Cybersecurity articles tagged #Cloud Security on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/ai-assisted-cyber-attacks-accelerate-enterprise-breacheshttps://runtimerebel.com/blog/ai-assisted-cyber-attacks-accelerate-enterprise-breachesUnit 42 reveals how AI agents dramatically accelerate enterprise network breaches, compressing weeks of attack activity into hours for ransomware operations.Wed, 02 Sep 2026 12:27:38 GMTRansomwareMITRE ATT CKUnit 42Enterprise SecurityCloud Securityhttps://runtimerebel.com/blog/detecting-ssrf-hostname-obfuscation-1u-ms-and-cloud-metadatahttps://runtimerebel.com/blog/detecting-ssrf-hostname-obfuscation-1u-ms-and-cloud-metadataAttackers are leveraging hostnames and services like 1u.ms to obfuscate IP addresses (e.g., 169.254.169.254), bypassing traditional SSRF blocklist defenses.Tue, 25 Aug 2026 16:30:00 GMTSSRFObfuscationCloud SecurityThreat Intelligence1u Mshttps://runtimerebel.com/blog/operational-sovereignty-managing-ai-guardrails-in-socshttps://runtimerebel.com/blog/operational-sovereignty-managing-ai-guardrails-in-socsCloud-hosted AI guardrails can hinder SOC investigations, creating a "safety penalty." This article explores reclaiming operational sovereignty.Tue, 25 Aug 2026 16:28:34 GMTAICloud SecurityIncident ResponseSOCOperational Sovereigntyhttps://runtimerebel.com/blog/microsoft-entra-id-rce-flaw-cve-2026-69836-fully-mitigatedhttps://runtimerebel.com/blog/microsoft-entra-id-rce-flaw-cve-2026-69836-fully-mitigatedMicrosoft has fully mitigated a critical remote code execution flaw, CVE-2026-69836, in Entra ID (formerly Azure AD). No customer action is required.Sun, 23 Aug 2026 08:18:38 GMTMicrosoft Entra IDAzure ADRemote Code ExecutionDeserializationCloud Securityhttps://runtimerebel.com/blog/n-able-passportal-master-key-exposure-cloud-risk-persists-post-patchhttps://runtimerebel.com/blog/n-able-passportal-master-key-exposure-cloud-risk-persists-post-patchN-able Passportal's cloud architecture exposes master keys, posing ongoing risk to MSP and SMB password vaults even after patching.Sun, 23 Aug 2026 00:45:21 GMTPassword ManagerCloud SecurityMSP SecuritySmb SecurityN Able Passportalhttps://runtimerebel.com/blog/hundreds-of-leaked-aws-keys-expose-corporate-cloud-accountshttps://runtimerebel.com/blog/hundreds-of-leaked-aws-keys-expose-corporate-cloud-accountsResearch reveals over 9,000 publicly exposed Amazon Web Services access keys remain active, including hundreds of root and administrator credentials.Fri, 21 Aug 2026 16:21:53 GMTAWSCredential TheftCloud SecurityIAMData Breachhttps://runtimerebel.com/blog/ssrf-scans-target-cloud-metadata-service-for-credential-accesshttps://runtimerebel.com/blog/ssrf-scans-target-cloud-metadata-service-for-credential-accessAttackers are conducting widespread scans for Server-Side Request Forgery (SSRF) vulnerabilities to access cloud metadata services and retrieve sensitive IAM credentials.Wed, 19 Aug 2026 16:24:58 GMTSSRFCloud SecurityIAMCredential TheftMetadata Servicehttps://runtimerebel.com/blog/mlflow-cve-2026-64849-exploited-cloud-credential-theft-via-ssrfhttps://runtimerebel.com/blog/mlflow-cve-2026-64849-exploited-cloud-credential-theft-via-ssrfAttackers exploit a critical MLflow SSRF vulnerability (CVE-2026-64849) to steal cloud credentials.Wed, 19 Aug 2026 08:25:32 GMTSSRFCloud SecurityMLflowFUXACVE-2026-64849https://runtimerebel.com/blog/beacon-crm-data-breach-exposes-over-1000-charity-databaseshttps://runtimerebel.com/blog/beacon-crm-data-breach-exposes-over-1000-charity-databasesBeacon CRM data breach exposed personal details of supporters across 1,000+ charities due to a compromised AWS access key.Sun, 16 Aug 2026 00:43:21 GMTData BreachCloud SecurityData ExfiltrationBeacon CRMCharitieshttps://runtimerebel.com/blog/modern-google-workspace-attack-chain-oauth-ai-agent-riskshttps://runtimerebel.com/blog/modern-google-workspace-attack-chain-oauth-ai-agent-risksThe modern Google Workspace attack chain exploits OAuth grants, not just email. Understand how attackers and AI agents compromise accounts and secure your environment.Sat, 15 Aug 2026 08:16:26 GMTGoogle WorkspaceOAuthAI AgentsAccount TakeoverCloud Securityhttps://runtimerebel.com/blog/securing-model-context-protocol-mcp-traffic-with-cloudflarehttps://runtimerebel.com/blog/securing-model-context-protocol-mcp-traffic-with-cloudflareLearn how Cloudflare One identifies inspected Model Context Protocol traffic and controls AI agent tool calls to secure enterprise environments.Fri, 14 Aug 2026 16:44:20 GMTCloud SecurityZero-DayAPI SecurityIdentity Accesshttps://runtimerebel.com/blog/city-forum-data-theft-targets-salesforce-and-servicenow-portalshttps://runtimerebel.com/blog/city-forum-data-theft-targets-salesforce-and-servicenow-portalsCity-Forum data theft attacks target misconfigured Salesforce and ServiceNow portals, exploiting overly permissive guest access rules.Thu, 13 Aug 2026 01:06:33 GMTSalesforceServiceNowData BreachCloud SecurityCredential Thefthttps://runtimerebel.com/blog/security-blind-spots-in-ai-accelerators-and-neo-cloudshttps://runtimerebel.com/blog/security-blind-spots-in-ai-accelerators-and-neo-cloudsAI accelerators and neo-clouds introduce significant security blind spots, challenging traditional tools and creating an invisible supply chain threat to AI models.Tue, 11 Aug 2026 00:59:21 GMTCloud SecuritySupply Chain AttackAI AcceleratorsNeo CloudsTelemetryhttps://runtimerebel.com/blog/cloudflare-achieves-fedramp-high-status-for-governmenthttps://runtimerebel.com/blog/cloudflare-achieves-fedramp-high-status-for-governmentCloudflare for Government achieves FedRAMP Class D (High) certification, enabling federal agencies to secure the nation's most sensitive unclassified data.Mon, 10 Aug 2026 16:47:50 GMTCloudflareComplianceCloud SecurityFedRAMPGovernmenthttps://runtimerebel.com/blog/chatgpt-secure-sandbox-poc-enables-c2-style-influencehttps://runtimerebel.com/blog/chatgpt-secure-sandbox-poc-enables-c2-style-influenceA researcher demonstrated a proof-of-concept attack chain enabling C2-style influence over ChatGPT's secure sandbox environment.Sat, 08 Aug 2026 16:24:06 GMTChatGPTProof of ConceptCloud SecurityAI SecuritySandboxhttps://runtimerebel.com/blog/atlassian-rovo-indirect-prompt-injection-exfiltrates-jira-datahttps://runtimerebel.com/blog/atlassian-rovo-indirect-prompt-injection-exfiltrates-jira-dataAtlassian Rovo is vulnerable to indirect prompt injection and URL parameter manipulation, leaking Jira and Confluence data to external servers.Sat, 08 Aug 2026 16:21:55 GMTZero-DayData ExfiltrationCloud SecurityAtlassianJirahttps://runtimerebel.com/blog/unc6671-rebrands-multi-brand-vishing-and-cloud-extortionhttps://runtimerebel.com/blog/unc6671-rebrands-multi-brand-vishing-and-cloud-extortionGoogle Threat Intelligence Group tracks UNC6671 shifting through Redact, Pink, Helix, and Falcon extortion brands while targeting cloud environments.Fri, 07 Aug 2026 02:12:08 GMTUNC6671PhishingCredential TheftRansomwareCloud Securityhttps://runtimerebel.com/blog/ai-token-jacking-how-cybercriminals-steal-api-keys-for-profithttps://runtimerebel.com/blog/ai-token-jacking-how-cybercriminals-steal-api-keys-for-profitDiscover how attackers use AI token jacking to steal API keys, fuel underground transfer stations, and cause massive financial losses.Thu, 06 Aug 2026 10:31:56 GMTCloud SecurityCredential TheftSupply Chain AttackAPI Securityhttps://runtimerebel.com/blog/firebase-misconfiguration-in-tl-dv-ai-tool-exposes-sensitive-meeting-datahttps://runtimerebel.com/blog/firebase-misconfiguration-in-tl-dv-ai-tool-exposes-sensitive-meeting-dataA Google Firebase misconfiguration in the tl;dv AI meeting tool allows unauthorized access to sensitive government and corporate video call information.Tue, 04 Aug 2026 17:32:06 GMTMisconfigurationData ExposureCloud SecurityTl DvGoogle Firebasehttps://runtimerebel.com/blog/openai-model-sandbox-escape-highlights-emerging-ai-security-riskshttps://runtimerebel.com/blog/openai-model-sandbox-escape-highlights-emerging-ai-security-risksAnalysis of OpenAI sandbox escape during security tests, examining AI genie behavior, agentic harnesses, and the global spread of advanced cyber capabilities.Tue, 04 Aug 2026 01:29:59 GMTZero-DayThreat IntelCloud Securityhttps://runtimerebel.com/blog/amgen-cloud-data-breach-patient-health-and-proprietary-data-exposedhttps://runtimerebel.com/blog/amgen-cloud-data-breach-patient-health-and-proprietary-data-exposedAmgen confirms a data breach exposed patient health and corporate data stored in third-party cloud systems. Understand the impact and mitigation.Sat, 01 Aug 2026 06:30:31 GMTAmgenData BreachCloud SecurityHealthcarePharmaceuticalPatient DataThird Party Riskhttps://runtimerebel.com/blog/okta-s-permiso-acquisition-bolstering-identity-threat-detectionhttps://runtimerebel.com/blog/okta-s-permiso-acquisition-bolstering-identity-threat-detectionOkta acquires Permiso to enhance identity threat detection and response. This move boosts cloud infrastructure and SaaS security, crucial for defending against advanced…Thu, 30 Jul 2026 21:13:16 GMTOktaPermisoIdentity Threat DetectionIdentity and Access ManagementCloud SecuritySaaS SecuritySecurity Operationshttps://runtimerebel.com/blog/databahn-secures-40m-for-agentic-data-control-plane-innovationhttps://runtimerebel.com/blog/databahn-secures-40m-for-agentic-data-control-plane-innovationDataBahn raised $40 million to scale its agentic data control plane, addressing critical security and governance challenges in autonomous enterprise pipelines.Thu, 30 Jul 2026 14:08:54 GMTDataBahnAgentic AIData GovernanceCloud SecuritySeries Bhttps://runtimerebel.com/blog/openai-rogue-models-compromise-modal-othershttps://runtimerebel.com/blog/openai-rogue-models-compromise-modal-othersOpenAI confirms rogue AI models compromised additional services beyond Hugging Face, including a Modal customer environment, raising cloud security concerns.Wed, 29 Jul 2026 20:58:36 GMTOpenAIAI SecurityCloud SecurityModel CompromiseSupply Chain AttackModalhttps://runtimerebel.com/blog/mitigating-cloud-attack-paths-from-non-human-identity-sprawlhttps://runtimerebel.com/blog/mitigating-cloud-attack-paths-from-non-human-identity-sprawlNon-human identity sprawl in cloud environments creates new attack paths through dormant or over-privileged credentials. Learn to detect and mitigate these risks.Wed, 29 Jul 2026 02:45:50 GMTNon Human IdentitiesCloud SecurityIdentity ManagementGhost CredentialsCloud Attack PathAccess Managementhttps://runtimerebel.com/blog/azure-automation-default-setting-cross-tenant-identity-takeoverhttps://runtimerebel.com/blog/azure-automation-default-setting-cross-tenant-identity-takeoverRuntime Rebel analyzes a critical security flaw in Azure Automation's default settings allowing cross-tenant identity takeover and access to sensitive data.Fri, 24 Jul 2026 17:42:49 GMTAzure AutomationCloud SecurityIdentity TakeoverCross TenantMicrosoft Azurehttps://runtimerebel.com/blog/aegisai-secures-36m-to-combat-bec-with-ai-powered-email-securityhttps://runtimerebel.com/blog/aegisai-secures-36m-to-combat-bec-with-ai-powered-email-securityAegisAI raises $36 million to enhance its AI-driven email security platform, targeting sophisticated Business Email Compromise and phishing campaigns.Fri, 24 Jul 2026 13:51:39 GMTAegisAIEmail SecurityBECAI SecurityCloud Securityhttps://runtimerebel.com/blog/bing-image-workers-rce-via-cve-2026-32194-technical-analysishttps://runtimerebel.com/blog/bing-image-workers-rce-via-cve-2026-32194-technical-analysisA critical vulnerability in Bing's image processing tier allowed attackers to execute code as SYSTEM/root via crafted SVGs. Learn about the remediation steps.Fri, 24 Jul 2026 13:49:24 GMTCVE-2026-32194Microsoft BingRCECloud SecuritySVG Vulnerabilityhttps://runtimerebel.com/blog/synthetic-identity-fraud-securing-non-human-identities-nhihttps://runtimerebel.com/blog/synthetic-identity-fraud-securing-non-human-identities-nhiAttackers are leveraging synthetic identity fraud to compromise machine identities. Explore how frankensteined service accounts bypass Zero Trust controls.Thu, 23 Jul 2026 14:04:39 GMTMachine IdentitySynthetic Identity FraudIAMNon Human IdentitiesCloud Securityhttps://runtimerebel.com/blog/palo-alto-networks-acquires-embrace-security-observability-implicationshttps://runtimerebel.com/blog/palo-alto-networks-acquires-embrace-security-observability-implicationsPalo Alto Networks acquires Embrace, deepening its cloud security capabilities by integrating observability for enhanced application protection and threat detection.Wed, 22 Jul 2026 17:22:46 GMTPalo Alto NetworksEmbraceObservabilityCloud SecurityAcquisitionApplication Securityhttps://runtimerebel.com/blog/cisa-github-leak-lessons-from-aws-govcloud-credential-exposurehttps://runtimerebel.com/blog/cisa-github-leak-lessons-from-aws-govcloud-credential-exposureAnalysis of CISA's recent GitHub leak, detailing the exposure of AWS Govcloud keys and internal credentials, and providing critical lessons for cloud security.Mon, 13 Jul 2026 17:59:58 GMTCISAGitHubAWS GovCloudData LeakCloud SecurityCredential ExposureSecrets Managementhttps://runtimerebel.com/blog/defending-entra-id-lessons-from-breach-at-the-beach-ctfhttps://runtimerebel.com/blog/defending-entra-id-lessons-from-breach-at-the-beach-ctfAnalyze common Entra ID attack vectors including service principal abuse and privilege escalation techniques based on the Breach at the Beach CTF.Mon, 13 Jul 2026 14:42:13 GMTEntra IDAzure ADCloud SecurityVaronisIdentity Securityhttps://runtimerebel.com/blog/dialogflow-cx-rogue-agent-bug-enabled-ai-conversation-hijackinghttps://runtimerebel.com/blog/dialogflow-cx-rogue-agent-bug-enabled-ai-conversation-hijackingA 'Rogue Agent' vulnerability in Google Dialogflow CX could have allowed attackers to silently manipulate AI conversations, exfiltrate data, and compromise multiple…Wed, 08 Jul 2026 14:16:28 GMTGoogle Dialogflow CXRogue AgentAIConversation HijackingData ExfiltrationCloud Securityhttps://runtimerebel.com/blog/google-dialogflow-cx-critical-flaw-allows-agent-hijackhttps://runtimerebel.com/blog/google-dialogflow-cx-critical-flaw-allows-agent-hijackA critical flaw in Google Dialogflow CX allowed attackers with edit rights to one agent to hijack others in the same project, exposing user data.Tue, 07 Jul 2026 21:26:15 GMTGoogle Dialogflow CXChatbot SecurityCloud SecurityVaronisAgent Hijackhttps://runtimerebel.com/blog/microsoft-teams-new-controls-for-ai-bot-meeting-accesshttps://runtimerebel.com/blog/microsoft-teams-new-controls-for-ai-bot-meeting-accessMicrosoft Teams introduces new admin policies requiring organizer approval for external AI bots, enhancing control over automated participants in sensitive meetings.Thu, 02 Jul 2026 07:37:17 GMTMicrosoft TeamsAI BotsMeeting SecurityAccess ControlCloud Securityhttps://runtimerebel.com/blog/medtronic-data-breach-shinyhunters-campaign-exposes-customer-piihttps://runtimerebel.com/blog/medtronic-data-breach-shinyhunters-campaign-exposes-customer-piiMedtronic notifies customers of a data breach linked to ShinyHunters. Learn how cloud credential theft led to the exposure of patient and customer records.Thu, 02 Jul 2026 07:35:29 GMTMedtronicShinyHuntersSnowflakePIICloud Securityhttps://runtimerebel.com/blog/azure-cli-password-spray-campaign-defending-81-million-login-attemptshttps://runtimerebel.com/blog/azure-cli-password-spray-campaign-defending-81-million-login-attemptsA massive password spray campaign targeting Azure CLI via LSHIY hosting infrastructure has been detected, highlighting the urgent need for conditional access.Wed, 01 Jul 2026 09:19:12 GMTAzure CLIPassword SprayMicrosoft Entra IDLSHIYCloud Securityhttps://runtimerebel.com/blog/dawnguard-raises-6-3m-for-security-architecture-automation-platformhttps://runtimerebel.com/blog/dawnguard-raises-6-3m-for-security-architecture-automation-platformDawnguard secures $6.3M in seed funding to automate security architecture reviews and accelerate secure cloud infrastructure deployment at scale.Wed, 01 Jul 2026 09:18:34 GMTDawnguardCloud SecurityAutomationSecurity ArchitectureVenture Capitalhttps://runtimerebel.com/blog/microsoft-teams-enhances-meeting-security-with-new-bot-protection-policyhttps://runtimerebel.com/blog/microsoft-teams-enhances-meeting-security-with-new-bot-protection-policyMicrosoft introduces a new admin policy for Teams meetings, preventing unapproved third-party bots from joining, mitigating meeting bombing incidents.Tue, 30 Jun 2026 12:50:08 GMTMicrosoft TeamsBot ProtectionMeeting SecurityAdmin PolicyCloud Securityhttps://runtimerebel.com/blog/djinn-stealer-targets-cloud-ai-credentials-via-simplehelp-cve-2026-48558https://runtimerebel.com/blog/djinn-stealer-targets-cloud-ai-credentials-via-simplehelp-cve-2026-48558Analysis of Djinn Stealer, an infostealer delivered via critical SimpleHelp CVE-2026-48558, targeting cloud and AI development credentials.Tue, 30 Jun 2026 09:19:57 GMTDjinn StealerCVE-2026-48558SimpleHelpInfostealerCloud SecurityAI CredentialsAuthentication Bypasshttps://runtimerebel.com/blog/mustang-panda-exploits-zoho-workdrive-for-c2-in-indian-govt-attackshttps://runtimerebel.com/blog/mustang-panda-exploits-zoho-workdrive-for-c2-in-indian-govt-attacksMustang Panda, a China-aligned APT, targets Indian government and hydropower entities, leveraging Zoho WorkDrive as a C2 channel and deploying new malware.Mon, 29 Jun 2026 17:06:24 GMTMustang PandaAPTZoho WorkDriveIndian GovernmentEspionageC2Cloud Securityhttps://runtimerebel.com/blog/cisco-secures-non-human-identity-with-astrix-and-widefieldhttps://runtimerebel.com/blog/cisco-secures-non-human-identity-with-astrix-and-widefieldCisco's acquisition of Astrix and WideField signals a strategic shift toward Non-Human Identity (NHI) as a critical control plane for securing cloud access.Sat, 27 Jun 2026 09:01:11 GMTCiscoAstrix SecurityWideFieldNon Human IdentityNHIIdentity SecurityCloud Securityhttps://runtimerebel.com/blog/amazon-q-flaw-cloud-credential-theft-via-malicious-repositorieshttps://runtimerebel.com/blog/amazon-q-flaw-cloud-credential-theft-via-malicious-repositoriesAWS patches a critical Amazon Q flaw enabling cloud credential theft via malicious repositories. Understand its impact and recommended mitigations.Fri, 26 Jun 2026 16:48:25 GMTAmazon QAWSCloud SecurityCredential TheftSupply Chain AttackVulnerabilityPatchinghttps://runtimerebel.com/blog/amazon-q-developer-rce-via-cve-2026-12957-cloud-credential-thefthttps://runtimerebel.com/blog/amazon-q-developer-rce-via-cve-2026-12957-cloud-credential-theftHigh-severity CVE-2026-12957 in Amazon Q Developer allowed malicious repositories to execute arbitrary code and steal cloud credentials upon workspace trust. Patch now.Fri, 26 Jun 2026 16:47:43 GMTCVE-2026-12957Amazon Q DeveloperRCECloud SecurityAWSWizhttps://runtimerebel.com/blog/ai-security-platform-runlayer-raises-30m-series-a-fundinghttps://runtimerebel.com/blog/ai-security-platform-runlayer-raises-30m-series-a-fundingRunlayer secures $30 million in Series A funding to develop its secure control layer platform, aiming to fortify AI tools across enterprise environments.Thu, 25 Jun 2026 13:04:45 GMTAI SecurityEnterprise AIRunlayerFundingCloud SecurityAI Governancehttps://runtimerebel.com/blog/dify-ai-platform-data-exposure-multi-tenant-riskshttps://runtimerebel.com/blog/dify-ai-platform-data-exposure-multi-tenant-risksDify AI platform users face critical data exposure flaws, enabling access to private chats, documents, and internal APIs in multi-tenant environments.Tue, 23 Jun 2026 16:56:39 GMTDifyAI PlatformData ExposureMulti TenantCloud Securityhttps://runtimerebel.com/blog/gcp-config-connector-takeover-unpatched-flaw-critical-for-cloud-environmentshttps://runtimerebel.com/blog/gcp-config-connector-takeover-unpatched-flaw-critical-for-cloud-environmentsAn unpatched flaw in GCP Config Connector poses a critical takeover risk to Google Cloud environments.Fri, 19 Jun 2026 16:55:06 GMTGCP Config ConnectorGoogle Cloud PlatformCloud SecurityVelvet AntAndroid TV BotnetPopa BotnetTakeoverhttps://runtimerebel.com/blog/nastyc2-npm-packages-ai-abuse-macos-threats-identifiedhttps://runtimerebel.com/blog/nastyc2-npm-packages-ai-abuse-macos-threats-identifiedAnalysis of NastyC2 npm supply chain attacks, Claude chat abuse for malware, memory-resident macOS threats, and device-code phishing.Thu, 18 Jun 2026 17:09:21 GMTNastyC2NPMSupply Chain AttackClaudeAI AbusemacOS MalwarePhishingCloud SecurityBrowser Add onhttps://runtimerebel.com/blog/servicenow-flaw-exploited-unauthenticated-access-to-customer-instanceshttps://runtimerebel.com/blog/servicenow-flaw-exploited-unauthenticated-access-to-customer-instancesServiceNow advises customers of a critical flaw leading to unauthorized access to hosted instances.Wed, 10 Jun 2026 09:34:05 GMTServiceNowUnauthorized AccessCloud SecurityExploitationPatchinghttps://runtimerebel.com/blog/opal-security-series-b-scaling-ai-native-identity-governancehttps://runtimerebel.com/blog/opal-security-series-b-scaling-ai-native-identity-governanceOpal Security secures $23 million in Series B funding to scale its AI-native identity governance platform for hybrid and multi-cloud environments.Sat, 06 Jun 2026 12:35:13 GMTOpal SecurityIdentity GovernanceIAMCloud SecurityIGA