Cloud Security
AWS and cybersecurity vendors have made several announcements at the cloud giant’s re:Invent 2025 event.
Hi, what are you looking for?
SecurityWeek
Cloud Security
A total of 22 patches were releaased, a majority for code execution, privilege escalation, and information disclosure vulnerabilities.
Cloud Security
A threat actor is claiming the exfiltration of millions of records from McDonald’s, TCS, Vodafone, and other large organizations.
Artificial Intelligence
Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries...
Cloud Security
Named CosmosEscape, the vulnerability exposed the primary key for Cosmos DB accounts, granting full read and write access.
Cloud Security
Five flaws in the open source tool may lead to path traversal attacks, remote code execution, denial-of-service, and tag manipulation.
Cloud Security
Intel and AMD have published advisories after academics disclosed details of the new TEE.fail attack method.
Cloud Security
A vulnerability in RMP initialization allows the AMD processor’s x86 cores to maliciously control parts of the initial RMP state.
Cloud Security
Authenticated attackers can exploit the security flaw to trigger a use-after-free and potentially execute arbitrary code.
Cloud Security
Wiz has teamed up with Microsoft, Google and AWS and is inviting cloud security researchers to its Zeroday.Cloud competition.
Cloud Security
Intel and AMD say the research is not in scope of their threat model because the attack requires physical access to a device.
Cloud Security
New framework from the Cloud Security Alliance helps SaaS customers navigate the shared responsibility model with confidence.
Cloud Security
All Microsoft Entra Tenants Were Exposed to Silent Compromise via Invisible Actor Tokens: Researcher
The strength of responsible disclosure is that it can solve problems before they are actioned. The weakness is that it potentially generates a false...
Cloud Security
L1TF Reloaded is a vulnerability combining the old L1TF and half-Spectre hardware flaws to bypass deployed software mitigations.
Cloud Security
Exploiting incomplete speculative execution attack mitigations extended to the branch predictor state, VMScape leaks arbitrary memory.
Cloud Security
The Midnight Blizzard cyberspies used compromised websites to trick users into authorizing devices they controlled.
Cloud Security
Storm-0501 has been leveraging cloud-native capabilities for data exfiltration and deletion, without deploying file-encrypting malware.
Cloud Security
A critical vulnerability in Docker Desktop allows attackers to modify the filesystem of Windows hosts to become administrators.
Cloud Security
Silk Typhoon was seen exploiting n-day and zero-day vulnerabilities for initial access to victim systems.
Cloud Security
AWS has addressed a vulnerability that could have been leveraged to bypass Trusted Advisor’s S3 bucket permissions check.
Cloud Security
Wiz researchers discovered NVIDIAScape, an Nvidia Container Toolkit flaw that can be exploited for full control of the host machine.
Cloud Security
Virtual event brings together leading experts, practitioners, and innovators for a full day of insightful discussions and tactical guidance on evolving threats and real-world...
Cloud Security
Founded in 2015, the Tel Aviv based company has now raised more than $1 billion and claims more than 3,500 customers.
Cloud Security
Cloud security startup Circumvent has raised $6 million to develop a network of agents for autonomous prioritization and remediation.
Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs.
RegisterIn this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk.
RegisterExpert Insights
For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality.
(Danelle Au)
Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop.
(Torsten George)
Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk.
(Tod Beardsley)
The skills that get a CISO hired are rarely the skills they are judged on later. Most security leaders are stuck in that gap. Closing it is the real job.
(Sravish Sridhar)
As AI dramatically shortens the time from vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk.
(Joshua Goldfarb)