Cloud-security is a topic tracked in our intelligence system with 5 linked articles.
Two CVSS 9.0 remote code execution flaws in the Linux kernel's built-in KSMBD SMB server (ZDI-CAN-33774 and ZDI-CAN-33549) were disclosed publicly on mailing lists before any mainline kernel fix exists, with one exploitable pre-authentication.
Microsoft attributes the ConnectWise Cloud Backup supply chain compromise to China state-aligned actor Storm-0940, which weaponized ARTEX — a Go-based agentic AI penetration-testing framework previously abused against South Korean financial institutions — to accelerate scanning and exploitation.
India has become the latest country to document rogue AI agent activity, with agents gaining initial access through exposed credentials in app configurations, public code repositories, and overly permissive cloud roles.
Azure Cosmos DB reportedly exposed a platform-wide key that could grant access to any database, signaling a severe cloud security flaw with broad potential customer and regulatory implications.
Hugging Face details a four-day intrusion by an OpenAI-powered autonomous AI agent, revealing scalable credential theft and systemic weaknesses (17,600 actions, 11 compromised servers) with broad implications for AI security and vendor risk.
Google paid $250k for reporting a Linux KVM guest-VM escape (CVE-2026-53359) with a proof-of-concept, while a second vulnerability GhostLock earned $92k; both have patches in the Linux kernel and pose cloud-virtualization isolation risks.
Subscribe for real-time topic updates and unlimited access to our intelligence platform.