» Tag
cloud-security
14 postsMCP Security Needs Four Layers, Not Just a Gateway
Why MCP security requires four separate control layers beyond the gateway, backed by real CVEs and practical production controls.
221,000 Live Secrets Found in 7.6PB of Hugging Face Training Data
Researchers scanned 7.6PB of Hugging Face training data and found 221,303 live secrets — GitHub, GCP, database, and AI provider credentials.
CosmosEscape: How a Bug Exposed Every Azure Cosmos DB Account
A Gremlin API sandbox escape in Azure Cosmos DB exposed a master key capable of compromising any database on the service, Wiz Research found.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comContaining Financial Blast Radius from Bedrock and Marketplace Cloud Spend
A compromised AWS credential can turn into a major financial incident within hours via Bedrock and Marketplace. A DevOps governance model to limit blast radius before detection catches up.
Why AI Agents Should Propose Infrastructure, Not Execute It
AI agents with direct cloud API access risk emergent infrastructure mutations. A governance model splits propose, judge, and execute authority.
WriteOut Flaw in Writer AI Enabled Cross-Tenant Account Takeover
A critical flaw dubbed WriteOut let attackers hijack any Writer AI account by leaking session cookies through the platform's sandbox. Writer has since patched it.
Januscape: 16-Year-Old Critical Linux KVM Escape, PoC Public
CVE-2026-53359 (Januscape) is a critical Linux KVM guest-to-host escape in the shadow MMU, present since 2010; a public PoC causes host kernel panic.
AWS EKS Privilege Escalation: Pod Metadata to Cluster-Admin
How a compromised EKS pod can escalate to cluster-admin via EC2 metadata and node tokens, plus a persistent aws-auth backdoor technique.
Shark Vacuum AWS Cert Flaw Lets One Key Hijack an Entire Fleet's Root Shell
A stolen AWS certificate lets attackers run root commands on any Shark robot vacuum in the same cloud region, exposing cameras and Wi-Fi credentials.
AI Agents: Local Deployment, Label Workflows, Cloudflare Access
From Docker-based local AI agent systems to label-driven workflow orchestration and Cloudflare's temporary accounts, new patterns emerging in agent deployment.