cloud

A phishing email containing only a PNG image was sent from a compromised AWS account using the spoofed sender address admin@alchemistdigital.ae. Clicking the image redirected victims to a malicious Squarespace domain, giraffe-viola-p262.squarespacecom, which subsequently led to a PDF viewer.  The...

Researchers from Aqua identified critical vulnerabilities in six Amazon Web Services (AWS): CloudFormation, Glue, EMR, SageMaker, ServiceCatalog, and CodeStar. These vulnerabilities varied in severity, potentially allowing remote code execution, full-service user takeover, AI module manipulation, data exposure, data...

Attackers, including nation-state actors, increasingly leverage legitimate cloud services for espionage operations, exploiting their low-profile and cost-effective nature.  The services, such as Microsoft OneDrive and Google Drive, evade detection by masquerading as trusted entities, thereby enabling covert data exfiltration and...

A newly discovered vulnerability in Google Cloud Platform (GCP) has raised significant security concerns among users and experts alike. The vulnerability, dubbed "ConfusedFunction," involves GCP's Cloud Functions and Cloud Build services, potentially allowing attackers to escalate privileges and gain...

Multiple vulnerabilities in SAP AI Core had been identified, giving malicious actors access to customer data and the ability to take control of the service. With SAP AI Core, users may leverage the company's extensive cloud resources to create, train,...

When companies grow fast, especially during the run-up to an IPO or the intense years that follow, momentum can become both a driver and a risk multiplier. At Bumble, I had the opportunity to scale our engineering and infrastructure...

Criminals are exploiting cloud storage services to host phishing websites for SMS scams by abusing the static website hosting feature of cloud storage to store HTML files with malicious URLs, which are included in SMS text messages that bypass...

Jira has become an integral solution for IT teams worldwide to manage tasks, track issues, and collaborate on projects. What’s more, this Atlassian tool empowers teams to streamline workflows, enhance productivity, and deliver better results with precision. Yet with great...

Multiple Cloud Service providers like Google Cloud, AWS, and Azure have been discovered with a new vulnerability that has been termed "LeakyCLI." As the name suggests, the Command line interfaces of Google Cloud (Gcloud CLI), AWS (AWSCLI), and Azure (Azure...

Wiz, a leading cloud security company, has announced its acquisition of Gem Security for $350 million. This acquisition marks a significant milestone in Wiz's journey, which began just four years ago when its founders left Microsoft with a vision...