#cloudsecurity — Public Fediverse posts

🟦 Entra Tenant Governance | Find Configuration Drift

New preview lets admins detect tenant configuration drift natively across Entra and related services. 🔹

Define JSON baselines as configuration as code and create scheduled monitors. Monitors run every six hours and produce run summaries and detailed drift objects with property level diffs. Govern external tenants via B2B signals and role based templates from a single admin center. 💡

💡 Configuration as code baseline
🔍 Six hour monitor interval
⚖️ Cross tenant governance via B2B signals

▶︎ https://www.hubsite365.com/en-ww/pro-office-365/?id=78675908-1859-f111-bec7-7c1e5273f078&topic=eb4ea787-ac86-ec11-93b0-6045bd8f31a1&theater=true

#MICROSOFTENTRA #IDENTITYSECURITY #ZEROTRUST #CLOUDSECURITY

🟦 Entra Tenant Governance | Find Configuration Drift

New preview lets admins detect tenant configuration drift natively across Entra and related services. 🔹

Define JSON baselines as configuration as code and create scheduled monitors. Monitors run every six hours and produce run summaries and detailed drift objects with property level diffs. Govern external tenants via B2B signals and role based templates from a single admin center. 💡

💡 Configuration as code baseline
🔍 Six hour monitor interval
⚖️ Cross tenant governance via B2B signals

▶︎ https://www.hubsite365.com/en-ww/pro-office-365/?id=78675908-1859-f111-bec7-7c1e5273f078&topic=eb4ea787-ac86-ec11-93b0-6045bd8f31a1&theater=true

#MICROSOFTENTRA #IDENTITYSECURITY #ZEROTRUST #CLOUDSECURITY

🚨 Attackers don’t break in anymore — they log in.

Weak Entra roles, shadow admins & legacy access paths are the real targets.

👉 https://7asecurity.com/blog/2026/05/entra-roles-7asecurity-strategy/

#CyberSecurity #CloudSecurity #IAM

New #CloudSecTidbits explores how misconfigured AWS ELBs can silently break security boundaries through rule shadowing, CloudFront/WAF bypasses, and alternate routing paths.

We’re also releasing ELBaph — a new read-only tool to map ELB routing graphs, detect exposed paths, and surface real-world attack chains across ALBs/NLBs.

https://blog.doyensec.com/2026/05/25/cloudsectidbits-elbaph-alb.html

#AppSec #Doyensec #AWS #CloudSecurity #AppSec #SecurityResearch

New #CloudSecTidbits explores how misconfigured AWS ELBs can silently break security boundaries through rule shadowing, CloudFront/WAF bypasses, and alternate routing paths.

We’re also releasing ELBaph — a new read-only tool to map ELB routing graphs, detect exposed paths, and surface real-world attack chains across ALBs/NLBs.

https://blog.doyensec.com/2026/05/25/cloudsectidbits-elbaph-alb.html

#AppSec #Doyensec #AWS #CloudSecurity #AppSec #SecurityResearch

🔐 𝗥𝗘𝗟𝗜𝗔𝗡𝗢𝗜𝗗 will be attending 𝗜𝗻𝗳𝗼𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗘𝘂𝗿𝗼𝗽𝗲 𝟮𝟬𝟮𝟲 in London from June 2–4!

As one of 𝘌𝘶𝘳𝘰𝘱𝘦’𝘴 𝘭𝘦𝘢𝘥𝘪𝘯𝘨 𝘤𝘺𝘣𝘦𝘳𝘴𝘦𝘤𝘶𝘳𝘪𝘵𝘺 𝘦𝘷𝘦𝘯𝘵𝘴, Infosecurity Europe brings together security professionals, innovators, and decision-makers to explore the future of cyber resilience, cloud security, AI-driven protection, Zero Trust, and more.

#InfosecurityEurope #CyberSecurity #CloudSecurity #ZeroTrust #ApplicationSecurity #ADC #LoadBalancing #CyberResilience #DevSecOps #AI

https://www.relianoid.com/about-us/events/infosecurity-europe-2026/

Crypto4A launches quantum-safe rival to AWS Secrets Manager

https://web.brid.gy/r/https://nerds.xyz/2026/05/canadian-quantum-safe-secrets-manager/

Crypto4A launches quantum-safe rival to AWS Secrets Manager

https://fed.brid.gy/r/https://nerds.xyz/2026/05/canadian-quantum-safe-secrets-manager/

Crypto4A launches quantum-safe rival to AWS Secrets Manager

https://web.brid.gy/r/https://nerds.xyz/2026/05/canadian-quantum-safe-secrets-manager/

Crypto4A launches quantum-safe rival to AWS Secrets Manager

https://fed.brid.gy/r/https://nerds.xyz/2026/05/canadian-quantum-safe-secrets-manager/

Crypto4A launches quantum-safe rival to AWS Secrets Manager

https://web.brid.gy/r/https://nerds.xyz/2026/05/canadian-quantum-safe-secrets-manager/

🚨 Lambda Watchdog CVE Report 🚨
Latest AWS Lambda image scan detected 26 CVEs across 26 images:
• 🔴 Critical: 3
• 🟠 High: 11
• 🟡 Medium: 11
• 🔵 Low: 1

Check the full report 👉 https://lambdawatchdog.com/
#AWS #Lambda #CVE #CloudSecurity #Serverless

🚨 Lambda Watchdog CVE Report 🚨
Latest AWS Lambda image scan detected 26 CVEs across 26 images:
• 🔴 Critical: 3
• 🟠 High: 11
• 🟡 Medium: 11
• 🔵 Low: 1

Check the full report 👉 https://lambdawatchdog.com/
#AWS #Lambda #CVE #CloudSecurity #Serverless

🚨 Lambda Watchdog CVE Report 🚨
Latest AWS Lambda image scan detected 26 CVEs across 26 images:
• 🔴 Critical: 3
• 🟠 High: 11
• 🟡 Medium: 11
• 🔵 Low: 1

Check the full report 👉 https://lambdawatchdog.com/
#AWS #Lambda #CVE #CloudSecurity #Serverless

🚨 Lambda Watchdog CVE Report 🚨
Latest AWS Lambda image scan detected 26 CVEs across 26 images:
• 🔴 Critical: 3
• 🟠 High: 11
• 🟡 Medium: 11
• 🔵 Low: 1

Check the full report 👉 https://lambdawatchdog.com/
#AWS #Lambda #CVE #CloudSecurity #Serverless

🚨 Lambda Watchdog CVE Report 🚨
Latest AWS Lambda image scan detected 26 CVEs across 26 images:
• 🔴 Critical: 3
• 🟠 High: 11
• 🟡 Medium: 11
• 🔵 Low: 1

Check the full report 👉 https://lambdawatchdog.com/
#AWS #Lambda #CVE #CloudSecurity #Serverless

$148,337 #BugBounty paid by Google to a researcher (@brutecat) who found debug endpoints on Google Cloud allowing to configure privileged workflows leading to full #RCE in Google Cloud production (CVE-2026-2031)
#CloudSecurity #BugBountyTips
👇
https://brutecat.com/articles/google-cloud-rce/

$148,337 #BugBounty paid by Google to a researcher (@brutecat) who found debug endpoints on Google Cloud allowing to configure privileged workflows leading to full #RCE in Google Cloud production (CVE-2026-2031)
#CloudSecurity #BugBountyTips
👇
https://brutecat.com/articles/google-cloud-rce/

$148,337 #BugBounty paid by Google to a researcher (@brutecat) who found debug endpoints on Google Cloud allowing to configure privileged workflows leading to full #RCE in Google Cloud production (CVE-2026-2031)
#CloudSecurity #BugBountyTips
👇
https://brutecat.com/articles/google-cloud-rce/

$148,337 #BugBounty paid by Google to a researcher (@brutecat) who found debug endpoints on Google Cloud allowing to configure privileged workflows leading to full #RCE in Google Cloud production (CVE-2026-2031)
#CloudSecurity #BugBountyTips
👇
https://brutecat.com/articles/google-cloud-rce/

$148,337 #BugBounty paid by Google to a researcher (@brutecat) who found debug endpoints on Google Cloud allowing to configure privileged workflows leading to full #RCE in Google Cloud production (CVE-2026-2031)
#CloudSecurity #BugBountyTips
👇
https://brutecat.com/articles/google-cloud-rce/

Shashwat Sehgal, CEO & Co-Founder of P0 Security, warns that AI agents are recreating the same access problems that broke early cloud security.

🔐 Broad standing permissions are returning
🔐 Visibility alone does not reduce blast radius
🔐 Runtime governance matters more than authentication

“The organizations that avoid repeating the cloud security cycle will be the ones that treat agents as a new class of privileged non-human identity from day one.”

https://www.technadu.com/ai-agents-are-recreating-the-access-problems-that-broke-early-cloud-security/628330/

#Cybersecurity #AISecurity #IdentitySecurity #CloudSecurity #AIAgents

Shashwat Sehgal, CEO & Co-Founder of P0 Security, warns that AI agents are recreating the same access problems that broke early cloud security.

🔐 Broad standing permissions are returning
🔐 Visibility alone does not reduce blast radius
🔐 Runtime governance matters more than authentication

“The organizations that avoid repeating the cloud security cycle will be the ones that treat agents as a new class of privileged non-human identity from day one.”

https://www.technadu.com/ai-agents-are-recreating-the-access-problems-that-broke-early-cloud-security/628330/

#Cybersecurity #AISecurity #IdentitySecurity #CloudSecurity #AIAgents

Shashwat Sehgal, CEO & Co-Founder of P0 Security, warns that AI agents are recreating the same access problems that broke early cloud security.

🔐 Broad standing permissions are returning
🔐 Visibility alone does not reduce blast radius
🔐 Runtime governance matters more than authentication

“The organizations that avoid repeating the cloud security cycle will be the ones that treat agents as a new class of privileged non-human identity from day one.”

https://www.technadu.com/ai-agents-are-recreating-the-access-problems-that-broke-early-cloud-security/628330/

#Cybersecurity #AISecurity #IdentitySecurity #CloudSecurity #AIAgents

Shashwat Sehgal, CEO & Co-Founder of P0 Security, warns that AI agents are recreating the same access problems that broke early cloud security.

🔐 Broad standing permissions are returning
🔐 Visibility alone does not reduce blast radius
🔐 Runtime governance matters more than authentication

“The organizations that avoid repeating the cloud security cycle will be the ones that treat agents as a new class of privileged non-human identity from day one.”

https://www.technadu.com/ai-agents-are-recreating-the-access-problems-that-broke-early-cloud-security/628330/

#Cybersecurity #AISecurity #IdentitySecurity #CloudSecurity #AIAgents

Shashwat Sehgal, CEO & Co-Founder of P0 Security, warns that AI agents are recreating the same access problems that broke early cloud security.

🔐 Broad standing permissions are returning
🔐 Visibility alone does not reduce blast radius
🔐 Runtime governance matters more than authentication

“The organizations that avoid repeating the cloud security cycle will be the ones that treat agents as a new class of privileged non-human identity from day one.”

https://www.technadu.com/ai-agents-are-recreating-the-access-problems-that-broke-early-cloud-security/628330/

#Cybersecurity #AISecurity #IdentitySecurity #CloudSecurity #AIAgents

🚨 Lambda Watchdog CVE Report 🚨
Latest AWS Lambda image scan detected 26 CVEs across 26 images:
• 🔴 Critical: 3
• 🟠 High: 11
• 🟡 Medium: 11
• 🔵 Low: 1

Check the full report 👉 https://lambdawatchdog.com/
#AWS #Lambda #CVE #CloudSecurity #Serverless

🚨 Lambda Watchdog CVE Report 🚨
Latest AWS Lambda image scan detected 26 CVEs across 26 images:
• 🔴 Critical: 3
• 🟠 High: 11
• 🟡 Medium: 11
• 🔵 Low: 1

Check the full report 👉 https://lambdawatchdog.com/
#AWS #Lambda #CVE #CloudSecurity #Serverless

CISA exposed plaintext passwords, cloud keys, and access tokens in a public GitHub repository tied to a government contractor account. 🔓
A researcher confirmed some credentials were valid, raising concerns over federal cloud security and contractor oversight at the US cyber agency. ☁️

🔗 https://techcrunch.com/2026/05/19/us-cyber-agency-cisa-exposed-reams-of-passwords-and-cloud-keys-to-the-open-web/

#TechNews #CISA #Cybersecurity #GitHub #CloudSecurity #Passwords #Infosec #Privacy #Security #DataBreach #OpenSource #GovTech #Cloud #USA #US #Tech #Government #Federal

CISA exposed plaintext passwords, cloud keys, and access tokens in a public GitHub repository tied to a government contractor account. 🔓
A researcher confirmed some credentials were valid, raising concerns over federal cloud security and contractor oversight at the US cyber agency. ☁️

🔗 https://techcrunch.com/2026/05/19/us-cyber-agency-cisa-exposed-reams-of-passwords-and-cloud-keys-to-the-open-web/

#TechNews #CISA #Cybersecurity #GitHub #CloudSecurity #Passwords #Infosec #Privacy #Security #DataBreach #OpenSource #GovTech #Cloud #USA #US #Tech #Government #Federal

CISA exposed plaintext passwords, cloud keys, and access tokens in a public GitHub repository tied to a government contractor account. 🔓
A researcher confirmed some credentials were valid, raising concerns over federal cloud security and contractor oversight at the US cyber agency. ☁️

🔗 https://techcrunch.com/2026/05/19/us-cyber-agency-cisa-exposed-reams-of-passwords-and-cloud-keys-to-the-open-web/

#TechNews #CISA #Cybersecurity #GitHub #CloudSecurity #Passwords #Infosec #Privacy #Security #DataBreach #OpenSource #GovTech #Cloud #USA #US #Tech #Government #Federal

CISA exposed plaintext passwords, cloud keys, and access tokens in a public GitHub repository tied to a government contractor account. 🔓
A researcher confirmed some credentials were valid, raising concerns over federal cloud security and contractor oversight at the US cyber agency. ☁️

🔗 https://techcrunch.com/2026/05/19/us-cyber-agency-cisa-exposed-reams-of-passwords-and-cloud-keys-to-the-open-web/

#TechNews #CISA #Cybersecurity #GitHub #CloudSecurity #Passwords #Infosec #Privacy #Security #DataBreach #OpenSource #GovTech #Cloud #USA #US #Tech #Government #Federal

CISA exposed plaintext passwords, cloud keys, and access tokens in a public GitHub repository tied to a government contractor account. 🔓
A researcher confirmed some credentials were valid, raising concerns over federal cloud security and contractor oversight at the US cyber agency. ☁️

🔗 https://techcrunch.com/2026/05/19/us-cyber-agency-cisa-exposed-reams-of-passwords-and-cloud-keys-to-the-open-web/

#TechNews #CISA #Cybersecurity #GitHub #CloudSecurity #Passwords #Infosec #Privacy #Security #DataBreach #OpenSource #GovTech #Cloud #USA #US #Tech #Government #Federal

Cybercrime “Industrialization” Keep Growing in Latin America

Fraud, ransomware, and AI-driven attacks have become part of increasingly coordinated and scalable criminal…
#Conflict #Conflicts #War #AISecurity #Appgate #CISO #cloudsecurity #Cloudflare #ConnectivityCloud #criticalinfrastructure #cyberattacks #Cybersecurity #Dataprivacy #DefensiveAI #Fraudprevention #Kaspersky #Latinamerica #México #NuevoLeón #ransomware #Regulation&Policy #SMESecurity #zerotrust
https://www.europesays.com/3010689/

Der Vorfall sorgt nicht nur wegen des politischen Hintergrunds für Aufmerksamkeit, sondern zeigt erneut die wachsenden Risiken moderner Cybersecurity- und Datenschutzprobleme im Bereich Cloud-Infrastruktur und Third-Party-Risk-Management. 👇

#trumpmobile #datenleck #cybersecurity #datenschutz #databreach #itsicherheit #cyberangriff #cloudsecurity #security #datenpanne #cloud #privacy #infosec #kundendaten #mobilfunk #trump

https://teufelswerk.net/trump-mobile-datenleck-persoenliche-kundendaten-oeffentlich-zugaenglich-warum-der-vorfall-ein-ernstes-cybersecurity-problem-ist/

Der Vorfall sorgt nicht nur wegen des politischen Hintergrunds für Aufmerksamkeit, sondern zeigt erneut die wachsenden Risiken moderner Cybersecurity- und Datenschutzprobleme im Bereich Cloud-Infrastruktur und Third-Party-Risk-Management. 👇

#trumpmobile #datenleck #cybersecurity #datenschutz #databreach #itsicherheit #cyberangriff #cloudsecurity #security #datenpanne #cloud #privacy #infosec #kundendaten #mobilfunk #trump

https://teufelswerk.net/trump-mobile-datenleck-persoenliche-kundendaten-oeffentlich-zugaenglich-warum-der-vorfall-ein-ernstes-cybersecurity-problem-ist/

Der Vorfall sorgt nicht nur wegen des politischen Hintergrunds für Aufmerksamkeit, sondern zeigt erneut die wachsenden Risiken moderner Cybersecurity- und Datenschutzprobleme im Bereich Cloud-Infrastruktur und Third-Party-Risk-Management. 👇

#trumpmobile #datenleck #cybersecurity #datenschutz #databreach #itsicherheit #cyberangriff #cloudsecurity #security #datenpanne #cloud #privacy #infosec #kundendaten #mobilfunk #trump

https://teufelswerk.net/trump-mobile-datenleck-persoenliche-kundendaten-oeffentlich-zugaenglich-warum-der-vorfall-ein-ernstes-cybersecurity-problem-ist/

Der Vorfall sorgt nicht nur wegen des politischen Hintergrunds für Aufmerksamkeit, sondern zeigt erneut die wachsenden Risiken moderner Cybersecurity- und Datenschutzprobleme im Bereich Cloud-Infrastruktur und Third-Party-Risk-Management. 👇

#trumpmobile #datenleck #cybersecurity #datenschutz #databreach #itsicherheit #cyberangriff #cloudsecurity #security #datenpanne #cloud #privacy #infosec #kundendaten #mobilfunk #trump

https://teufelswerk.net/trump-mobile-datenleck-persoenliche-kundendaten-oeffentlich-zugaenglich-warum-der-vorfall-ein-ernstes-cybersecurity-problem-ist/

Der Vorfall sorgt nicht nur wegen des politischen Hintergrunds für Aufmerksamkeit, sondern zeigt erneut die wachsenden Risiken moderner Cybersecurity- und Datenschutzprobleme im Bereich Cloud-Infrastruktur und Third-Party-Risk-Management. 👇

#trumpmobile #datenleck #cybersecurity #datenschutz #databreach #itsicherheit #cyberangriff #cloudsecurity #security #datenpanne #cloud #privacy #infosec #kundendaten #mobilfunk #trump

https://teufelswerk.net/trump-mobile-datenleck-persoenliche-kundendaten-oeffentlich-zugaenglich-warum-der-vorfall-ein-ernstes-cybersecurity-problem-ist/

📰 Nation-State Actors Weaponize Open-Source ROADtools for Azure Cloud Attacks, Bypassing MFA and Persisting in Networks

🚨 Cloud Attack Alert: Nation-states are weaponizing the open-source ROADtools framework to attack Azure environments. Unit 42 breaks down how they achieve persistence & bypass MFA. #ROADtools #Azure #CloudSecurity #EntraID

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/roadtools-nation-state-tactics-in-the-cloud/?utm_source=mastodo…

I'm now GNA 119 under CIRCL's GCVE system — a decentralized vulnerability
identification authority. I have authority to mint vulnerability
identifiers for cloud findings, including ones where vendor CNAs decline
to issue CVEs.

I could start assigning IDs to my own research today. I won't.

Cloud vulnerability validation shouldn't be one person's judgment. Mine
or anyone else's.

I'm forming a consensus panel of practitioners for each major cloud
platform — AWS, GCP, Azure, and managed services. GCVE-119 allocations
will go through panel review, not solo decisions.

Charter, scope, and membership criteria coming. Community input on
structure welcome before anything is finalized.

Background on GCVE and the cloud finding gap:
https://olearysec.com/gcve/

#infosec #vulnerability #GCVE #cloudsecurity #security

I'm now GNA 119 under CIRCL's GCVE system — a decentralized vulnerability
identification authority. I have authority to mint vulnerability
identifiers for cloud findings, including ones where vendor CNAs decline
to issue CVEs.

I could start assigning IDs to my own research today. I won't.

Cloud vulnerability validation shouldn't be one person's judgment. Mine
or anyone else's.

I'm forming a consensus panel of practitioners for each major cloud
platform — AWS, GCP, Azure, and managed services. GCVE-119 allocations
will go through panel review, not solo decisions.

Charter, scope, and membership criteria coming. Community input on
structure welcome before anything is finalized.

Background on GCVE and the cloud finding gap:
https://olearysec.com/gcve/

#infosec #vulnerability #GCVE #cloudsecurity #security

Researchers say deleted Google API keys may stay active for up to 23 minutes due to cloud propagation delays.

The issue could reportedly allow continued access to Gemini uploads, APIs, and cloud resources after key deletion.

https://www.technadu.com/google-api-keys-remain-usable-after-deletion-for-up-to-23-minutes-report-says/628304/

#Cybersecurity #CloudSecurity #GoogleCloud #APIKeys

Researchers say deleted Google API keys may stay active for up to 23 minutes due to cloud propagation delays.

The issue could reportedly allow continued access to Gemini uploads, APIs, and cloud resources after key deletion.

https://www.technadu.com/google-api-keys-remain-usable-after-deletion-for-up-to-23-minutes-report-says/628304/

#Cybersecurity #CloudSecurity #GoogleCloud #APIKeys

Researchers say deleted Google API keys may stay active for up to 23 minutes due to cloud propagation delays.

The issue could reportedly allow continued access to Gemini uploads, APIs, and cloud resources after key deletion.

https://www.technadu.com/google-api-keys-remain-usable-after-deletion-for-up-to-23-minutes-report-says/628304/

#Cybersecurity #CloudSecurity #GoogleCloud #APIKeys

Researchers say deleted Google API keys may stay active for up to 23 minutes due to cloud propagation delays.

The issue could reportedly allow continued access to Gemini uploads, APIs, and cloud resources after key deletion.

https://www.technadu.com/google-api-keys-remain-usable-after-deletion-for-up-to-23-minutes-report-says/628304/

#Cybersecurity #CloudSecurity #GoogleCloud #APIKeys

🚨 Lambda Watchdog CVE Report 🚨
Latest AWS Lambda image scan detected 43 CVEs across 26 images:
• 🔴 Critical: 3
• 🟠 High: 15
• 🟡 Medium: 23
• 🔵 Low: 2

Check the full report 👉 https://lambdawatchdog.com/
#AWS #Lambda #CVE #CloudSecurity #Serverless

🚨 Lambda Watchdog CVE Report 🚨
Latest AWS Lambda image scan detected 43 CVEs across 26 images:
• 🔴 Critical: 3
• 🟠 High: 15
• 🟡 Medium: 23
• 🔵 Low: 2

Check the full report 👉 https://lambdawatchdog.com/
#AWS #Lambda #CVE #CloudSecurity #Serverless

🚨 Lambda Watchdog CVE Report 🚨
Latest AWS Lambda image scan detected 43 CVEs across 26 images:
• 🔴 Critical: 3
• 🟠 High: 15
• 🟡 Medium: 23
• 🔵 Low: 2

Check the full report 👉 https://lambdawatchdog.com/
#AWS #Lambda #CVE #CloudSecurity #Serverless

Google API Keys Remain Usable for 23 Minutes After Deletion

Deleting a Google API key doesn't mean it's immediately useless to hackers - in fact, our experiments show it can remain active for up to 23 minutes, allowing attackers to continue misusing it even after you've tried to revoke access.

https://osintsights.com/google-api-keys-remain-usable-for-23-minutes-after-deletion?utm_source=mastodon&utm_medium=social

#CloudSecurity #ApiKeyManagement #CredentialMisuse #EmergingThreats #GoogleApiKeys