kyber.today

daily cyber × ai intelligence

← index

tagged

[aws]

15 editions · 21 items

October 26, 2026

  • A researcher escaped the AWS MCP Server’s Python sandbox to execute commands as its Lambda user. The aws___run_script assessment found that attribute reads hidden inside pattern matching could bypass custom restrictions and recover capabilities needed to reach the underlying process. The exposed credentials belonged to an IAM role in an AWS-owned account, not the researcher’s customer account. AWS acknowledged the report on September 15 and said a fix was in progress; the work was conducted with assistance from Claude Opus 4.6. · AI & Agent Security
  • Aokigahara is stealing sessions and configuration from AI developer tools. Check Point Research found the new infostealer targeting Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI and other assistants alongside Git, SSH, AWS, Azure and Google Cloud credentials (analysis). The researchers have not confirmed that its operators reused or sold the stolen AI credentials. · AI & Agent Security

in PHP2Shell May Outlive the Patch

October 11, 2026

  • AWS Bedrock AgentCore gave up its IMDS credentials to a single prompt. Zenity Labs found AgentCore agents could reach their instance metadata endpoint — still IMDSv1 at the time — so an attacker with nothing but chat access to one exposed agent could extract temporary credentials, enumerate every other agent in the same AWS account and region, pull container images from ECR, and read users' agent session memory. Root cause: the Firecracker MicroVM provided insufficient network isolation, combined with overly broad permissions. Disclosed to AWS in December 2025. The Register (earlier coverage) · Cloud & Identity

in Microsoft's 17 Trillion-Row Analytics Service Fell to One Unchecked JWT

October 10, 2026

  • GhostAction is back: Socket counts 500+ GitHub accounts that committed a malicious workflow to tens of thousands of repos since 7 October, while StepSecurity traced two high-profile maintainer accounts — pyxel author Takashi Kitao (27 repos from 13:20 UTC) and athenadriver's Henry Wu (318 repos in a 16-minute burst, 21:10–21:26 UTC). The workflow (security-audit.yml / github_actions_security.yml) triggers on any push or tag, checks out with fetch-depth: 0, and curls named Actions secrets plus AWS, Anthropic, OpenAI, OpenRouter, GitHub and GitLab keys found anywhere in working tree or git history to 193.32.204[.]199 over plain HTTP. Initial access is assessed as leaked PATs from infostealer logs; the 2025 round exfiltrated 3,325 secrets from 817 repos across 327 users (The Hacker News). · Supply Chain & CI/CD

in Fake "Security Audit" Workflows Sweep GitHub for Cloud and AI Keys

October 9, 2026

  • The Shai-Hulud / ChainDrop worm jumped to AI infrastructure. Malicious tensorlake v0.5.144 carried a preinstall hook launching an obfuscated loader that runs the worm under Bun, harvesting AWS credentials, Kubernetes creds, Vault and CI secrets, crypto wallets, and configuration/MCP files for Claude, Cursor, Kiro, Windsurf and Zed, plus the HackBrowserData binary. It propagates by enumerating the victim's published packages, building Sigstore provenance and republishing them; C2 resolves through an Ethereum contract (iseekaigogo[.]com) with GitHub as fallback, and a PowerShell "hostage token" monitor polls api.github.com/user to check the stolen token is still valid. The version has been pulled from npm (The Hacker News, The Register). · AI & Model Security
  • One prompt to one agent took over every agent in an AWS account. Zenity Labs showed that a single publicly reachable agent on Bedrock AgentCore could be used to compromise all AgentCore agents in the same account and region, via an internal AWS temporary-credentials interface agents could reach without restriction. AWS has patched it and tightened default agent permissions (The Decoder, Dark Reading). · AI & Model Security

in Third NetScaler RCE in a Month Lands on the Same SAML Surface

September 26, 2026

  • TeamFiltration campaign hits Microsoft 365 with default passwords. Proofpoint tracks UNK_CondorFiltration, which targeted more than 5,700 accounts across 28 tenants from 1,487 unique AWS EC2 source IPs, compromising 7 accounts — primarily at Chilean retail and financial institutions (The Hacker News). · Cloud, CI/CD & Identity
  • AWS credential quarantine is only as good as your alerting. Unit 42 tracked updates to AWS's managed quarantine policies, tested the GitHub secret-scanning integration, and published logging strategies for detecting quarantine events (@Unit42_Intel). One practitioner's response captures the gap: @HoustonIntrove1 says a key was quarantined and "nobody noticed for two days because that CloudTrail event wasn't in any alert." · Cloud, CI/CD & Identity

in Kiteworks Orders a Global Shutdown on a Zero-Day Warning

September 23, 2026

  • AWS disclosed CVE-2026-94384 (CVSS 8.1) in the Amazon Connect Salesforce integration, a confused-deputy in the sfExecuteAWSService Lambda: it accepts caller-supplied parameters and dispatches API calls, letting a lower-privileged identity perform operations its own IAM policy explicitly denies. Affects Lambda versions 5.15 through 5.24.16 (AWS bulletin). · Cloud & Identity
  • Fake job-interview "coding assignments" are pushing DevOps engineers to run terraform init against typosquatted HashiCorp registries, pulling a malicious provider that drops the FLATROOF and ROOFDECK macOS backdoors and steals browser data, keychain secrets and cloud API keys before pivoting into AWS and GCP. SentinelOne ties the chain to the LayerZero/KelpDAO compromise and reports it resurfacing on an Indian IT-services engineer's Mac with no crypto exposure (SentinelOne Labs). · Supply Chain & Developer Tooling
  • ShinyHunters says it breached the FBI through an unpatched Oracle PeopleSoft zero-day on the bureau's jobs site, claiming pre-auth RCE, lateral movement onto FBI-managed servers in AWS GovCloud, and 2–3TB of data on current, former and prospective employees — allegedly touching HR, MedLink and CJIS. The group defaced fbijobs.gov, which is now offline "for maintenance," and says it wants no money: it is demanding the FBI retract a 15 May bulletin within a week. The FBI has not confirmed the breach, and neither Oracle nor AWS responded to inquiries (The Register, BleepingComputer). The group also named German dialysis firm Fresenius Medical Care as a victim (@DarkWebInformer); its Cl0p leak-site hijack ran in earlier coverage. · Threat Activity & Breaches

in Attack Chains That Run Themselves

September 21, 2026

  • AWS AgentCore Harness's default-enabled shell tool reaches into the same memory space where AgentCore Identity resolves credentials to plaintext, so prompt injection can steer an agent into exfiltrating them. Unit 42 examined the harness against the Identity vault and a downstream MCP server it authenticates to; encryption at rest, in transit, KMS and IAM gating all hold until the credential has to leave the vault to be used. AWS reviewed and closed the report as informative under the shared-responsibility model, pointing to allowedTools scoping and egress filtering as customer-side controls — which is also Unit 42's mitigation advice, alongside least-privilege vault service accounts and outbound traffic monitoring from harness containers (Unit 42). · AI & Model Security

in ShinyHunters Takes Cl0p's Leak Site Hostage

September 16, 2026

  • CVE-2026-39364 is being mass-scanned for cloud secrets on exposed Vite development servers. F5 Labs observed August requests targeting environment files, certificates, AWS and Azure configurations, Terraform state and Serverless configuration through a query-parameter bypass. Exploitation requires a network-exposed dev server, a target under server.fs.allow and a matching server.fs.deny rule; Vite’s default localhost binding is not internet-exposed (The Hacker News). · Vulnerabilities & Exploitation

in CVE-2026-76461 Gives Remote Attackers Root on Cisco Email Gateways

September 2, 2026

  • Langflow CVE-2026-0768 (CVSS 9.8) is under active exploitation for unauthenticated Python execution as root, with observed activity focused on harvesting OpenAI and AWS API keys from the low-code AI platform (BleepingComputer). VulnCheck ties the same campaign cluster to exploitation of a critical Rails flaw for credential probing and C2 (The Hacker News). · Exploited in the Wild
  • Fake IT support campaign drops a malicious MSI that sideloads a trojanized DLL via a signed binary, then uses WMI to launch a custom reverse shell tunnelled over localhost:9001 to an AWS API Gateway C2 — legitimate cloud fronting plus signed-binary proxy execution in one chain (Unit 42). · Threat Activity

in OpenAI Says Astra Crossed the Line: Autonomous Zero-Day Discovery at "Critical" Cyber Risk

August 14, 2026

  • The LiteLLM compromise is far larger than initially reported. New reporting from CloudSEK and Hudson Rock puts the blast radius at ~2,500 organizations — including Nvidia, AWS, and Samsung Electronics — with terabytes of credentials exfiltrated in a ~40-minute window and 434,000 CI/CD pipelines exposed (earlier coverage). Some commenters flagged it as possibly the largest credential compromise on record. (Ars Technica, discussion) · Supply Chain

in vCenter Under Active Exploitation: Critical RCE Weaponized for Reverse-SSH Persistence Across 47 Countries

July 1, 2026

  • Nextron tracked a threat actor running five concurrent spear-phishing campaigns against European defense and UAV supply-chain targets, all sharing one trick: AWS Cognito unauthenticated identity pools. Payloads (C#, Python, HTA) fetch fresh 15-minute STS credentials at runtime — no static keys to burn — and exfiltrate to attacker S3 buckets signed with hand-rolled SigV4. IOCs and detection rules published. Nextron (X) · Cloud & Identity

in CitrixBleed Returns: watchTowr Discloses a New NetScaler Pre-Auth Memory Overread