home.social

#cloudsecurity — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #cloudsecurity, aggregated by home.social.

  1. 🚨 New MEDIUM CVE detected in AWS Lambda 🚨
    CVE-2026-44664 impacts fast-xml-builder in 3 Lambda base images.

    Details: github.com/aws/aws-lambda-base
    More: lambdawatchdog.com/

  2. 🚨 New HIGH CVE detected in AWS Lambda 🚨
    CVE-2026-44665 impacts fast-xml-builder in 3 Lambda base images.

    Details: github.com/aws/aws-lambda-base
    More: lambdawatchdog.com/

  3. 🚨 New HIGH CVE detected in AWS Lambda 🚨
    CVE-2026-44432 impacts urllib3 in 6 Lambda base images.

    Details: github.com/aws/aws-lambda-base
    More: lambdawatchdog.com/

  4. 🚨 New HIGH CVE detected in AWS Lambda 🚨
    CVE-2026-44431 impacts urllib3 in 6 Lambda base images.

    Details: github.com/aws/aws-lambda-base
    More: lambdawatchdog.com/

  5. 🚨 Lambda Watchdog CVE Report 🚨
    Latest AWS Lambda image scan detected 49 CVEs across 26 images:
    • 🔴 Critical: 1
    • 🟠 High: 22
    • 🟡 Medium: 23
    • 🔵 Low: 3

    Check the full report 👉 lambdawatchdog.com/

  6. «Warum Cloud-Lock-in zum Sicherheitsrisiko wird—Digitale Souveränität braucht einen Exit-Plan:
    Mit dem Wechsel hin zu Open-Source-Strukturen hat Schleswig-Holstein Anfang des Jahres ein deutliches Signal gesetzt. Die Abhängigkeit von großen Technologiekonzernen ist kein Naturgesetz.»

    Viele verantwortliche Leute glauben wenn sie die Tools aufzuzählen, dass dies ein Plan sei. Es ist komplexer & benötigt Zeit.

    💻 it-daily.net/it-management/clo

    #cybersicherheit #cloudservices #itsicherheit #cloudsecurity

  7. Pocket OS: AI Didn't Fail, DevOps Did 🤖🔧

    AI agent deleted production database + backups in 9 seconds.

    Root causes:

    Token with PROD delete rights just lying around

    Staging agent = PROD access

    Backups on same volume

    No least privilege

    AI amplifies what's already there (good or bad).

    Fundamentals first. Always.

    #DevOps #SRE #AIAgents #CloudSecurity

  8. The future of money is moving to Amsterdam, and Upsun is proud to be part of the conversation! 🇳🇱 💶

    We're heading to Money20/20 to show how we're helping fintechs move from legacy complexity to seamless modernization. 😎

    Stop by our booth to meet the team! 🤝

    📅 June 2 – 4, 2026
    📍 Amsterdam, Netherlands
    👉 europe.money2020.com/

    #Money2020 #Fintech #FinancialServices #CloudSecurity

  9. Looking for a cloud firewall that’s not a black box?
    IPFire runs on AWS as a standard AMI — transparent, open, and easy to manage.
    #CloudSecurity #OpenSource #AWS #NetworkSecurity ipfire.org/downloads/cloud

  10. 📰 Braintrust AI Platform Breach Exposes Customer API Keys in AWS Account

    📢 Braintrust AI platform discloses AWS security breach. Unauthorized access to an account storing customer API keys prompts urgent rotation advisory. A significant supply chain risk for the AI ecosystem. 🤖 #Braintrust #DataBreach #CloudSecurity #AI

    🔗 cyber.netsecops.io

  11. Gartner: sovereign cloud is only possible if you're American or Chinese. Everyone else is renting the illusion.
    Europe produced white papers. One operator in Peel runs a genuinely sovereign stack.
    The question was never capability. It was appetite.
    haunted.lighthouse.co.im/artic
    #DigitalSovereignty #CloudSecurity #CLOUDACT #Infrastructure

  12. Eliminating database password risk might sound like a dream but we are making it a reality with network isolation and SSH keys. ☁️ 🔒

    By ditching default passwords and opting for private networking, you can stop worrying about credential leaks and hardcoded secrets. 🛡️

    Our latest guide breaks down how we use multi-layered isolation and explicit service authorization to keep your administrative access secure. 👉 devcenter.upsun.com/posts/elim

    #CloudSecurity #DatabaseSafety #InfraAsCode #WebDev

  13. @cryptomator
    The "Cloud" is just someone else's computer—and as we see, even tech giants aren't invincible.
    When big tech fails or laws compromise your privacy, having a transparent way to access and manage your own backups becomes a necessity, not a luxury.
    This is why #Keepita focuses on giving users a clear window into their mobile data. Don't let your backups be a mystery hidden in someone else's vulnerable cloud.

    #Keepita #DataPrivacy #MicrosoftHack #CloudSecurity #InfoSec #SelfCustody

  14. IPFire in the cloud? Yes.
    It’s available as an AMI on AWS, giving you full control with none of the complexity of native cloud firewalls.
    #CloudSecurity #OpenSource #AWS #Firewall ipfire.org/downloads/cloud

  15. Enterprises need flexibility, not lock-in.
    IPFire offers an open-source firewall platform that works across environments — including AWS.
    #CloudSecurity #Firewall #OpenSource #AWS ipfire.org/downloads/cloud

  16. A practical cybersecurity brief on reducing operational risk, strengthening controls, and improving executive decision-making.

    Where would are cloud security bypassers stealing your data ever... break first in your environment?

    Read more: steelefortress.com/fortress-fe

    CyberSecurity #CloudSecurity #InfoSec #Security

    🎥 Watch Teaser: steelefortress.com/6ztxan

  17. May the Vault be with you. ✨

    For Star Wars Day, we’re celebrating all space guardians, pilots, droids, and teams who keep their data safe across the galaxy.

    With Cryptomator Hub, teams can centrally manage access to encrypted vaults — so important files stay protected, whether you’re working from the office, remotely, or on an intergalactic mission.

    Happy May the 4th! 🚀🔐

    #StarWarsDay #MayThe4th #Cryptomator #CryptomatorHub #Encryption #DataSecurity #CloudSecurity

  18. Physical security has become an important aspect of protecting confidential computing workloads. Physical access is typically excluded from hardware vendors' CVM attack models, leaving physical and relay attacks largely unaddressed.
    Flashbots and Intel have each been working independently on solutions to help bridge this physical-access gap: writings.flashbots.net/mind-th

    #ConfidentialComputing #CloudSecurity #TPM

  19. Physical security has become an important aspect of protecting confidential computing workloads. Physical access is typically excluded from hardware vendors' CVM attack models, leaving physical and relay attacks largely unaddressed.
    Flashbots and Intel have each been working independently on solutions to help bridge this physical-access gap: writings.flashbots.net/mind-th

    #ConfidentialComputing #CloudSecurity #TPM

  20. Physical security has become an important aspect of protecting confidential computing workloads. Physical access is typically excluded from hardware vendors' CVM attack models, leaving physical and relay attacks largely unaddressed.
    Flashbots and Intel have each been working independently on solutions to help bridge this physical-access gap: writings.flashbots.net/mind-th

    #ConfidentialComputing #CloudSecurity #TPM

  21. Physical security has become an important aspect of protecting confidential computing workloads. Physical access is typically excluded from hardware vendors' CVM attack models, leaving physical and relay attacks largely unaddressed.
    Flashbots and Intel have each been working independently on solutions to help bridge this physical-access gap: writings.flashbots.net/mind-th

    #ConfidentialComputing #CloudSecurity #TPM

  22. Physical security has become an important aspect of protecting confidential computing workloads. Physical access is typically excluded from hardware vendors' CVM attack models, leaving physical and relay attacks largely unaddressed.
    Flashbots and Intel have each been working independently on solutions to help bridge this physical-access gap: writings.flashbots.net/mind-th

    #ConfidentialComputing #CloudSecurity #TPM

  23. 🚨 Most people think red teaming is about exploits.

    It’s not.

    The most effective attacks today don’t start with vulnerabilities —
    they start with **trust**.

    Modern environments are cloud-heavy, identity-driven, and full of SaaS integrations. In these systems, attackers don’t always need to “break in.”

    They move quietly through:

    • Over-permissioned identities
    • Weak approval workflows
    • Misconfigured cloud roles
    • OAuth tokens and API access
    • Human behavior under pressure
    • Business processes no one questions

    This is what I’ve been studying and calling the **Quiet Kill Chain** —
    a sequence of legitimate-looking actions that, when chained together, become an attack path.

    No loud exploits.
    No obvious malware.
    Just normal activity… used the wrong way.

    ## What changes at an advanced level?

    You stop asking:
    “What exploit should I use?”

    And start asking:

    • Where does this system trust too easily?
    • Which action would look completely normal?
    • What would defenders ignore?
    • How can I blend into business operations?

    Because the strongest intrusion today is not the one that is invisible.

    It’s the one that looks **legitimate**.

    ## My takeaway

    Offensive security is shifting from breaking systems
    to understanding them deeply enough to move inside them unnoticed.

    I’ve written a full deep-dive on this concept here 👇

    🔗 dev.to/blackcipher/the-quiet-k

    Curious to hear your thoughts —
    Is detection today ready for this level of subtlety?

    #CyberSecurity #RedTeam #OffensiveSecurity #ThreatIntel #CloudSecurity #IdentitySecurity #EthicalHacking #BlackCipher

  24. 82% of enterprises are running AI agents they don't know about.

    That number came out of #RSAC Conference 2026 — and it wasn't the most alarming stat on the table.

    Sean Martin sat back down with Itamar Apelblat, Co-Founder and CEO of Token Security, to unpack what he heard walking the show floor and what the CSA data now makes impossible to ignore: 65% of organizations have already had an AI agent-related incident in the last twelve months. 82% found agents in their environment that nobody authorized. Only 21% have any formal process to retire an agent when it's done.

    Discovery alone is not governance. Intent-based enforcement is. That's where this conversation lands — and it's worth your time.

    A huge thank you to the team at Token Security for joining Sean Martin and Marco Ciappelli on this journey — both on the floor at #RSAC2026 and in the recap. We loved sharing your story and we're looking forward to many more conversations ahead. 🙌

    📍 Where are we headed next? Glad you asked: Infosecurity Europe and Black Hat USA — see you there.

    🎙️ Recap: youtu.be/ZeI5bSbQ070
    🎙️ On Location: youtu.be/uWjCQC3LnaY
    🌐 RSAC Coverage: itspmagazine.com/rsac
    🌐 Next Coverages: itspmagazine.com/technology-an

    #TokenSecurity #AIAgents #AgentSecurity #CyberSecurity #CISO #CloudSecurity #AIGovernance #IdentitySecurity #CSAReport #InfoSec #RSAC2026 #InfosecurityEurope #BlackHatUSA #CyberSecurityPodcast

  25. «Tuta Drive: Verschlüsselter Cloud-Speicher startet in geschlossene Beta»

    Verschlüsselung in der Technik geht nicht um die Geheimhaltung sondern u.a. um die Verifizierung der Daten. Ich habe keine Ahnung wie die Verschlüsselung von @Tutanota umgesetzt ist aber ich gehe mal vom Positiven aus, da die auch Post-Quantum Verschlüsselung mittlerweile bei bestehenden Services umsetzten.

    🔐 stadt-bremerhaven.de/tuta-driv

    #online #datenschutz #verschlusselung #cloud #cloudsecurity #cloudserver #web

  26. «Tuta Drive: Verschlüsselter Cloud-Speicher startet in geschlossene Beta»

    Verschlüsselung in der Technik geht nicht um die Geheimhaltung sondern u.a. um die Verifizierung der Daten. Ich habe keine Ahnung wie die Verschlüsselung von @Tutanota umgesetzt ist aber ich gehe mal vom Positiven aus, da die auch Post-Quantum Verschlüsselung mittlerweile bei bestehenden Services umsetzten.

    🔐 stadt-bremerhaven.de/tuta-driv

    #online #datenschutz #verschlusselung #cloud #cloudsecurity #cloudserver #web

  27. «Tuta Drive: Verschlüsselter Cloud-Speicher startet in geschlossene Beta»

    Verschlüsselung in der Technik geht nicht um die Geheimhaltung sondern u.a. um die Verifizierung der Daten. Ich habe keine Ahnung wie die Verschlüsselung von @Tutanota umgesetzt ist aber ich gehe mal vom Positiven aus, da die auch Post-Quantum Verschlüsselung mittlerweile bei bestehenden Services umsetzten.

    🔐 stadt-bremerhaven.de/tuta-driv

    #online #datenschutz #verschlusselung #cloud #cloudsecurity #cloudserver #web

  28. «Tuta Drive: Verschlüsselter Cloud-Speicher startet in geschlossene Beta»

    Verschlüsselung in der Technik geht nicht um die Geheimhaltung sondern u.a. um die Verifizierung der Daten. Ich habe keine Ahnung wie die Verschlüsselung von @Tutanota umgesetzt ist aber ich gehe mal vom Positiven aus, da die auch Post-Quantum Verschlüsselung mittlerweile bei bestehenden Services umsetzten.

    🔐 stadt-bremerhaven.de/tuta-driv

    #online #datenschutz #verschlusselung #cloud #cloudsecurity #cloudserver #web

  29. «Tuta Drive: Verschlüsselter Cloud-Speicher startet in geschlossene Beta»

    Verschlüsselung in der Technik geht nicht um die Geheimhaltung sondern u.a. um die Verifizierung der Daten. Ich habe keine Ahnung wie die Verschlüsselung von @Tutanota umgesetzt ist aber ich gehe mal vom Positiven aus, da die auch Post-Quantum Verschlüsselung mittlerweile bei bestehenden Services umsetzten.

    🔐 stadt-bremerhaven.de/tuta-driv

    #online #datenschutz #verschlusselung #cloud #cloudsecurity #cloudserver #web

  30. Cloud Native Security: Exam Objective 704.1 of the LPI DevOps Tools Engineer v2.0 covers the key principles, risks, and mitigation strategies specific to cloud-native environments.

    Explore the objective to sharpen your DevOps skills: lpi.org/unns

  31. Subdomain Takeover Vulnerabilities and Prevention

    In this article, I cover:
    * How subdomain takeover vulnerabilities occur
    * Real-world exploitation scenarios
    Reconnaissance and detection techniques
    * Practical prevention and DNS hygiene strategies

    denizhalil.com/2026/02/16/subd

    #CyberSecurity #SubdomainTakeover #DNS #AttackSurface #BugBounty #RedTeam #BlueTeam #InfoSec #CloudSecurity #WebSecurity #EthicalHacking

  32. Subdomain Takeover Vulnerabilities and Prevention

    In this article, I cover:
    * How subdomain takeover vulnerabilities occur
    * Real-world exploitation scenarios
    Reconnaissance and detection techniques
    * Practical prevention and DNS hygiene strategies

    denizhalil.com/2026/02/16/subd

    #CyberSecurity #SubdomainTakeover #DNS #AttackSurface #BugBounty #RedTeam #BlueTeam #InfoSec #CloudSecurity #WebSecurity #EthicalHacking

  33. Subdomain Takeover Vulnerabilities and Prevention

    In this article, I cover:
    * How subdomain takeover vulnerabilities occur
    * Real-world exploitation scenarios
    Reconnaissance and detection techniques
    * Practical prevention and DNS hygiene strategies

    denizhalil.com/2026/02/16/subd

    #CyberSecurity #SubdomainTakeover #DNS #AttackSurface #BugBounty #RedTeam #BlueTeam #InfoSec #CloudSecurity #WebSecurity #EthicalHacking

  34. Vor ein paar Monaten wurde ich gebeten, die neue Version des C5 ses @bsi zu kommentieren.

    thomasfricke.de/post/c5-commen

    Der Teil mit der Jurisdiktion scheint es geschafft zu haben. Nicht aber die Drohnen? Im Original mit Schreibfehler

    heise.de/news/BSI-Kriterienkat

    #c5 #cloudsecurity #digitalesouveränität