37 article(s) in our index mention this organisation.
AWS has implemented a managed policy, AWSCompromisedKeyQuarantine, to proactively address the risk of exposed IAM access keys. This policy automatically attaches to IAM users whose credentials have been exposed, either t…
A former CrowdSec employee’s GitHub account was used to copy approximately 170 private GitHub repositories, including sensitive data like email addresses, investor details, and internal code, following a supply chain att…
Unit 42 researchers discovered a significant security vulnerability in AWS AgentCore Harness, a managed runtime for AI agents. Due to a default configuration, the built-in shell tool runs as root, allowing attackers to e…
Researchers have discovered a new hardware attack, DDRop, that breaks the memory protection offered by Intel TDX and AMD SEV-SNP, two key technologies used in cloud computing to protect customer data. The attack involves…
A recent study by Intruder found significant differences in cloud security configurations across major providers – AWS, Azure, and Google Cloud. While some issues like weak identity and access management were prevalent a…
Catch, an AI executive assistant startup, has raised $5 million to enhance its agentic admin assistant, designed to handle sensitive executive tasks like scheduling and communications while prioritizing security and user…
The article highlights a growing concern among CISOs that traditional vulnerability management – relying on a massive influx of CVEs and subjective CVSS scores – is no longer sufficient to meet the demands of modern boar…
Researchers at the University of Toronto have developed GPUThor, a Rowhammer attack that bypasses ECC memory protection on NVIDIA Ampere-class workstation GPUs (A4000, A5000, A6000) to achieve denial-of-service and privi…
Xpander, a startup founded by former AWS engineers, has secured $7.5 million in seed funding to help organizations manage and deploy AI agents. The platform aims to simplify AI adoption and governance for businesses stru…
Over 2,500 organizations and 434,000 CI/CD pipelines were impacted by a supply chain attack involving the LiteLLM AI library. The attack stemmed from a compromised version of Aqua Security’s Trivy vulnerability scanner,…
CISA has released updated guidance on Software Bill of Materials (SBOMs), adding 10 new elements and refining existing ones to improve comprehensiveness. However, critics, like OWASP founder Jeff Williams, argue that the…
A security flaw in AWS Kiro, an AI coding assistant, allowed an attacker to rewrite its configuration file and execute arbitrary code on a developer's machine simply by inserting malicious text into a seemingly innocuous…
A Go botnet called NadMesh is actively targeting exposed AI services and cloud infrastructure, specifically seeking AWS keys, Kubernetes tokens, and Docker API access. The botnet, discovered by XLab and previously identi…
A SANS Internet Storm Center analysis reveals a widespread scanning campaign targeting servers to identify and exploit vulnerabilities related to AI assistants and local Large Language Models (LLMs). The scans are active…
AI coding assistants like Claude Code, Amazon Q Developer, and Cursor are vulnerable to a decades-old technique called GhostApproval, where attackers can trick the tools into accessing and modifying sensitive system file…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four actively exploited vulnerabilities to its KEV catalog, including flaws in Adobe ColdFusion, JoomShaper SP Page Builder, and Langflow. These…
North Korean-linked threat actors are deploying malicious npm packages that mimic Rollup polyfill tooling to steal developer secrets. These packages, including 'rollup-packages-polyfill-core' and 'rollup-runtime-polyfill…
This article reports on a significant investment by IBM and Red Hat into Project Lightwell, a new service designed to address the growing challenge of securing open-source software supply chains. Driven by Anthropic's My…
A security firm, Sysdig, has identified what appears to be the first fully automated ransomware attack orchestrated by an AI agent, dubbed JADEPUFFER. The agent exploited a vulnerability in Langflow, an open-source AI ap…
A high-severity vulnerability was discovered in the Amazon Q Developer extension for Visual Studio Code, allowing attackers to steal cloud credentials through malicious code repositories. The extension’s automatic execut…
