Cloud infrastructure security, misconfigurations, and platform vulnerabilities.
The convergence of AI adoption and cloud infrastructure is creating attack surfaces that legacy security models can't protect. …
Drone strikes on three Yandex data centers reveal how kinetic attacks can collapse cloud services overnight. The lesson …
The GhostAction supply chain attack has compromised hundreds of maintainer accounts to inject credential-stealing GitHub Actions workflows across …
OAuth grants bypass SSO, MFA, and user lifecycle controls — creating persistent access paths attackers actively exploit. Shield53 examines why token governance is now a board-level risk and …
Browser and identity-layer attacks bypass endpoint artifacts entirely. Shield53 analyzes why EDR blind spots are growing as SaaS adoption outpaces host-centric detection models.
Microsoft's general availability of native Linux containers in WSL changes the endpoint threat surface. With wslc.exe now on every developer machine, security teams must move quickly to establish …
Cloudflare's entry into the public CA space with post-quantum-ready certificates signals an accelerating shift in how TLS infrastructure is provisioned and how organizations should plan their cryptographic migration …
Over 16,000 misconfigured Supabase databases are exposing PII, passwords, and auth tokens. The root cause isn't a platform flaw — it's the security blind spot created when AI …
Microsoft's disclosure of Storm-3168 attacks against Azure shows AI agents compressing the destructive kill chain to seven minutes. Shield53 on why service principal hygiene and resource locks are …
An AI-augmented threat actor abused exposed credentials to destroy Azure-hosted storage, apps, and databases. The attack pattern signals a shift from data theft to cloud-native destructive operations with …
JADEPUFFER's pivot from LLM-driven ransomware to destructive Azure operations via compromised service principals exposes a critical gap in cloud identity governance. The attack pattern — pure destruction without …
Cloudflare fixed a serious multi-tenant isolation flaw in Containers that allowed Workers Paid customers to read residual data from other tenants' disks. The root cause: a block-zeroing shortcut …
A thin provisioning misconfiguration in Cloudflare Containers exposed residual customer data across tenant boundaries. The flaw highlights persistent isolation challenges in shared infrastructure and raises questions about sandbox …
Dark Reading's SASE framework guide highlights a growing reality — most organizations fail at SASE not because of bad products, but because of poor governance and phased migration …
Forgotten service accounts in Microsoft 365 are becoming a preferred vector for data theft. Shield53 analyzes why identity hygiene failures persist and what defenders must do now.
The UNK_CondorFiltration campaign exposed a glaring truth: non-human identities with default passwords and no MFA remain invisible to most M365 defenders. Seven compromises across 5,700 sprayed accounts proves …
Shield53 analyzes the shift toward consolidated SASE platforms and explains why convergence alone doesn't solve the identity, visibility, and misconfiguration challenges that distributed enterprises still face.
Google Kubernetes Config Connector centralizes cloud provisioning under a single powerful service account — but that convenience creates a confused deputy risk that can hand a low-privilege Kubernetes …
Varonis Threat Labs' TrustSink technique shows how compromised privileged Entra accounts can register rogue external authentication providers to silently harvest plaintext passwords during legitimate login flows — and …
Microsoft is retiring the Calendar, People, and Files companion apps on December 16, 2026. Shield53 sees this as an opportunity to audit auto-installed taskbar app sprawl and accelerate …
A 2017 UK police risk assessment flagged Microsoft Azure data access by US government insiders. Nine years later, the fundamental issue—encryption doesn't stop the provider—remains unresolved for law …
Elastic Security Labs outlines a plan-first methodology for cloud threat emulation that challenges the endpoint-centric testing habits many teams still carry. Shield53 analyzes why this shift matters and …
OAuth consent abuse bypasses MFA entirely because the user legitimately authenticates and authorizes the malicious app. Shield53 analyses why traditional identity controls fall short and what defenders must …
As reported by BleepingComputer, Microsoft 365's frictionless sharing model creates persistent over-privilege risks that most organizations can't see. Shield53 breaks down why identity-centric governance, not bolt-on tooling, is …
Microsoft's decision to let Teams admins customize blocked file extensions is a step forward, but organizations shouldn't wait for November to tighten their collaboration security posture. Here's what …
Real-world Google Workspace breaches increasingly combine social engineering with malicious OAuth app abuse. Shield53 breaks down why lean security teams must prioritize SaaS identity controls over exhaustive checklists.
Google Workspace is now identity infrastructure for thousands of organizations, and attackers are exploiting OAuth and social engineering to compromise it. The decisions defenders make in the first …
Malicious OAuth apps bypass MFA and password policies entirely. Shield53 analyzes why Google Workspace environments remain broadly exposed to consent-phishing and what defenders should prioritize now.
Microsoft's disclosure of passkey-themed phishing and AI-augmented BEC campaigns reveals a troubling truth: attackers are adapting faster than defenders are hardening. Passkeys reduce but don't eliminate social engineering …
Threat actors are abusing Microsoft Graph API to map corporate environments and hand off stolen access to extortion groups like ShinyHunters. Defenders must rethink identity-centric monitoring and BYOD …
Wiz Research found ~10% of internet-facing LiteLLM gateways accepted the default 'sk-1234' admin key, exposing provider API keys and cloud IAM credentials. The real issue is how AI …
Third-party app integrations granted months or years ago persist silently in Google Workspace environments, creating overlooked breach paths. Shield53 examines why OAuth token sprawl is a top SaaS …
Chainguard's milestone of 1 billion container build manifests highlights a fundamental shift in how organizations must approach container security — from periodic patching to continuous, verifiable rebuilds. The …
An exposed Elasticsearch cluster holding 220 million APIS records from 2017–2026 shows how chained misconfigurations and default credentials can transform regulated travel data into a surveillance-ready dataset.
Intruder's 2026 Cloud Security Index reveals that misconfiguration risk profiles across AWS, Azure, and GCP share almost nothing in common. Uniform checklists are structurally inadequate for multi-cloud environments, …
Microsoft's Exchange Online outage (EX1467029) caused significant email delivery delays with 'Server busy' errors, now resolved for new messages. Shield53 analyzes the security implications of cloud dependency and …
Elastic Security Labs demonstrates that Kubernetes audit logs and container runtime data each tell half the story. Without cross-plane correlation, defenders miss container escapes that process events never …
Aesto Health's AWS infrastructure breach exposing 9.5M patient records underscores persistent cloud credential and IAM weaknesses in healthcare third-party data custodians. Defenders must rethink cloud access governance and …
Snowflake is forcing legacy service accounts off password auth by October 2026. The mechanical migration is straightforward; the real challenge is inventorying, attributing, and right-sizing thousands of orphaned …
Nigeria's sovereign cloud initiative signals a broader trend: data residency is now a national security imperative. But sovereignty without security maturity creates new attack surfaces and vendor lock-in …
Truffle Security's four-year audit reveals hundreds of live, high-privilege AWS keys still circulating in public repositories. The real failure isn't detection — it's the absence of rotation, root …
The CareCloud breach exposing 3.7 million patients reveals systemic weaknesses in healthcare cloud security and third-party vendor risk. Shield53 analyzes the AWS access vector, notification delays, and what …
Researchers demonstrated a remote Spectre attack leaking JWTs from co-located Cloudflare Workers at 12 bits/second, exposing fundamental limitations in language-level isolation. Cloudflare has mitigated the issue, but the …
A Python-based framework operating entirely within Microsoft cloud is a wake-up call for defenders still relying on endpoint-centric detection. Shield53 breaks down why cloud-resident threats demand a fundamentally …
A single attacker has spent over a year scraping Salesforce and ServiceNow portals using nothing more than over-privileged guest identities. The real story isn't the tooling — it's …
A threat actor selling 3.6 million Azure account records underscores a persistent truth: cloud breaches rarely stem from platform vulnerabilities. They stem from identity failures. Shield53 analyzes the …
Attackers are bypassing traditional email security entirely by stealing OAuth tokens, granting persistent access to Gmail, Drive, and connected SaaS systems. Organizations relying solely on phishing defenses are …
A targeted data theft campaign dubbed 'City-Forum' is actively exploiting misconfigured Salesforce Experience Cloud and ServiceNow portals. Shield53 breaks down why this matters and what defenders must do …
The Snowflake extortion campaign remains a defining case study in cloud security failure. Moucka's guilty plea should force every enterprise to reassess MFA enforcement, credential hygiene, and third-party …
The guilty plea of Connor Moucka underscores how a single credential harvesting campaign can cascade into billions of stolen records. Defenders must rethink SaaS access controls before the …
A Canadian national's guilty plea in the Snowflake cloud data-theft campaign exposes systemic gaps in SaaS credential hygiene and MFA adoption. Shield53 examines what defenders must learn from …
GitGuardian found 321 live n8n instances exposed via leaked API tokens in public GitHub commits. Shield53 breaks down why automation platforms are high-value targets and what defenders must …
Amgen's cloud data breach highlights the systemic third-party risk facing pharmaceutical organizations. When patient health data and proprietary research collide in shared cloud environments, the blast radius extends …
A sandbox escape in Azure Cosmos DB's Gremlin API could have granted attackers read/write access to databases across all customer tenants. Shield53 breaks down the blast radius and …
Non-human identity sprawl is quietly undermining cloud security postures across enterprises. Expert analysis on why dormant service accounts and ghost credentials represent one of the most underestimated attack …
Confused deputy flaws in Google Cloud and Microsoft Azure allow attackers to silently escalate privileges and bypass access controls. These architectural weaknesses demand immediate attention from cloud security …
A maintenance automation bug took down Azure and Microsoft 365 at scale. Shield53 examines what this means for enterprise resilience, dependency risk, and how defenders should plan for …
A chain of flaws in Azure Automation — including a dangerous default-public configuration — could have enabled cross-tenant identity takeover. Shield53 breaks down the risk and what cloud …
A Microsoft Exchange Online false-quarantine incident highlights the operational risks of centralized cloud email dependencies. Security and IT teams should treat platform-level disruptions as part of their threat …
Lifetime cloud storage promotions are trending, but bargain pricing often comes at the cost of security rigor, compliance, and long-term reliability. Here's what security-conscious users should evaluate before …
Google Cloud's bet on agentic AI defense raises critical questions about automation trust, adversarial AI, and whether defenders can truly stay ahead. Shield53 breaks down what security teams …
Two threat actors are exploiting OAuth client ID spoofing to validate stolen credentials in Microsoft Entra ID without triggering sign-in alerts. This telemetry-blind technique poses serious risks to …
As Entra ID becomes a prime attacker target, hands-on CTF training like Varonis's Breach at the Beach offers defenders a rare chance to practice real investigation techniques in …
A lone attacker leveraged AI tooling and chained cloud misconfigurations to compromise an AWS environment and launch an extortion campaign. This incident redefines the threat model for cloud …
A critical lateral movement flaw in Google Dialogflow CX allowed a compromised agent to hijack others in the same Cloud project — intercepting live conversations and injecting attacker-controlled …
Traditional CI security scanners are failing to catch sophisticated GitHub Actions attack chains, creating a dangerous false sense of security in software supply chains. Here's what defenders need …
Microsoft's new Cloud Rebuild feature for Windows 11 introduces powerful recovery capabilities, but raises important questions about data sovereignty, network dependency, and attack surface expansion that security teams …
A sophisticated password spray campaign dubbed LSHIY has targeted Azure CLI environments across 64 organizations with 81 million login attempts. Shield53 analysts break down why this matters and …
A sustained automated password spray campaign targeting Azure CLI has compromised at least 78 accounts across 81M+ attempts. Shield53 breaks down why IPv6-sourced attacks are straining traditional defenses.
Unauthenticated AI endpoints are being hijacked to power offensive operations, turning enterprise AI investments into attacker infrastructure. Shield53 breaks down the risk, who's exposed, and how to respond.
Microsoft's new admin policy for Teams meeting bot approvals addresses a genuine but underappreciated attack surface. Here's why defenders should care and how to deploy it effectively.
Salesforce has disabled the Klue Battlecards app integration following a security incident involving OAuth token abuse. Organizations remain locked out of the connection until further notice.
For nearly a decade, adversary tooling silently hammered Azure AD Graph APIs with zero defender visibility. That gap has closed — here's how to ingest the logs and …
A critical misconfiguration in FIFA's Microsoft Entra access controls left live World Cup streaming infrastructure exposed to remote takeover. The flaw could have enabled threat actors to disrupt …
A critical mail flow pipeline failure has left Exchange Online users in North America and Germany unable to send or receive emails for hours, with Microsoft scrambling to …
A cross-service incident is preventing Microsoft Teams and Office for the web users from accessing files, marking the latest in a series of platform stability issues affecting enterprise …
Critical infrastructure failure disrupts multi-factor authentication setup and sign-in services for enterprise customers worldwide, exposing risks in centralized identity management.
Security researcher documents Azure Backup vulnerability fix despite Microsoft's denial, raising questions about transparency in cloud security patching and CVE assignment authority.
A configuration mishap in Microsoft's Windows 365 platform prevents Office installations, exposing the fragility of cloud-dependent enterprise workflows and the cascading effects of service disruptions.
Enterprise printing service experiences share creation failures due to API modifications that exposed underlying race conditions in Microsoft's cloud infrastructure.
Popular development platform Vercel disclosed unauthorized access to internal systems after threat actors claimed to steal employee data, API keys, and source code.
ShinyHunters cybercriminals exploited a Salesforce misconfiguration at McGraw Hill, exposing personal data of 13.5 million users including names, addresses, and contact information.
Microsoft distributed $2.3 million to researchers who uncovered 80+ high-impact vulnerabilities in cloud and AI systems during their annual security contest, exposing concerning attack vectors.
McGraw-Hill confirmed cybercriminals exploited a Salesforce platform vulnerability to access company data, while extortion group ShinyHunters claims to hold 45 million records containing personal information.
Major security platform expansion delivers comprehensive coverage for macOS environments, cloud security posture management, email threat detection, and SIEM migration capabilities through native integrations.
A new report from Orca Security reveals that high-severity cloud security alerts tripled in 2024, signaling a concerning trend in cloud infrastructure risks.
A critical vulnerability (CVE‑2025‑53786) has been identified in Microsoft Exchange Server hybrid deployments, enabling attackers who already have on‑premises administrative access to escalate their privileges into connected Microsoft …