Latest Cloud Security News

Zero-trust is based on a fundamentally different approach compared to earlier security models. The integration of advanced AI, autonomous agent systems, and the looming threat of quantum computing all require a new security approach, unlike the strategies that have worked for the past decade. AI agents are taking over routine governance, risk, and compliance tasks, forcing GRC professionals to rethink the skills needed to stay relevant. The most serious flaw lets video playlists trigger local file reads, and FFmpeg had a similar vulnerability. The flaw is rated Critical, but development ended about 20 years… A pre-authentication code execution vulnerability has been disclosed in Apache Axis 1.x, a SOAP engine for Java.

Blockchain infrastructure provider Chainstack https://master-your-business.com/what-are-the-latest-trends-in-business-strategy/ on Tuesday disclosed that it was targeted in a cyber attack that allowed an unauthorized party to gain access to some parts of its infrastructure. "The supporting attack infrastructure rotates IP addresses within hours to days." The agency said the attacks have also targeted cryptocurrency exchanges and digital asset service providers, resulting in the theft of keys and funds. Software security company Apiiro said yesterday that 1,122 public copies of that file hold at least one secret, though it did not test whether any still work. ⚡ Threat of the Week OpenSSH Flaw Sees Exploitation Attempts — Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set….

But the TEE "does not protect against a vulnerability in the software running inside the environment," the company said. That mode processes requests inside a trusted execution environment (TEE) designed to keep them private even from the company itself. Truffle Security says it found over 9000 publicly accessible and active AWS key pairs AI is amplifying the impact of vulnerabilities, long-lived credentials and other cloud risks, says Datadog He keynotes leading technology conferences on cloud computing, SOA, enterprise application integration, and enterprise architecture.

• "An external attacker gained unauthorized access to part of Chainstack's infrastructure through a third-party component," the company said .
• The Xen Project credited AI company Anthropic with finding the flaws using its Claude model.
• Blockchain analysis firm Chainalysis has revealed that its ongoing investigation into the agentic cyber attack targeting its systems also exposed names, usernames, password hashes and live tokens for all users.
• Cybersecurity researchers have disclosed details of a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq by an Iran state-aligned threat actor between August and October 2026.

Microsoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row

Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root Starting October 17, 2026, Vapor Panda is said to have used the AI tool against more than 200 distinct organizations across the world, including foreign ministries in … A client is trusted when its certificate is in the server's trust store, the list of identities the server https://ilaca.info/5-key-takeaways-on-the-road-to-dominating-13/ will accept. Attacks mounted by the group are known to rely on spear-phishing as an initial access pathway to lure recipients into opening trojanized utilities or clicking on attacker-controlled websites that host similar tools as direct downloads.

There's a lot packed into this week's news, including some strange research findings, fresh attacks, and a few warnings worth taking seriously. But each role still trusted Qubole's account, so the attacker's requests worked. How the attacker got those credentials has not been disclosed. The attacker used credentials for an AWS account that Qubole's platform uses to reach those customers. So far, the company has confirmed that the attacker downloaded account details for about 100 users…

Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory

The third trend transforming cloud security in 2026 is AI’s dual role as both an attacker force multiplier and a vital component of defense. Microsoft has made similar advances in post-quantum cryptography, collaborating with global standards bodies to develop algorithms that can withstand both classical and quantum attacks. Current encryption, especially public key cryptography, relies on hard mathematical problems that classical computers can’t solve easily. The shift from focusing solely on network security to emphasizing identity-based security is especially important in cloud settings. This approach involves constant identity verification, strict adherence to least-privilege principles, and micro-segmentation of network resources to reduce the impact of potential breaches.

Microsoft almost gave away the keys to everyone’s Azure Cosmos DBs

Dave’s industry experience includes tenures as CTO and CEO of several successful software companies, and upper-level management positions in Fortune 100 companies. Cloud SecurityCloud ComputingSecurityArtificial IntelligenceQuantum ComputingEmerging TechnologyAccess ControlIdentity and Access Management The cloud security landscape is evolving faster than most organizations realize. Quantum-safe cryptography must be implemented carefully to prevent vulnerabilities that AI-driven attacks could exploit. SentinelOne and other endpoint security platforms have used AI to detect threats that would be invisible to traditional signature-based systems. According to CrowdStrike’s 2026 Global Threat Report, AI is facilitating more advanced attacks, with more than 90 organizations reporting breaches involving legitimate AI tools used as attack channels.

• As enterprises increasingly depend on cloud services, ‘living off the land’ for attackers has evolved into ‘living off the cloud.’
• Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory
• A multi-tenant authentication gap in Microsoft’s AI operations agent exposed live command streams, internal reasoning, and credentials to any Entra ID account, researchers said.
• Attackers exploited a vulnerability scanner to steal 350GB of data that they then leaked on the dark web.
• A critical vulnerability dubbed Januscape patched in the Linux kernel-based virtualization module poses arbitrary code execution risk to multi-tenant cloud environments and virtualized enterprise servers.
• An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday.

Quarterly updates on key programs (STAR, CCM, and CAR), for users interested in trust and assurance. The latest cloud security news, trends, insights, and thought leadership from industry experts. Google Warns LLMjacking Attacks http://www.montsec.info/what-i-can-teach-you-about-14/ Are Costing Some Enterprises Up to $1 Million in Cloud Charges Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction