Cybersecurity articles tagged #AWS on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/cloud-security-index-2026-multi-cloud-risk-analysishttps://runtimerebel.com/blog/cloud-security-index-2026-multi-cloud-risk-analysisIntruder analyzed cloud misconfigurations across AWS, Azure, and GCP, revealing distinct risk profiles and universal IAM challenges.Mon, 07 Sep 2026 13:49:04 GMTCloud SecurityGoogle CloudIAMMisconfigurationAWShttps://runtimerebel.com/blog/hundreds-of-leaked-aws-keys-expose-corporate-cloud-accountshttps://runtimerebel.com/blog/hundreds-of-leaked-aws-keys-expose-corporate-cloud-accountsResearch reveals over 9,000 publicly exposed Amazon Web Services access keys remain active, including hundreds of root and administrator credentials.Fri, 21 Aug 2026 16:21:53 GMTAWSCredential TheftCloud SecurityIAMData Breachhttps://runtimerebel.com/blog/north-korea-attribution-data-breaches-impact-ontrac-uk-educationhttps://runtimerebel.com/blog/north-korea-attribution-data-breaches-impact-ontrac-uk-educationAWS attributes recent hacks to North Korea. OnTrac and the UK Department for Education report significant data breaches, impacting over 600,000 records.Fri, 31 Jul 2026 17:43:11 GMTNorth KoreaAPTData BreachOntracUK Department for EducationAWShttps://runtimerebel.com/blog/aws-kiro-rce-via-indirect-prompt-injection-mitigation-guidehttps://runtimerebel.com/blog/aws-kiro-rce-via-indirect-prompt-injection-mitigation-guideResearch reveals a critical flaw in AWS Kiro where malicious web pages trigger RCE by rewriting configuration files via indirect prompt injection attacks.Tue, 21 Jul 2026 17:22:23 GMTAWSKiroRCEPrompt InjectionAI Securityhttps://runtimerebel.com/blog/amazon-q-flaw-cloud-credential-theft-via-malicious-repositorieshttps://runtimerebel.com/blog/amazon-q-flaw-cloud-credential-theft-via-malicious-repositoriesAWS patches a critical Amazon Q flaw enabling cloud credential theft via malicious repositories. Understand its impact and recommended mitigations.Fri, 26 Jun 2026 16:48:25 GMTAmazon QAWSCloud SecurityCredential TheftSupply Chain AttackVulnerabilityPatchinghttps://runtimerebel.com/blog/amazon-q-developer-rce-via-cve-2026-12957-cloud-credential-thefthttps://runtimerebel.com/blog/amazon-q-developer-rce-via-cve-2026-12957-cloud-credential-theftHigh-severity CVE-2026-12957 in Amazon Q Developer allowed malicious repositories to execute arbitrary code and steal cloud credentials upon workspace trust. Patch now.Fri, 26 Jun 2026 16:47:43 GMTCVE-2026-12957Amazon Q DeveloperRCECloud SecurityAWSWizhttps://runtimerebel.com/blog/kali365-phishing-as-a-service-expands-to-target-aws-and-oktahttps://runtimerebel.com/blog/kali365-phishing-as-a-service-expands-to-target-aws-and-oktaThe FBI-flagged Kali365 phishing kit now targets AWS and Okta via device code phishing, bypassing multi-factor authentication for cloud enterprise accounts.Wed, 03 Jun 2026 05:44:29 GMTKali365Phishing as a ServiceMFA BypassCloud SecurityAWSOktahttps://runtimerebel.com/blog/securing-identity-attack-paths-protecting-cached-aws-credentialshttps://runtimerebel.com/blog/securing-identity-attack-paths-protecting-cached-aws-credentialsAttackers exploit cached AWS access keys to achieve lateral movement. Learn how identity-based attack paths expose 98% of cloud entities and how to defend.Thu, 21 May 2026 13:17:05 GMTAWSIdentity SecurityCloud SecurityLateral MovementIAMhttps://runtimerebel.com/blog/apt41-deploys-stealth-backdoor-for-cloud-credential-harvestinghttps://runtimerebel.com/blog/apt41-deploys-stealth-backdoor-for-cloud-credential-harvestingChina-linked APT41 is targeting AWS, Azure, and Google Cloud with a new zero-detection backdoor designed to harvest credentials and maintain persistence.Mon, 13 Apr 2026 16:35:11 GMTAPT41Cloud SecurityCredential HarvestingAWSAzureBackdoorhttps://runtimerebel.com/blog/ec-investigates-breach-after-intelbroker-claims-aws-account-hackhttps://runtimerebel.com/blog/ec-investigates-breach-after-intelbroker-claims-aws-account-hackThe European Commission is investigating a security breach of its AWS infrastructure after threat actor IntelBroker claimed to have stolen user database records.Fri, 27 Mar 2026 16:24:50 GMTEuropean CommissionIntelBrokerAWSIdentity Access ManagementData Breachhttps://runtimerebel.com/blog/chrome-zero-days-and-router-botnets-weekly-threat-intel-recaphttps://runtimerebel.com/blog/chrome-zero-days-and-router-botnets-weekly-threat-intel-recapAnalysis of the latest Chrome zero-day vulnerabilities, router botnet infrastructure risks, and AWS cloud security breaches from March 2026.Mon, 16 Mar 2026 16:28:15 GMTChromeBotnetsAWSZero-DayAI Securityhttps://runtimerebel.com/blog/aws-honeytoken-implementation-proactive-detection-of-iam-credential-thefthttps://runtimerebel.com/blog/aws-honeytoken-implementation-proactive-detection-of-iam-credential-theftLearn how to implement AWS honeytokens using IAM and CloudTrail to detect unauthorized credential usage and mitigate lateral movement in cloud environments.Mon, 09 Mar 2026 04:41:00 GMTAWSHoneytokensIAMCloudTrailDetection Engineeringhttps://runtimerebel.com/blog/geopolitical-strikes-on-aws-data-centers-mitigating-physical-disaster-riskhttps://runtimerebel.com/blog/geopolitical-strikes-on-aws-data-centers-mitigating-physical-disaster-riskIranian drone strikes damaged AWS data centers in UAE and Bahrain, highlighting critical vulnerabilities to physical disasters and the urgent need for geo-redundancy.Tue, 03 Mar 2026 20:12:52 GMTAWSData CenterPhysical AttackIranCloud SecurityDisaster RecoveryGeopolitical Threathttps://runtimerebel.com/blog/automated-ai-driven-exploitation-of-fortigate-management-interfaces-in-aws-environmentshttps://runtimerebel.com/blog/automated-ai-driven-exploitation-of-fortigate-management-interfaces-in-aws-environmentsThreat actors are utilizing artificial intelligence to automate credential stuffing and exploit exposed administrative ports on Fortinet devices within AWS…Mon, 23 Feb 2026 12:21:29 GMTFortiGateAWSCredential StuffingAINetwork Security