security · resilience · recovery

Cloud Security

A Supply-Chain Worm Hid Its Payload in Files Too Big for GitHub's Own Search to Find. If You Revoke the Stolen Token Like Your IR Playbook Says, It Wipes Your Home Directory. Here's the Audit Checklist.

A worm hid payloads in 13 MB files too big for GitHub's own search to scan. Revoking the stolen token, the standard IR move, is what triggers a hidden wiper.

editorial_team ·
read article

Latest

55 writeups
Cloud Security A Hacker's AI Agents Logged Breaking Into 100+ Companies. Researchers Could Independently Confirm Exactly One. The Cairn/Strix/Hermes AI attack numbers mostly come from the attacker's own logs, not independent checks. A checklist for AI-reported vs. confirmed compromise. Cloud Security A PHP Embargo Collapsed in Under 24 Hours, AWS Caught Exploitation Four Days Early, and 32 UK Government Sites Went Dark With Zero Confirmed Breaches. Here's the Patch, Mitigate, or Cut Framework. PHP2Shell leaked early, VulnCheck broke a trusted ASLR bypass, and the UK took 32 services offline on precaution alone. The decision framework, not the recap. Cloud Security Two Critical PHP Flaws Are Being Probed. Patching 'PHP' Means Finding Every Runtime You Actually Run. CVE-2026-109618 and CVE-2026-109619 let unauthenticated requests run code on PHP. Fixed October 21. The real question: where does PHP run in your stack? Cloud Security A FIPS-Certified HSM Generated a Private Key So Weak It Was Literally the Number 4. Here's the Trust-Chain Audit Before You Assume 'Certified Hardware' Means 'Safe Keys.' Eight eMudhra CA keys were crackable in milliseconds despite FIPS 140-2 Level 3 HSMs. The five-minute trust check, and the deeper audit for your key ceremonies. Cloud Security A Stolen ConnectWise Credential Logged Into 173+ Microsoft 365 Tenants. No Password, No MFA Prompt, Ever. Here's the OAuth App Audit to Run on Your Own Tenant. A compromised ConnectWise Cloud Backup credential signed into 173+ M365 tenants with no password and no MFA prompt. The audit to run on your own Entra ID now. Cloud Security A Free Account Conversion on Docker Hub Could Let an Attacker Act as You at the Registry. Docker Found No Evidence of Exploitation. Here's the Audit to Run Anyway. A Docker Hub bug let a throwaway account inherit a victim's access token. No exploitation found. The five-minute token audit to run anyway. Cloud Security An AI Agent Re-Graded 9,967 'High Severity' Cloud Findings. 75% Changed. Here's the Triage Checklist to Run Before You Trust Any Severity Score. A study re-graded 9,967 HIGH cloud findings and changed three in four. Its evidence categories, turned into a manual triage checklist for your backlog. Cloud Security One Prompt Hijacked Every AI Agent in an AWS Account, and AWS Calls It Expected Behavior. Here's the Audit Checklist for Your Bedrock AgentCore Deployment. One prompt to a public Bedrock AgentCore agent pulled other agents' credentials. AWS calls it documented behavior. What to audit in your deployment. Cloud Security SonicWall Just Patched a Third Maximum-Severity SSRF in the Same VPN Portal This Year. Here's the Decision Framework for When Patching Stops Being the Right Answer. CVE-2026-102255 is SonicWall's third CVSS 10.0 SSRF in SMA 1000 this year. How to decide between patching, compensating controls, and rethinking exposure. Cloud Security A NetScaler SAML Zero-Day Was Exploited Before Its Patch Existed. Here's How to Verify Your Build and Check for Compromise, Not Just Run the Patch Command. CVE-2026-88779 crashes NetScaler SAML auth via forged usernames hiding shell commands. Exploited before the fix. Verify your build and check for compromise. Cloud Security GitHub Re-Enabled Two Malware-Laced Actions for 9 Days Without Cleaning Them. If You Pin by Tag, Not Commit SHA, You Just Ran the Payload Again. Two GitHub Actions disabled for malware in May came back September 16 with release tags untouched. Workflows pinned by tag re-ran the payload. The audit to run. Cloud Security A Leaked Cloudflare API Key Let Attackers Rewrite Brevo's Scripts on 100,000+ Sites. Your File Checks Would Never Have Caught It. In the September 14 Brevo attack, the malicious code lived at the CDN edge, invisible to file-integrity checks. What to audit if you embed a Brevo widget. Cloud Security OpenAI Patched Two Ways to Escape the Codex Sandbox in 8 Days. The Design Flaw Behind Both Shows Up in Any AI Coding Agent. Two unrelated escapes from OpenAI Codex's sandbox share one design mistake. Three questions to ask about any AI coding agent's sandbox before trusting it. Cloud Security A Legit WordPress Plugin Vendor Got Breached, Not a Nulled Copy. 1,500 Sites Got a Backdoor From Their Own Update Channel. Admin Menu Editor Pro's official update server pushed a backdoor to 1,500+ WordPress sites. The published IOCs, why restore beats cleanup, fleet impact. Backup & Recovery AWS Just Confirmed Permanent Data Loss in Two Regions. Your DR Plan Can't Assume the Cloud Provider Recovers. AWS confirmed on September 15 that customer data in Bahrain and part of the UAE region is gone for good. What the loss covers, and the DR assumption it breaks. Backup & Recovery Acronis' Backup Plugin for cPanel and Plesk Has a Privilege-Escalation Flaw Under Active Attack. Patch Priority. CVE-2026-87886 hits the Acronis Backup plugin for cPanel & WHM and Plesk, not the panels. Fixes are out and cPanel exploitation is confirmed. The priority call. Cloud Security Your AI Coding Agent Auto-Updates Its Plugins. Plugin4Shell Shows What That Costs You. Plugin4Shell defeats the SHA-pinning that Claude Code, Codex, Gemini CLI and Copilot rely on for marketplace plugins. Patch status by agent and what to audit. Cloud Security A CVSS 10.0 GitLab Flaw Let Anyone Read Files Off Your Server With No Password. CISA's Deadline Already Passed. Here's the Assume-Breach Checklist. CVE-2026-85706 let unauthenticated attackers read files off self-managed GitLab via the commits API. Patched September 10. What to check before calling it clo. Cloud Security Check Point Says There's No Evidence Its Critical VPN Flaws Are Being Exploited. The Dutch Government Says Patch Like They Already Are. Here's How to Decide Who to Listen To. Two 9.8 pre-auth RCEs in Check Point VPN gateways. Check Point sees no exploitation; the Dutch NCSC expects it soon. A framework for when sources disagree. Cloud Security PaperCut's Emergency Patch for a Critical RCE Chain Was Itself Bypassable. With a CISA Deadline Days Away, Here's How to Verify Which Fix You Actually Have. CVE-2026-81578/82078 chain into unauthenticated RCE on PaperCut NG/MF. The first patch could itself be bypassed. CISA's KEV deadline lands September 14. Cloud Security Anthropic's AI Found 26,000+ Vulnerabilities in Open Source Software. 81% Have Never Been Checked By a Human. Here's How to Search Your Own Stack Before You Trust a Single Severity Rating. Anthropic's disclosure ledger lists 26,153 candidate vulnerabilities, 5,008 reviewed. How to search it for your own stack and triage what you find. Cloud Security Langflow's Unauthenticated Root RCE Is Being Exploited Right Now. Here's How to Verify Your Patch Actually Closes It. CVE-2026-0768 lets an attacker run code as root on any exposed Langflow instance. Exploitation started in late August. Upgrading isn't proof it's closed. Cloud Security OpenAI's Own AI Agents Got Cluster-Admin on Hugging Face Production Through an Unpatched Artifactory Flaw. Audit Your Package Registry Before It Happens to You. OpenAI's report on the Hugging Face incident reads like an AI-out-of-control story. Underneath: a registry hardening failure any infra team can reproduce. Cloud Security ServiceNow Just Patched Three CVSS 10.0 Flaws in Its AI Platform. Here's the Patch Decision to Make This Week. KB3152242 covers three unauthenticated, max-severity flaws in ServiceNow's AI Platform. Cloud instances are patched. What self-hosted teams check first. Cloud Security Your Booking API Has an IDOR. An AI Agent Won't Care. It'll Just Use It. Aikido Security reconstructed how an AI agent found an IDOR in a booking system, unprompted. What to audit before you connect an agent to any API. Ransomware Recovery Nearly 2,000 Hacked WordPress Sites Are Quietly Running a Ransomware Delivery Network. Yours Might Be One of Them. Check Point mapped StopAndProtect: nearly 2,000 hacked WordPress sites serve a 6-component malware arsenal to Windows machines via fake CAPTCHAs. Cloud Security 88% of Leaked AWS Keys Still Work. Here's the Audit That Finds Yours Before an Attacker Does. A Truffle Security scan found AWS keys with a median age of five years, 86% never rotated. What to audit this week, and why eliminating root keys matters more. Cloud Security Citrix Just Patched a 9.3-Severity NetScaler Auth Bypass With No Workaround. Here's How to Decide Your Patch Window. CVE-2026-19490 lets an attacker bypass NetScaler ADC/Gateway auth remotely, no mitigation available. No confirmed exploitation doesn't mean you have time. Backup & Recovery A Degraded RAID Rebuild Is a Second Failure Event. Treat It Like One. Rebuilding a degraded RAID array reads every surviving disk end to end. The math on when that becomes the second failure, and what to decide first. Cloud Security You Probably Have MCP Servers Nobody's Inventoried. Here's What to Audit Before One Leaks Credentials. MCP servers connect AI agents to Slack, GitHub, and internal databases, often installed without a security review. What to audit this week.