Do Son A flaw (CVE-2025-4679) in Synology ABM leaked a static client_secret, allowing unauthenticated attackers read-only access to all Microsoft 365 tenants with ABM installed.
Cloud Security
Trellix uncovers "OneClik," a sophisticated APT campaign abusing Microsoft ClickOnce and AWS cloud services to deploy Go-language backdoors, targeting energy, oil, and gas sectors.
Mandiant Red Team breached Aviatrix Controller via auth bypass & RCE flaws CVE-2025-2171/2172—reached root, gained AWS keys. Full chain, no guesswork.
Trend Micro reveals misconfigured Kubernetes containers in AWS EKS can expose sensitive AWS credentials via unencrypted HTTP API, leading to privilege escalation risks.
Trend Micro uncovers a new attack method using misconfigured Docker Remote APIs and the Tor network to stealthily deploy cryptominers and establish persistent access.
Apache CloudStack LTS updates patch five security flaws, including two critical vulnerabilities in Kubernetes and admin access, risking full system compromise.
A high-severity flaw (CVE-2024-43706) in Kibana's Synthetic Monitoring allows unauthorized access. Upgrade to 8.12.1 or apply mitigations immediately.
High-severity flaws in Salesforce OmniStudio's FlexCard and Data Mapper expose encrypted customer data. Learn how to protect your organization.
Cisco issues advisories for high-severity flaws (CVSS 8.8, 8.7) in IMC and NDFC, risking privilege escalation and device impersonation. Patch immediately!
CVSS 9.9 flaw in Cisco ISE cloud deployments with public PoC exploit enables remote attacks on AWS, Azure, and OCI. Patch now.
Wiz uncovers JINX-0132, a cryptojacking campaign exploiting misconfigured Nomad, Consul, Docker, and Gitea in DevOps environments to mine Monero.
Learn about new vulnerabilities in VMware Cloud Foundation that could lead to unauthorized access, info disclosure, and unapproved actions.
Bitnami Pgpool flaw (CVE-2025-22248) exposes PostgreSQL to unauthenticated access. Update to Pgpool 4.6.0-1 or Helm chart 16.0.0 to fix.
Microsoft patched critical Azure & Power Apps security flaws before exploitation. No user action needed. Stay informed on cloud security.
Commvault updates its March advisory after detecting nation-state threat activity in Azure; no data breach confirmed, advanced defenses deployed.
Tenable Research discovered "ConfusedComposer," a GCP Composer vulnerability enabling privilege escalation. Learn how attackers could exploit Cloud Build permissions.
CISA warns of potential risks from Oracle cloud credential exposure. Urges password resets, MFA, and vigilance against phishing attacks.
Subdomain takeovers are evolving into a serious supply chain threat, allowing attackers to inject malicious content.
Google introduces Unified Security, powered by Gemini AI, to streamline enterprise cybersecurity. Discover new AI security agents, enhanced threat detection, and data protection tools for comprehensive security management.
Despite Oracle's denial, evidence confirms a data breach exposing customer security keys and credentials, raising GDPR concerns.
Stay ahead of the game with cloud security automation. Explore the benefits of using automation tools to detect and respond to threats in real time.