Cloud
Curated coverage and analysis in this editorial area.
CVE-2026-3886: QEMU virtio-gpu Integer Overflow Enables Guest-to-Host Escape
An integer overflow in QEMU’s virtio-gpu driver allows local privilege escalation from guest to host with a CVSS score of 8.8. The ups…
GitLab 19.0 Debuts Native Secrets Management and Air-Gapped AI
GitLab 19.0 integrates native secrets management, agentic merge request workflows, and self-hosted AI models, reinforcing its 'single…
PoC Zealot: Autonomous AI Executes End-to-End GCP Cloud Attack
Unit 42’s Zealot project demonstrates how multi-agent AI systems can autonomously chain SSRF, credential theft, and BigQuery exfiltrat…
CISA Faces Congressional Scrutiny After Months-Long AWS GovCloud Credential Leak on GitHub
Senator Maggie Hassan has demanded a classified briefing from CISA following the discovery of a public GitHub repository that exposed…
Zealot: How Autonomous AI Orchestrates Multi-Stage Cloud Compromise
Palo Alto Networks’ Unit 42 has demonstrated Zealot, a multi-agent PoC capable of executing end-to-end cloud attack chains without hum…
Microsoft Neutralizes Fox Tempest: Malware-Signing-as-a-Service Operation Dismantled
Microsoft has disrupted Fox Tempest, a sophisticated 'Malware-Signing-as-a-Service' operation that leveraged stolen identities to expl…
CISA Contractor Exposed AWS GovCloud Credentials and Plaintext Passwords on GitHub for Months
A federal contractor at Nightwing exposed administrative AWS GovCloud credentials and internal passwords in plaintext on GitHub for ov…
ShinyHunters: A Serial Extortion Campaign Targets Enterprise SaaS (May 2026)
Between May 7 and May 18, 2026, ShinyHunters targeted Canvas, 7-Eleven, and Grafana in a high-profile data extortion spree. While Inst…
Grafana Refuses Ransom Following GitHub Token Theft and Codebase Breach
Grafana Labs has confirmed that a stolen GitHub access token allowed attackers to exfiltrate its source code. Despite extortion attemp…
GitHub Enterprise RCE: A Single 'git push' Puts Corporate Backends at Risk
CVE-2026-3854 allows Remote Code Execution on GitHub Enterprise Server via user-controlled push options. Reports indicate that 88% of…
NVIDIA Confirms GeForce NOW Data Breach via Armenian Partner
NVIDIA has confirmed that a regional partner in the GeForce NOW Alliance suffered a breach exposing user personal data. While central…
Zara Data Breach: 197,000 Emails Exposed via Compromised Anodot Tokens
Threat actor ShinyHunters has published a 140 GB Zara dataset allegedly obtained via compromised Anodot authentication tokens. Have I…