Root on One Kubernetes Node Could Become Every Workload on It
Cryptographic workload identities cannot prove which process asked for them if an attacker controls the node making that claim. Unit 42 demonstrated the risk in SPIFFE/SPIRE.
Cloud Security
Hackers Searched 1.8 Million Android Apps for the Keys to Someone Else’s Business
A working app can still expose a key to private systems. Anthropic describes a 1.8 million-APK credential hunt in Claude-assisted criminal operations, while separate cases show how quickly stolen tokens can become wider access.
The Helpdesk Asked You to Upgrade Your Passkey. Then the Quiet Download Began.
The passkey was only the pretext. Microsoft says attackers are calling personal phones, capturing cloud sessions and quietly collecting files and email for hours or days.
Nine Years of Passport and Flight Data Sat Behind Default Credentials
Researchers reached a Vietnam-linked passenger-data cluster through a cloud path and default credentials. It contained 220,783,700 flight records, including passport details, but ownership and possible theft remain unconfirmed.
They Trusted Coder’s Registry. For 14 Hours, It Served Credential Stealers.
Attackers diverted Coder's trusted Terraform registry to malicious modules that searched provisioners for cloud keys, tokens, SSH credentials and secrets.
One Healthcare Archive Was Breached. 9.5 Million Patients Paid the Price.
A breach at Aesto Health reached 9.5 million people across at least two dozen providers, exposing medical, financial and identity data stored in AWS.
Hasbro Shut Down the Account. The Identity Data Was Already Gone.
Hasbro says a compromised employee account exposed personal and financial information. Massachusetts records identify 436 affected residents, while the worldwide total remains undisclosed.
Nutex Knows Data Left the Network. It Still Cannot Say Whose Data Was Taken.
Nutex Health has confirmed that an unauthorised party accessed its network and exfiltrated information from company servers. The healthcare operator knows that data left the environment. It does not yet know, or has not publicly disclosed, whether the stolen material…
They Never Became Customers. Their Identity Data Was Still in the Breach.
A Heights Finance cloud-platform breach reached borrowers, applicants and people who only enquired. Data retention turned a past interaction into a present risk.
The Login Was Legitimate. Russia-Linked Operators Turned OAuth and WhatsApp Linking Into Initial Access.
The login pages were real. The QR codes were real. The device-linking requests were real. That did not make them safe. Google Threat Intelligence Group has documented three suspected Russian cyber-espionage clusters that repeatedly turn legitimate authentication features into initial-access…