Cloud security · News & analysis
Gheist Turns GitHub Workflow Logs Into a Route Out for Cloud Secrets
Wiz’s new investigation shows why private repository access and cloud trust policies belong in the same incident review.
NEWS · ALERTS · RESEARCH
Cloud security
Original cybersecurity reporting and practical analysis, alongside headlines from trusted publications, agencies and researchers.
Original reporting & analysis
Cloud security · News & analysis
AWS’s Hybrid Access Guidance Makes Certificate Rotation a Service-Continuity Issue
New PKI guidance asks cloud teams to connect short-lived credentials with clear workload identities, protected keys and tested renewal procedures.
Cloud security · News & analysis
SageMaker SDK Fix Leaves Teams With a Second Job: Checking Old Logs
AWS says failed Git operations can expose repository credentials in CloudWatch Logs, making credential review part of the response.
Cloud security · News & analysis
AWS GuardDuty Guidance Puts Cloud Alert Coverage Under the Microscope
An October operational guide explains how resource context strengthens attack-sequence findings—and why teams must check the services supplying that context.
Cloud security · News & analysis
AWS SPIRE Blueprint Makes Workload Identity an Operations Decision
New AWS guidance connects machine identity to managed infrastructure, raising practical questions about recovery, ownership and permission design.
Cloud security · News & analysis
Cloud Supply-Chain Attacks Turn Build Credentials Into the Prize
Unit 42 describes how malicious dependencies and blockchain-based coordination reach beyond the infected developer machine.
Cloud security · News & analysis
AWS Schedules October 24 Test of Sovereign Cloud Independence
An October 24 independence exercise puts the difference between provider resilience and application resilience on the customer’s agenda.
Cloud security · News & analysis
A Password Reset Became a Route Into Cloud Deployment Credentials
Microsoft’s Storm-3068 case study shows why identity recovery, development pipelines and Kubernetes access need a shared incident view.
Cloud security · News & analysis
Restored GitHub Actions Expose a Hidden Risk in Build-System Recovery
Socket says previously compromised Actions became reachable again with malicious tags intact, reopening questions about trusted dependencies.
Cloud security · News & analysis
Cloud Security Reviews Need to Follow the Token, Not Just the Login
Final CISA and NIST guidance brings token issuance, validation and lifecycle controls into the same security conversation.
Headlines from our sources
197 sourced updates · Publication dates or labeled coverage weeks shown · Read full coverage at the source
Help Net Security
VikingCloud gives businesses a scorecard for AI governance readiness ↗
Industry newsHelp Net Security
Upwind secures $400 million to protect AI across endpoints, code, and cloud ↗
Industry newsRapid7 Research
How Rapid7 InsightGovCloud Supports BOD 22-01 Compliance ↗
ResearchSecurityWeek
TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices ↗
Industry newsHelp Net Security
Tailscale fixes SSH flaws allowing lateral movement within tailnets ↗
Industry newsThe Hacker News
Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass ↗
Industry newsSecurityWeek
Long-Hidden Flaws Patched in EPICS Research Facility Control Software ↗
Industry newsThe Hacker News
Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits ↗
Industry newsThe Hacker News
Japan's GMO Offers $1 Million Bounty to Catch Hackers Behind FX Trading Cloud Breach ↗
Industry newsThe Hacker News
Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers ↗
Industry newsThe Hacker News
ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws ↗
Industry newsAWS Security Blog
Introducing Route 53 Resolved IP Validation for AWS Network Firewall ↗
ResearchDataBreaches.net
Pentagon ignored cybersecurity flaws before data breach, Marines’ lawsuit says ↗
Industry newsAWS Security Blog
AWS becomes first CSP to complete the Cloud High profile assessment with 172 services and features in scope ↗
ResearchAWS Security Blog
Part 3 – Cybersecurity journeys: The work behind the work ↗
ResearchSecurityWeek
Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws ↗
Industry newsThe Hacker News
GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption ↗
Industry newsSecurityWeek
HPE Patches Dozens of Critical Flaws in Networking Products ↗
Industry newsCloudflare Blog
Introducing the Cloudflare PHP Capture the Flag challenge ↗
ResearchCloudflare Blog
What took the Internet offline in Q3 2026 ↗
ResearchSOCRadar
Wasmtime Sandbox Escape Flaws Patched in Cranelift ↗
ResearchThe Hacker News
CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution ↗
Industry newsCloudflare Blog
Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang ↗
ResearchDark Reading
'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets ↗
Industry newsChannelPro
How 6 tech vendors are helping MSPs tackle everyday challenges ↗
Industry newsInfosecurity Magazine
Linux Flaws Exposed Before Fixes as Root Exploit Goes Public ↗
Industry newsESET WeLiveSecurity
PHP2Shell: What to know about two critical PHP flaws ↗
ResearchThe Hacker News
Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes ↗
Industry newsHelp Net Security
Fortinet patches critical FortiOS flaws found with AI help ↗
Industry newsThe Hacker News