cloud security
Cloudflare Launches Bot Preference Sync for AI Traffic Management
Cloudflare has introduced Bot Preference Sync, a new feature designed to simplify the management of AI bot traffic. This tool automatically updates a website's robots.txt file to align with the user's AI bot configuration settings. The goal is to prevent discrepancies between stated preferences and enforced rules, ensuring better control over how AI crawlers access and use website content.
Hundreds of leaked AWS keys give full control over corporate accounts
Truffle Security has identified over 9,300 active AWS access keys exposed publicly between August 2022 and August 2026. Of these, 817 keys were linked to companies, with 526 being root keys and 242 granting full administrative privileges. This level of access allows attackers to potentially steal, delete, or manipulate cloud data and services, or deploy resource-intensive applications like cryptominers.
Microsoft Named Leader in Cloud Workload Protection Platforms Report
Frost & Sullivan has recognized Microsoft as a visionary leader in its 2026 Cloud Workload Protection Platforms report. The analysis highlights Microsoft's comprehensive approach to securing cloud-native architectures, emphasizing the need for runtime security that integrates code, cloud resources, identities, and operational data. Microsoft's Defender for Cloud platform was specifically noted for its broad coverage and integration within the company's security ecosystem.
Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets
Researchers discovered vulnerabilities in Anthropic's Claude Code and Google's Gemini CLI that allowed unprivileged attackers to execute code on CI runners. The flaws, which have been patched and assigned CVEs, involved issues with command validation and container launching. A separate finding related to OpenAI's Codex also allowed for the hijacking of agent runs, though OpenAI considers its sandbox to have behaved as documented.
NadMesh Botnet Targets Exposed AI Services for Cloud Credentials
A newly identified botnet written in Go, dubbed NadMesh, is actively scanning for and exploiting exposed AI services. The botnet specifically targets cloud environments, seeking to steal AWS keys and Kubernetes tokens from vulnerable AI platforms. Researchers have observed it scanning for services like ComfyUI and Ollama, which are often deployed without adequate security measures.
Accenture Confirms Security Incident After Hacker Claims 35GB Source-Code Theft
Accenture has acknowledged a security incident after a threat actor advertised what they claim is stolen internal data. The attacker, using the alias "888", says they took more than 35GB of source code and cloud credentials from the consulting giant and are offering it for sale. Accenture says it has addressed the source of the issue and that its operations were not disrupted.
Protecting Microsoft at AI speed: How SFI proactively hardens our cloud
Microsoft has developed an internal AI system to proactively evaluate and strengthen its cloud infrastructure. This system operates at AI speed to match the scale and complexity of Microsoft's hyper-scale environments, ensuring security controls are robust and effective. While not a customer-facing product, the insights gained will inform future product improvements.
Operationalizing Day Minus Seven: The Cloud-Native ROC
The article introduces the concept of a Risk Operations Center (ROC) as a necessary evolution for cybersecurity teams facing AI-driven threats. It argues that traditional risk management models are insufficient due to the speed at which AI can discover and exploit vulnerabilities, especially in cloud environments. A ROC, powered by platforms like Qualys Enterprise TruRisk Management (ETM), aims to unify disparate security findings, hyper-prioritize risks based on exploitability and business impact, and enable autonomous remediation to keep pace with attackers.
Blackpoint AI SOC Agent autonomously contains identity-based attacks
Blackpoint Cyber has released an AI-powered security agent designed to automatically detect and neutralize identity-based cyberattacks. This agent focuses on threats targeting cloud-based productivity suites like Microsoft 365 and Google Workspace. By leveraging a combination of artificial intelligence and human oversight, the system aims to significantly reduce the time it takes to contain compromised accounts and prevent further damage.
Threat Actors Uses Agentic AI to Rapidly Compromise Cloud Target
Researchers have identified threat actors leveraging agentic artificial intelligence to significantly speed up cloud compromises. What would typically take weeks of manual effort was accomplished in a mere 72 hours, demonstrating a new level of efficiency in cyberattacks.
Qualys Joins Cisco Cloud Control Studio as a Launch Partner to Bring Risk Intelligence to Agentic Operations
Qualys has partnered with Cisco to integrate its risk intelligence capabilities into Cisco's new Cloud Control Studio platform. This collaboration aims to provide joint customers with unified asset inventory, prioritized vulnerability findings, and automated remediation workflows directly within Cisco's AI-driven operational environment. The integration is designed to help security teams manage expanding attack surfaces and overwhelming alert volumes by providing context and enabling faster, more efficient responses.
5 insights from Frost & Sullivan’s 2025 Frost Radar™ for Cloud Security Posture Management
A new report from Frost & Sullivan highlights the evolving landscape of Cloud Security Posture Management (CSPM), which is shifting from a compliance-focused tool to an integrated governance layer within Cloud Native Application Protection Platforms (CNAPPs). The market is projected to grow significantly, driven by the need for continuous risk-based prioritization, code-to-cloud visibility, and platform consolidation to manage multicloud complexity. Artificial intelligence is also playing an increasing role in enhancing CSPM capabilities.
Improving security posture across the Microsoft partner ecosystem
Microsoft is detailing its strategy for enhancing security within its partner ecosystem, particularly focusing on Cloud Solution Providers (CSPs). These partners are crucial for deploying and managing Microsoft cloud services like Azure and Microsoft 365. The company aims to ensure the partner network remains healthy, compliant, and effective to deliver optimal customer outcomes.
Microsoft named a leader in the Frost Radar for cloud and application runtime security
A new report from Frost & Sullivan identifies Microsoft as a leader in cloud and application runtime security. The report highlights a market shift towards contextual risk reduction, focusing on how exposures combine across infrastructure and applications to create exploitable attack paths. Microsoft's position is attributed to its extensive ecosystem, the capabilities of Microsoft Defender for Cloud integrated with Defender XDR, and its large customer base.
From CI/CD to Cloud Data: How Shai Hulud Persistence Leads to Redshift Breach
A security incident involving Shai Hulud has been detailed, starting with a compromise in the CI/CD pipeline that led to the exposure of Jenkins credentials. This initial breach allowed for privilege escalation within AWS, ultimately resulting in unauthorized access to Redshift data.
Cloud Worm PCPJack Steals Credentials and Evicts TeamPCP Artifacts
A new credential theft framework dubbed PCPJack has been identified, capable of spreading across exposed cloud infrastructure. The tool not only harvests sensitive data from various cloud services but also actively removes artifacts associated with the threat actor group TeamPCP. PCPJack targets services like Docker, Kubernetes, and MongoDB, exfiltrating stolen information and seeking to infect additional systems.