{"title":"Cloud advisories","description":"Cloud platform and SaaS advisories: stolen keys, exposed environment variables and tenant breaches.","home":"https://vulnpocalypse.dev/feeds/","items":[{"id":"https://vulnpocalypse.dev/advisories/apify-discloses-breach-rotates-api-tokens-and-urges-2fa-resets/","title":"Apify discloses breach, rotates API tokens and urges 2FA resets","url":"https://vulnpocalypse.dev/advisories/apify-discloses-breach-rotates-api-tokens-and-urges-2fa-resets/","date":"2026-11-12","summary":"BleepingComputer reports Apify says an unauthorized party accessed internal systems; affected users are told to reset 2FA in Apify Console.","tags":["breach","web","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/vexy-ransomware-group-claims-jhamf-group-on-its-leak-site-per-ransomlook/","title":"Vexy ransomware group claims JHAMF Group on its leak site, per RansomLook","url":"https://vulnpocalypse.dev/advisories/vexy-ransomware-group-claims-jhamf-group-on-its-leak-site-per-ransomlook/","date":"2026-11-12","summary":"RansomLook reports the Vexy ransomware group listed Colombian IT firm JHAMF Group on its leak site; customers should watch for an official notice.","tags":["breach","enterprise","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/securityweek-reports-dreeze-raises-33m-for-cloud-app-recovery/","title":"SecurityWeek reports Dreeze raises $33M for cloud app recovery","url":"https://vulnpocalypse.dev/advisories/securityweek-reports-dreeze-raises-33m-for-cloud-app-recovery/","date":"2026-11-11","summary":"SecurityWeek reports Dreeze says it raised $33 million for cloud app recovery; no flaw is reported, so no patching is needed.","tags":["ecosystem","cloud","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/palo-alto-networks-discloses-checkov-ssrf-flaw-cve-2026-0323/","title":"Palo Alto Networks discloses Checkov SSRF flaw CVE-2026-0323","url":"https://vulnpocalypse.dev/advisories/palo-alto-networks-discloses-checkov-ssrf-flaw-cve-2026-0323/","date":"2026-11-11","summary":"Palo Alto Networks says Checkov before 3.4.2 has an SSRF flaw, CVE-2026-0323; upgrade to 3.4.2 or later if external module downloads are on.","tags":["exploited","cloud","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/grok-app-builder-35578-public-grokme-apps-expose-data-and-passwords/","title":"Grok app builder: 35,578 public grok.me apps expose data and passwords","url":"https://vulnpocalypse.dev/advisories/grok-app-builder-35578-public-grokme-apps-expose-data-and-passwords/","date":"2026-11-11","summary":"Researchers found 35,578 of 37,571 Grok-built apps open without sign-in, some with passwords; check app access settings and unpublish unowned apps.","tags":["ai-tools","ai-tools","web","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/wiz-says-attacker-abused-qubole-aws-role-access-in-customer-breaches/","title":"Wiz says attacker abused Qubole AWS role access in customer breaches","url":"https://vulnpocalypse.dev/advisories/wiz-says-attacker-abused-qubole-aws-role-access-in-customer-breaches/","date":"2026-11-11","summary":"Wiz says an attacker used a Qubole AWS account to access customer AWS accounts; Qubole users should check CloudTrail logs from October 1 onward.","tags":["supply-chain","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/operation-snowball-jailbroken-ai-agent-hits-european-telecom/","title":"Operation Snowball: Jailbroken AI agent hits European telecom","url":"https://vulnpocalypse.dev/advisories/operation-snowball-jailbroken-ai-agent-hits-european-telecom/","date":"2026-11-11","summary":"A jailbroken AI agent attacked a European telecom and 13 hosted organizations for two weeks; patch Cisco BroadWorks CVE-2026-20320 now.","tags":["ai-tools","ai-tools","network-edge","enterprise","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/iris-ohyama-says-iris-plaza-cloud-breach-may-expose-77-million-people/","title":"Iris Ohyama says Iris Plaza cloud breach may expose 7.7 million people","url":"https://vulnpocalypse.dev/advisories/iris-ohyama-says-iris-plaza-cloud-breach-may-expose-77-million-people/","date":"2026-11-11","summary":"Iris Ohyama says unauthorized cloud access may have exposed data of 7.7 million Iris Plaza users, so change any reused Iris Plaza password now.","tags":["breach","cloud","web"]},{"id":"https://vulnpocalypse.dev/advisories/openssh-alpine-musl-password-auth-bypass/","title":"OpenSSH password bypass on Alpine and musl without PAM: locked accounts accept long passwords","url":"https://vulnpocalypse.dev/advisories/openssh-alpine-musl-password-auth-bypass/","date":"2026-11-11","summary":"On Alpine and musl systems with sshd built without PAM, a locked account accepts any long password. Update openssh and restart sshd.","tags":["exploited","open-source","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/beget-hosting-cyberattack-wipes-cloud-data-vps-and-kubernetes-backups-lost/","title":"Beget hosting cyberattack wipes cloud data, VPS and Kubernetes backups lost","url":"https://vulnpocalypse.dev/advisories/beget-hosting-cyberattack-wipes-cloud-data-vps-and-kubernetes-backups-lost/","date":"2026-11-11","summary":"Attackers reached Beget's management systems and ran wipe scripts, destroying VPS, cloud storage and Kubernetes data and all binary VPS backups.","tags":["breach","cloud","web","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/artex-ai-framework-exposed-korean-banks/","title":"ARTEX AI pentest operators exposed their own servers, revealing an agentic hacking campaign against South Korean banks","url":"https://vulnpocalypse.dev/advisories/artex-ai-framework-exposed-korean-banks/","date":"2026-11-11","summary":"Operators of the China-made ARTEX AI pentest framework left servers open, exposing Claude Code and DeepSeek-driven tooling tied to breaches at seven South.","tags":["ai-tools","ai-tools","enterprise","cloud","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/workos-artex-ai-breach/","title":"WorkOS says an attacker used the ARTEX AI agent to breach an internal sales app","url":"https://vulnpocalypse.dev/advisories/workos-artex-ai-breach/","date":"2026-11-11","summary":"On 30 October 2026 WorkOS found an attacker had used the ARTEX AI pentest agent to breach an internal sales app and read CRM and customer records.","tags":["ai-tools","ai-tools","enterprise","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/llmjacking-google-researchers-report-stolen-ai-access-bills-up-to-1-million/","title":"LLMJacking: Google researchers report stolen AI access bills up to $1 million","url":"https://vulnpocalypse.dev/advisories/llmjacking-google-researchers-report-stolen-ai-access-bills-up-to-1-million/","date":"2026-11-11","summary":"Google researchers report LLMJacking, where stolen cloud credentials run AI models at victim cost; watch AI service changes and rotate keys.","tags":["ai-tools","ai-tools","cloud","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/chainstack-discloses-breach-of-production-systems-exposing-customer-data/","title":"Chainstack discloses breach of production systems exposing customer data","url":"https://vulnpocalypse.dev/advisories/chainstack-discloses-breach-of-production-systems-exposing-customer-data/","date":"2026-11-11","summary":"Chainstack says an attacker accessed part of its production systems and customer data; rotate node credentials, API keys and passwords.","tags":["breach","crypto","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/northflank-breach-ai-key-abuse/","title":"Northflank breach leads to abuse of customers' AI API keys \u2014 rotate all secrets","url":"https://vulnpocalypse.dev/advisories/northflank-breach-ai-key-abuse/","date":"2026-11-11","summary":"Northflank disclosed a breach on 30 Oct 2026 after Wiz flagged it; customers report unauthorised AI API key use. Treat all env vars as compromised and rotate.","tags":["ai-tools","cloud","ai-tools"]},{"id":"https://vulnpocalypse.dev/advisories/black-october-ai-platform-breaches/","title":"Black October: nine AI developer platforms breached, stolen keys ran about 2.5M Bedrock calls","url":"https://vulnpocalypse.dev/advisories/black-october-ai-platform-breaches/","date":"2026-11-11","summary":"Nine AI developer platforms disclosed breaches in October 2026. Stolen keys from stored secrets drove about 2.5M Bedrock calls. Revoke, then rotate.","tags":["ai-tools","cloud","ai-tools"]},{"id":"https://vulnpocalypse.dev/advisories/binance-hot-wallet-theft-2026/","title":"Binance hack: $6.3B drained after attackers got its own systems to sign","url":"https://vulnpocalypse.dev/advisories/binance-hot-wallet-theft-2026/","date":"2026-11-11","summary":"On 29 Oct 2026 attackers got Binance's hot-wallet signing systems to sign withdrawals on ten chains, taking about $6.3B, reportedly via a DevOps laptop.","tags":["breach","crypto","cloud","ci-cd"]},{"id":"https://vulnpocalypse.dev/advisories/au-small-finance-bank-probes-salesforce-hosted-data-leak-after-scarlettgroup-ext/","title":"AU Small Finance Bank probes Salesforce-hosted data leak after ScarlettGroup extortion claim","url":"https://vulnpocalypse.dev/advisories/au-small-finance-bank-probes-salesforce-hosted-data-leak-after-scarlettgroup-ext/","date":"2026-11-11","summary":"AU Small Finance Bank is investigating a possible leak on a Salesforce-hosted platform after a group claimed it stole customer KYC and loan data; claims are","tags":["breach","enterprise","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/google-gemini-4-carbon-security/","title":"Google launches Gemini 4 Carbon, a frontier model it says improves automated vulnerability detection","url":"https://vulnpocalypse.dev/advisories/google-gemini-4-carbon-security/","date":"2026-11-11","summary":"Google released Gemini 4 Carbon (28 Oct 2026), a model it says leads at finding software vulnerabilities, via its limited Fairwind program. Not a breach.","tags":["ai-tools","ai-tools","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/xint-says-openai-api-compaction-flaw-exposed-hidden-model-reasoning/","title":"Xint says OpenAI API compaction flaw exposed hidden model reasoning","url":"https://vulnpocalypse.dev/advisories/xint-says-openai-api-compaction-flaw-exposed-hidden-model-reasoning/","date":"2026-11-11","summary":"Xint reports an OpenAI API compaction flaw exposed raw model reasoning; per Xint, OpenAI deployed a fix, and no client action is described.","tags":["ai-tools","ai-tools","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/attackers-abuse-microsoft-teams-external-chat-for-it-support-impersonation-and-m/","title":"Attackers abuse Microsoft Teams external chat for IT-support impersonation and malware delivery in under 15","url":"https://vulnpocalypse.dev/advisories/attackers-abuse-microsoft-teams-external-chat-for-it-support-impersonation-and-m/","date":"2026-11-11","summary":"Arctic Wolf saw over 400 incidents where attackers used external Teams chats and email bombing to get remote access and run payloads within 15 minutes.","tags":["ecosystem","enterprise","endpoint","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/symantec-reports-ai-attack-agent-built-to-hijack-exposed-model-endpoints/","title":"Symantec reports AI attack agent built to hijack exposed model endpoints","url":"https://vulnpocalypse.dev/advisories/symantec-reports-ai-attack-agent-built-to-hijack-exposed-model-endpoints/","date":"2026-11-11","summary":"Symantec reports an AI attack agent built to hijack unauthenticated OpenAI-style endpoints, so require authentication on any model endpoint you expose.","tags":["ai-tools","ai-tools","web","nextjs","cloud","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/railway-breach-rotate-all-environment-variables-and-secrets/","title":"Railway breach: rotate all environment variables and secrets","url":"https://vulnpocalypse.dev/advisories/railway-breach-rotate-all-environment-variables-and-secrets/","date":"2026-11-11","summary":"Railway confirmed attackers may have decrypted customer environment variables; rotate every secret stored there and review provider logs.","tags":["ai-tools","cloud","ci-cd","ai-tools"]},{"id":"https://vulnpocalypse.dev/advisories/edk2-pxe-rce-cve-2026-97631/","title":"TianoCore EDK II PXE driver pre-boot RCE (CVE-2026-97631): fixed on main, in no stable release yet","url":"https://vulnpocalypse.dev/advisories/edk2-pxe-rce-cve-2026-97631/","date":"2026-11-11","summary":"An EDK II PXE driver overflow can run code before the OS and Secure Boot. No stable fix yet: disable PXE where unused and isolate boot networks.","tags":["exploited","open-source","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/litellm-11070-on-pypi-and-docker-was-backdoored-with-a-credential-stealer-and-re/","title":"LiteLLM 1.107.0 on PyPI and Docker was backdoored with a credential stealer and remote code loader","url":"https://vulnpocalypse.dev/advisories/litellm-11070-on-pypi-and-docker-was-backdoored-with-a-credential-stealer-and-re/","date":"2026-11-11","summary":"LiteLLM 1.107.0 on PyPI and official Docker images ran a credential stealer on every Python start; roll back to 1.106.2 and rotate all reachable secrets.","tags":["supply-chain","pypi","ai-tools","open-source","ci-cd","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/ovhcloud-cli-release-assets-infostealer/","title":"OVHcloud CLI v0.11.0 to v0.15.0: GitHub release binaries and checksums.txt swapped for an infostealer for 94 minutes","url":"https://vulnpocalypse.dev/advisories/ovhcloud-cli-release-assets-infostealer/","date":"2026-11-11","summary":"OVHcloud CLI binaries for v0.11.0 to v0.15.0 fetched on 19 Oct 2026, 12:47 to 14:21 UTC, were an infostealer. Check MD5s, rotate secrets, install v0.16.0.","tags":["supply-chain","cloud","endpoint","ai-tools"]},{"id":"https://vulnpocalypse.dev/advisories/opencode-console-provider-key-breach/","title":"OpenCode Console breach: OpenAI, Anthropic and Google keys stored in workspaces may have been exposed","url":"https://vulnpocalypse.dev/advisories/opencode-console-provider-key-breach/","date":"2026-11-11","summary":"An intruder reached an OpenCode legacy system and may have exposed provider keys saved in OpenCode Console. Revoke those keys at OpenAI, Anthropic or Google.","tags":["ai-tools","ai-tools","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/crafty-falcon-ai-attacks-indian-nbfcs-payment-apis/","title":"CRAFTY FALCON: CERT-In warns AI-driven attacks are draining Indian BFSI through their own payment APIs","url":"https://vulnpocalypse.dev/advisories/crafty-falcon-ai-attacks-indian-nbfcs-payment-apis/","date":"2026-11-11","summary":"CERT-In advisory CIAD-2026-0058 names CRAFTY FALCON, an AI-assisted actor invoking Indian NBFC and fintech payment APIs to move funds at machine speed.","tags":["ai-tools","ai-tools","enterprise","cloud","web","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/socradar-reports-cve-2026-109469-cvss-10-entra-device-registration-flaw/","title":"SOCRadar reports CVE-2026-109469, CVSS 10 Entra device registration flaw","url":"https://vulnpocalypse.dev/advisories/socradar-reports-cve-2026-109469-cvss-10-entra-device-registration-flaw/","date":"2026-11-10","summary":"SOCRadar reports CVE-2026-109469, a CVSS 10 Entra device registration flaw; details are not confirmed, so verify against the NVD record.","tags":["exploited","cloud","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/researcher-says-100-flaws-found-in-uk-government-public-code-per-wired/","title":"Researcher says 100+ flaws found in UK government public code, per Wired","url":"https://vulnpocalypse.dev/advisories/researcher-says-100-flaws-found-in-uk-government-public-code-per-wired/","date":"2026-11-10","summary":"Wired reports a researcher says he found over 100 vulnerabilities in public UK government code; check your repos for committed secrets.","tags":["ai-tools","open-source","cloud","ai-tools","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/near-ai-breached-via-sglang-rce-flaw-18-agents-and-100-users-hit/","title":"NEAR AI breached via SGLang RCE flaw, 18 agents and 100 users hit","url":"https://vulnpocalypse.dev/advisories/near-ai-breached-via-sglang-rce-flaw-18-agents-and-100-users-hit/","date":"2026-11-10","summary":"An SGLang RCE flaw let an attacker into NEAR AI systems; users should check for direct mail from security@near.ai and be wary of unsolicited messages.","tags":["ai-tools","ai-tools","cloud","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/diraq-founder-claims-quantum-could-cut-ai-data-centre-energy-use/","title":"Diraq founder claims quantum could cut AI data centre energy use","url":"https://vulnpocalypse.dev/advisories/diraq-founder-claims-quantum-could-cut-ai-data-centre-energy-use/","date":"2026-11-10","summary":"ET Tech reports a founder's claim that quantum computers could cut AI data centre energy use; no security flaw is described, so no action.","tags":["ai-tools","ai-tools","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/datadog-claims-cloud-highcritical-flaws-rose-fourfold-since-may/","title":"Datadog claims cloud high/critical flaws rose fourfold since May","url":"https://vulnpocalypse.dev/advisories/datadog-claims-cloud-highcritical-flaws-rose-fourfold-since-may/","date":"2026-11-10","summary":"Infosecurity Magazine reports Datadog claims median high/critical cloud workload flaws rose from four to 16; review long-lived keys and dependency","tags":["ai-tools","cloud","ai-tools","ci-cd","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/wyndham-android-app-exposed-customer-data-via-hardcoded-credential/","title":"Wyndham Android app exposed customer data via hardcoded credential","url":"https://vulnpocalypse.dev/advisories/wyndham-android-app-exposed-customer-data-via-hardcoded-credential/","date":"2026-11-10","summary":"Wyndham confirmed an Android app hardcoded credential exposed customer data; it was revoked, so Wyndham members should watch for phishing.","tags":["exploited","cloud","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/varonis-says-notc2-poc-hides-c2-commands-in-aws-services/","title":"Varonis says NotC2 PoC hides C2 commands in AWS services","url":"https://vulnpocalypse.dev/advisories/varonis-says-notc2-poc-hides-c2-commands-in-aws-services/","date":"2026-11-09","summary":"Cyber Security News reports Varonis built NotC2, a proof-of-concept AWS C2 that needs stolen credentials; review IAM and SNS limits.","tags":["ai-tools","cloud","ai-tools"]},{"id":"https://vulnpocalypse.dev/advisories/mittwald-discloses-mcp-server-breach-of-56-projects-suspects-ai-use/","title":"Mittwald discloses MCP server breach of 56 projects, suspects AI use","url":"https://vulnpocalypse.dev/advisories/mittwald-discloses-mcp-server-breach-of-56-projects-suspects-ai-use/","date":"2026-11-09","summary":"Mittwald says hackers exploited a flaw in its MCP server to compromise 56 customer projects, if you host there, await its detailed account.","tags":["ai-tools","ai-tools","web","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/elastic-report-says-attackers-log-in-8-minutes-after-infostealer-hit/","title":"Elastic report says attackers log in 8 minutes after infostealer hit","url":"https://vulnpocalypse.dev/advisories/elastic-report-says-attackers-log-in-8-minutes-after-infostealer-hit/","date":"2026-11-09","summary":"Help Net Security reports Elastic says attackers logged in about 8 minutes after infostealer infections; review remote tools and sign-in methods.","tags":["ai-tools","ai-tools","endpoint","cloud","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/cpython-bug-enables-jinja-sandbox-escape-in-ai-inference-servers-runsybil-says/","title":"CPython bug enables Jinja sandbox escape in AI inference servers, RunSybil says","url":"https://vulnpocalypse.dev/advisories/cpython-bug-enables-jinja-sandbox-escape-in-ai-inference-servers-runsybil-says/","date":"2026-11-09","summary":"RunSybil reports a CPython bug it says lets a malicious model template escape the Jinja sandbox; treat untrusted model templates as code until patched.","tags":["ai-tools","ai-tools","open-source","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/digicert-data-breach-2026-11/","title":"DigiCert confirms data breach after a migration left an internal system exposed to the internet","url":"https://vulnpocalypse.dev/advisories/digicert-data-breach-2026-11/","date":"2026-11-09","summary":"A Feb 2025 migration exposed a DigiCert business system; unauthorised accounts read archived customer contact data and some ID documents. CA unaffected.","tags":["breach","enterprise","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/gitbook-breach-sso-flaw-led-to-infrastructure-access-api-tokens-revoked/","title":"GitBook breach: SSO flaw led to infrastructure access, API tokens revoked","url":"https://vulnpocalypse.dev/advisories/gitbook-breach-sso-flaw-led-to-infrastructure-access-api-tokens-revoked/","date":"2026-11-09","summary":"GitBook disclosed a November 2026 breach that exposed API tokens and integration secrets; create new GitBook API tokens and rotate connected secrets.","tags":["ai-tools","web","cloud","ai-tools","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/eclypsium-claims-ai-server-hardware-can-be-tampered-to-alter-chatbot-answers/","title":"Eclypsium claims AI server hardware can be tampered to alter chatbot answers","url":"https://vulnpocalypse.dev/advisories/eclypsium-claims-ai-server-hardware-can-be-tampered-to-alter-chatbot-answers/","date":"2026-11-09","summary":"Eclypsium says attackers with network access to DPUs or BMCs could alter AI model weights in memory; restrict that access and enable memory protections.","tags":["ai-tools","ai-tools","cloud","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/linux-kernel-tcp-cve-2026-98432/","title":"Linux kernel CVE-2026-98432: IPv4 TCP handshake use-after-free, with an AI-built remote root exploit","url":"https://vulnpocalypse.dev/advisories/linux-kernel-tcp-cve-2026-98432/","date":"2026-11-09","summary":"A race in Linux's IPv4 TCP handshake, present since 4.4, allows remote code execution. Install a fixed kernel or drop IPv4 packets carrying IP options.","tags":["exploited","open-source","cloud","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/gmo-internet-onamae-desktop-cloud-breach-leaks-data-draws-ransom-demand-and-unau/","title":"GMO Internet Onamae Desktop Cloud breach leaks data, draws ransom demand and unauthorized FX trades","url":"https://vulnpocalypse.dev/advisories/gmo-internet-onamae-desktop-cloud-breach-leaks-data-draws-ransom-demand-and-unau/","date":"2026-11-09","summary":"GMO Internet shut down its Onamae Desktop Cloud after a breach, an 8 billion yen extortion demand, a data leak and unauthorized trades on customer accounts.","tags":["breach","cloud","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/artex-agentic-ai-used-in-connectwise-supply-chain-attack-and-vapor-panda-espiona/","title":"ARTEX agentic AI used in ConnectWise supply chain attack and VAPOR PANDA espionage campaign","url":"https://vulnpocalypse.dev/advisories/artex-agentic-ai-used-in-connectwise-supply-chain-attack-and-vapor-panda-espiona/","date":"2026-11-09","summary":"China-aligned actors used the ARTEX agentic AI framework against ConnectWise customers and 200+ organizations, so review Microsoft 365 app access now.","tags":["supply-chain","ai-tools","cloud","enterprise","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/aoki-and-aokigahara-infostealers-target-ai-coding-assistant-credentials/","title":"Aoki and Aokigahara infostealers target AI coding assistant credentials","url":"https://vulnpocalypse.dev/advisories/aoki-and-aokigahara-infostealers-target-ai-coding-assistant-credentials/","date":"2026-11-09","summary":"Infostealers dubbed Aoki and Aokigahara steal AI coding assistant tokens and cloud keys, so rotate them if a developer machine may be infected.","tags":["ai-tools","ai-tools","endpoint","cloud","ci-cd","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/tensorlake-says-leaked-github-token-exposed-cloud-secrets-and-emails/","title":"Tensorlake says leaked GitHub token exposed cloud secrets and emails","url":"https://vulnpocalypse.dev/advisories/tensorlake-says-leaked-github-token-exposed-cloud-secrets-and-emails/","date":"2026-11-08","summary":"Tensorlake's Trust Center says a leaked GitHub token let an attacker read internal cloud secrets and customer emails; read its update.","tags":["breach","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/dosu-says-attacker-abused-org-invite-flaw-to-reach-its-db-ci-and-cloud/","title":"Dosu says attacker abused org-invite flaw to reach its DB, CI and cloud","url":"https://vulnpocalypse.dev/advisories/dosu-says-attacker-abused-org-invite-flaw-to-reach-its-db-ci-and-cloud/","date":"2026-11-08","summary":"Dosu says an attacker abused an org-invitation flaw to reach its database, CI and cloud; it advises customers to check logs for its listed indicators.","tags":["ai-tools","ci-cd","cloud","ai-tools"]},{"id":"https://vulnpocalypse.dev/advisories/stolen-entra-id-app-credentials-and-azure-devops-identities-used-to-breach-27-or/","title":"Stolen Entra ID app credentials and Azure DevOps identities used to breach 27 organizations","url":"https://vulnpocalypse.dev/advisories/stolen-entra-id-app-credentials-and-azure-devops-identities-used-to-breach-27-or/","date":"2026-11-08","summary":"Attackers used stolen Microsoft Entra ID app credentials and Azure DevOps identities to reach at least 27 organizations via MSPs, with no Microsoft flaw","tags":["breach","cloud","enterprise","ci-cd"]},{"id":"https://vulnpocalypse.dev/advisories/lxd-microcloud-cve-2026-112816/","title":"Canonical LXD and MicroCloud CVE-2026-112816: unverified mTLS client chain lets anyone impersonate a trusted client","url":"https://vulnpocalypse.dev/advisories/lxd-microcloud-cve-2026-112816/","date":"2026-11-08","summary":"LXD and MicroCloud accepted a trusted public certificate anywhere in a client's chain, enabling impersonation. Refresh to LXD 6.10.1, 5.21.9, 5.0.11 or 4.0.15.","tags":["exploited","cloud","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/the420in-reports-protesters-entered-microsoft-amsterdam-data-centre-site/","title":"The420.in reports protesters entered Microsoft Amsterdam data centre site","url":"https://vulnpocalypse.dev/advisories/the420in-reports-protesters-entered-microsoft-amsterdam-data-centre-site/","date":"2026-11-06","summary":"The420.in reports about 100 protesters entered a Microsoft data centre construction site near Amsterdam; no technical action is stated.","tags":["ecosystem","cloud"]}]}