform point-in-time pen-tests into continuous exposure management with unified platform combining pen-test findings and real-time cloud context
• There’s more going on here than a few bad bugs and clever attacks.
• The researchers found that DDRop can affect confidential computing technologies on both Intel and AMD platforms.
• What makes these attacks uncomfortable is not just their sophistication, but also that they are cheap, rented, and specifically engineered to produce a sign-in event that looks ordinary.
• The findings highlight the importance of strengthening hardware security protections as organizations increasingly rely on cloud-based services to process and store sensitive information.

An agent can read context, choose tools, query systems, revise its plan, and take a path nobody explicitly programmed. They can hide commands in public infrastructure, reuse old flaws, abuse weak defaults, or let automation stitch together a rough path that still works. Dell has released security updates to address multiple critical security flaws in Dell Container Storage Modules (CSM) that could be exploited by bad actors to take over susceptible systems. As organizations manage more identities, devices, data, and internet-facing infrastructure, security is shifting toward continuous visibility, control, and the ability to respond to risk at scale. Two of 31 newly disclosed flaws in Progress Software’s MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says. A flaw in SAP’s Cloud SDK for Python can send an application’s OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13.