https://vulnpocalypse.dev/feeds/Cloud platform and SaaS advisories: stolen keys, exposed environment variables and tenant breaches.enThu, 12 Nov 2026 16:59:02 +0000https://vulnpocalypse.dev/advisories/apify-discloses-breach-rotates-api-tokens-and-urges-2fa-resets/https://vulnpocalypse.dev/advisories/apify-discloses-breach-rotates-api-tokens-and-urges-2fa-resets/Thu, 12 Nov 2026 12:00:00 +0000BleepingComputer reports Apify says an unauthorized party accessed internal systems; affected users are told to reset 2FA in Apify Console.breachwebcloudhttps://vulnpocalypse.dev/advisories/vexy-ransomware-group-claims-jhamf-group-on-its-leak-site-per-ransomlook/https://vulnpocalypse.dev/advisories/vexy-ransomware-group-claims-jhamf-group-on-its-leak-site-per-ransomlook/Thu, 12 Nov 2026 12:00:00 +0000RansomLook reports the Vexy ransomware group listed Colombian IT firm JHAMF Group on its leak site; customers should watch for an official notice.breachenterprisecloudhttps://vulnpocalypse.dev/advisories/securityweek-reports-dreeze-raises-33m-for-cloud-app-recovery/https://vulnpocalypse.dev/advisories/securityweek-reports-dreeze-raises-33m-for-cloud-app-recovery/Wed, 11 Nov 2026 12:00:00 +0000SecurityWeek reports Dreeze says it raised $33 million for cloud app recovery; no flaw is reported, so no patching is needed.ecosystemcloudenterprisehttps://vulnpocalypse.dev/advisories/palo-alto-networks-discloses-checkov-ssrf-flaw-cve-2026-0323/https://vulnpocalypse.dev/advisories/palo-alto-networks-discloses-checkov-ssrf-flaw-cve-2026-0323/Wed, 11 Nov 2026 12:00:00 +0000Palo Alto Networks says Checkov before 3.4.2 has an SSRF flaw, CVE-2026-0323; upgrade to 3.4.2 or later if external module downloads are on.exploitedcloudopen-sourcehttps://vulnpocalypse.dev/advisories/grok-app-builder-35578-public-grokme-apps-expose-data-and-passwords/https://vulnpocalypse.dev/advisories/grok-app-builder-35578-public-grokme-apps-expose-data-and-passwords/Wed, 11 Nov 2026 12:00:00 +0000Researchers found 35,578 of 37,571 Grok-built apps open without sign-in, some with passwords; check app access settings and unpublish unowned apps.ai-toolsai-toolswebcloudhttps://vulnpocalypse.dev/advisories/wiz-says-attacker-abused-qubole-aws-role-access-in-customer-breaches/https://vulnpocalypse.dev/advisories/wiz-says-attacker-abused-qubole-aws-role-access-in-customer-breaches/Wed, 11 Nov 2026 12:00:00 +0000Wiz says an attacker used a Qubole AWS account to access customer AWS accounts; Qubole users should check CloudTrail logs from October 1 onward.supply-chaincloudhttps://vulnpocalypse.dev/advisories/operation-snowball-jailbroken-ai-agent-hits-european-telecom/https://vulnpocalypse.dev/advisories/operation-snowball-jailbroken-ai-agent-hits-european-telecom/Wed, 11 Nov 2026 12:00:00 +0000A jailbroken AI agent attacked a European telecom and 13 hosted organizations for two weeks; patch Cisco BroadWorks CVE-2026-20320 now.ai-toolsai-toolsnetwork-edgeenterprisecloudhttps://vulnpocalypse.dev/advisories/iris-ohyama-says-iris-plaza-cloud-breach-may-expose-77-million-people/https://vulnpocalypse.dev/advisories/iris-ohyama-says-iris-plaza-cloud-breach-may-expose-77-million-people/Wed, 11 Nov 2026 12:00:00 +0000Iris Ohyama says unauthorized cloud access may have exposed data of 7.7 million Iris Plaza users, so change any reused Iris Plaza password now.breachcloudwebhttps://vulnpocalypse.dev/advisories/openssh-alpine-musl-password-auth-bypass/https://vulnpocalypse.dev/advisories/openssh-alpine-musl-password-auth-bypass/Wed, 11 Nov 2026 12:00:00 +0000On Alpine and musl systems with sshd built without PAM, a locked account accepts any long password. Update openssh and restart sshd.exploitedopen-sourcecloudhttps://vulnpocalypse.dev/advisories/beget-hosting-cyberattack-wipes-cloud-data-vps-and-kubernetes-backups-lost/https://vulnpocalypse.dev/advisories/beget-hosting-cyberattack-wipes-cloud-data-vps-and-kubernetes-backups-lost/Wed, 11 Nov 2026 12:00:00 +0000Attackers reached Beget's management systems and ran wipe scripts, destroying VPS, cloud storage and Kubernetes data and all binary VPS backups.breachcloudwebenterprisehttps://vulnpocalypse.dev/advisories/artex-ai-framework-exposed-korean-banks/https://vulnpocalypse.dev/advisories/artex-ai-framework-exposed-korean-banks/Wed, 11 Nov 2026 12:00:00 +0000Operators of the China-made ARTEX AI pentest framework left servers open, exposing Claude Code and DeepSeek-driven tooling tied to breaches at seven South.ai-toolsai-toolsenterprisecloudopen-sourcehttps://vulnpocalypse.dev/advisories/workos-artex-ai-breach/https://vulnpocalypse.dev/advisories/workos-artex-ai-breach/Wed, 11 Nov 2026 12:00:00 +0000On 30 October 2026 WorkOS found an attacker had used the ARTEX AI pentest agent to breach an internal sales app and read CRM and customer records.ai-toolsai-toolsenterprisecloudhttps://vulnpocalypse.dev/advisories/llmjacking-google-researchers-report-stolen-ai-access-bills-up-to-1-million/https://vulnpocalypse.dev/advisories/llmjacking-google-researchers-report-stolen-ai-access-bills-up-to-1-million/Wed, 11 Nov 2026 12:00:00 +0000Google researchers report LLMJacking, where stolen cloud credentials run AI models at victim cost; watch AI service changes and rotate keys.ai-toolsai-toolscloudenterprisehttps://vulnpocalypse.dev/advisories/chainstack-discloses-breach-of-production-systems-exposing-customer-data/https://vulnpocalypse.dev/advisories/chainstack-discloses-breach-of-production-systems-exposing-customer-data/Wed, 11 Nov 2026 12:00:00 +0000Chainstack says an attacker accessed part of its production systems and customer data; rotate node credentials, API keys and passwords.breachcryptocloudhttps://vulnpocalypse.dev/advisories/northflank-breach-ai-key-abuse/https://vulnpocalypse.dev/advisories/northflank-breach-ai-key-abuse/Wed, 11 Nov 2026 12:00:00 +0000Northflank disclosed a breach on 30 Oct 2026 after Wiz flagged it; customers report unauthorised AI API key use. Treat all env vars as compromised and rotate.ai-toolscloudai-toolshttps://vulnpocalypse.dev/advisories/black-october-ai-platform-breaches/https://vulnpocalypse.dev/advisories/black-october-ai-platform-breaches/Wed, 11 Nov 2026 12:00:00 +0000Nine AI developer platforms disclosed breaches in October 2026. Stolen keys from stored secrets drove about 2.5M Bedrock calls. Revoke, then rotate.ai-toolscloudai-toolshttps://vulnpocalypse.dev/advisories/binance-hot-wallet-theft-2026/https://vulnpocalypse.dev/advisories/binance-hot-wallet-theft-2026/Wed, 11 Nov 2026 12:00:00 +0000On 29 Oct 2026 attackers got Binance's hot-wallet signing systems to sign withdrawals on ten chains, taking about $6.3B, reportedly via a DevOps laptop.breachcryptocloudci-cdhttps://vulnpocalypse.dev/advisories/au-small-finance-bank-probes-salesforce-hosted-data-leak-after-scarlettgroup-ext/https://vulnpocalypse.dev/advisories/au-small-finance-bank-probes-salesforce-hosted-data-leak-after-scarlettgroup-ext/Wed, 11 Nov 2026 12:00:00 +0000AU Small Finance Bank is investigating a possible leak on a Salesforce-hosted platform after a group claimed it stole customer KYC and loan data; claims arebreachenterprisecloudhttps://vulnpocalypse.dev/advisories/google-gemini-4-carbon-security/https://vulnpocalypse.dev/advisories/google-gemini-4-carbon-security/Wed, 11 Nov 2026 12:00:00 +0000Google released Gemini 4 Carbon (28 Oct 2026), a model it says leads at finding software vulnerabilities, via its limited Fairwind program. Not a breach.ai-toolsai-toolscloudhttps://vulnpocalypse.dev/advisories/xint-says-openai-api-compaction-flaw-exposed-hidden-model-reasoning/https://vulnpocalypse.dev/advisories/xint-says-openai-api-compaction-flaw-exposed-hidden-model-reasoning/Wed, 11 Nov 2026 12:00:00 +0000Xint reports an OpenAI API compaction flaw exposed raw model reasoning; per Xint, OpenAI deployed a fix, and no client action is described.ai-toolsai-toolscloudhttps://vulnpocalypse.dev/advisories/attackers-abuse-microsoft-teams-external-chat-for-it-support-impersonation-and-m/https://vulnpocalypse.dev/advisories/attackers-abuse-microsoft-teams-external-chat-for-it-support-impersonation-and-m/Wed, 11 Nov 2026 12:00:00 +0000Arctic Wolf saw over 400 incidents where attackers used external Teams chats and email bombing to get remote access and run payloads within 15 minutes.ecosystementerpriseendpointcloudhttps://vulnpocalypse.dev/advisories/symantec-reports-ai-attack-agent-built-to-hijack-exposed-model-endpoints/https://vulnpocalypse.dev/advisories/symantec-reports-ai-attack-agent-built-to-hijack-exposed-model-endpoints/Wed, 11 Nov 2026 12:00:00 +0000Symantec reports an AI attack agent built to hijack unauthenticated OpenAI-style endpoints, so require authentication on any model endpoint you expose.ai-toolsai-toolswebnextjscloudcryptohttps://vulnpocalypse.dev/advisories/railway-breach-rotate-all-environment-variables-and-secrets/https://vulnpocalypse.dev/advisories/railway-breach-rotate-all-environment-variables-and-secrets/Wed, 11 Nov 2026 12:00:00 +0000Railway confirmed attackers may have decrypted customer environment variables; rotate every secret stored there and review provider logs.ai-toolscloudci-cdai-toolshttps://vulnpocalypse.dev/advisories/edk2-pxe-rce-cve-2026-97631/https://vulnpocalypse.dev/advisories/edk2-pxe-rce-cve-2026-97631/Wed, 11 Nov 2026 12:00:00 +0000An EDK II PXE driver overflow can run code before the OS and Secure Boot. No stable fix yet: disable PXE where unused and isolate boot networks.exploitedopen-sourcecloudhttps://vulnpocalypse.dev/advisories/litellm-11070-on-pypi-and-docker-was-backdoored-with-a-credential-stealer-and-re/https://vulnpocalypse.dev/advisories/litellm-11070-on-pypi-and-docker-was-backdoored-with-a-credential-stealer-and-re/Wed, 11 Nov 2026 12:00:00 +0000LiteLLM 1.107.0 on PyPI and official Docker images ran a credential stealer on every Python start; roll back to 1.106.2 and rotate all reachable secrets.supply-chainpypiai-toolsopen-sourceci-cdcloudhttps://vulnpocalypse.dev/advisories/ovhcloud-cli-release-assets-infostealer/https://vulnpocalypse.dev/advisories/ovhcloud-cli-release-assets-infostealer/Wed, 11 Nov 2026 12:00:00 +0000OVHcloud CLI binaries for v0.11.0 to v0.15.0 fetched on 19 Oct 2026, 12:47 to 14:21 UTC, were an infostealer. Check MD5s, rotate secrets, install v0.16.0.supply-chaincloudendpointai-toolshttps://vulnpocalypse.dev/advisories/opencode-console-provider-key-breach/https://vulnpocalypse.dev/advisories/opencode-console-provider-key-breach/Wed, 11 Nov 2026 12:00:00 +0000An intruder reached an OpenCode legacy system and may have exposed provider keys saved in OpenCode Console. Revoke those keys at OpenAI, Anthropic or Google.ai-toolsai-toolscloudhttps://vulnpocalypse.dev/advisories/crafty-falcon-ai-attacks-indian-nbfcs-payment-apis/https://vulnpocalypse.dev/advisories/crafty-falcon-ai-attacks-indian-nbfcs-payment-apis/Wed, 11 Nov 2026 12:00:00 +0000CERT-In advisory CIAD-2026-0058 names CRAFTY FALCON, an AI-assisted actor invoking Indian NBFC and fintech payment APIs to move funds at machine speed.ai-toolsai-toolsenterprisecloudwebcryptohttps://vulnpocalypse.dev/advisories/socradar-reports-cve-2026-109469-cvss-10-entra-device-registration-flaw/https://vulnpocalypse.dev/advisories/socradar-reports-cve-2026-109469-cvss-10-entra-device-registration-flaw/Tue, 10 Nov 2026 12:00:00 +0000SOCRadar reports CVE-2026-109469, a CVSS 10 Entra device registration flaw; details are not confirmed, so verify against the NVD record.exploitedcloudenterprisehttps://vulnpocalypse.dev/advisories/researcher-says-100-flaws-found-in-uk-government-public-code-per-wired/https://vulnpocalypse.dev/advisories/researcher-says-100-flaws-found-in-uk-government-public-code-per-wired/Tue, 10 Nov 2026 12:00:00 +0000Wired reports a researcher says he found over 100 vulnerabilities in public UK government code; check your repos for committed secrets.ai-toolsopen-sourcecloudai-toolsenterprisehttps://vulnpocalypse.dev/advisories/near-ai-breached-via-sglang-rce-flaw-18-agents-and-100-users-hit/https://vulnpocalypse.dev/advisories/near-ai-breached-via-sglang-rce-flaw-18-agents-and-100-users-hit/Tue, 10 Nov 2026 12:00:00 +0000An SGLang RCE flaw let an attacker into NEAR AI systems; users should check for direct mail from security@near.ai and be wary of unsolicited messages.ai-toolsai-toolscloudopen-sourcehttps://vulnpocalypse.dev/advisories/diraq-founder-claims-quantum-could-cut-ai-data-centre-energy-use/https://vulnpocalypse.dev/advisories/diraq-founder-claims-quantum-could-cut-ai-data-centre-energy-use/Tue, 10 Nov 2026 12:00:00 +0000ET Tech reports a founder's claim that quantum computers could cut AI data centre energy use; no security flaw is described, so no action.ai-toolsai-toolscloudhttps://vulnpocalypse.dev/advisories/datadog-claims-cloud-highcritical-flaws-rose-fourfold-since-may/https://vulnpocalypse.dev/advisories/datadog-claims-cloud-highcritical-flaws-rose-fourfold-since-may/Tue, 10 Nov 2026 12:00:00 +0000Infosecurity Magazine reports Datadog claims median high/critical cloud workload flaws rose from four to 16; review long-lived keys and dependencyai-toolscloudai-toolsci-cdopen-sourcehttps://vulnpocalypse.dev/advisories/wyndham-android-app-exposed-customer-data-via-hardcoded-credential/https://vulnpocalypse.dev/advisories/wyndham-android-app-exposed-customer-data-via-hardcoded-credential/Tue, 10 Nov 2026 12:00:00 +0000Wyndham confirmed an Android app hardcoded credential exposed customer data; it was revoked, so Wyndham members should watch for phishing.exploitedcloudenterprisehttps://vulnpocalypse.dev/advisories/varonis-says-notc2-poc-hides-c2-commands-in-aws-services/https://vulnpocalypse.dev/advisories/varonis-says-notc2-poc-hides-c2-commands-in-aws-services/Mon, 09 Nov 2026 12:00:00 +0000Cyber Security News reports Varonis built NotC2, a proof-of-concept AWS C2 that needs stolen credentials; review IAM and SNS limits.ai-toolscloudai-toolshttps://vulnpocalypse.dev/advisories/mittwald-discloses-mcp-server-breach-of-56-projects-suspects-ai-use/https://vulnpocalypse.dev/advisories/mittwald-discloses-mcp-server-breach-of-56-projects-suspects-ai-use/Mon, 09 Nov 2026 12:00:00 +0000Mittwald says hackers exploited a flaw in its MCP server to compromise 56 customer projects, if you host there, await its detailed account.ai-toolsai-toolswebcloudhttps://vulnpocalypse.dev/advisories/elastic-report-says-attackers-log-in-8-minutes-after-infostealer-hit/https://vulnpocalypse.dev/advisories/elastic-report-says-attackers-log-in-8-minutes-after-infostealer-hit/Mon, 09 Nov 2026 12:00:00 +0000Help Net Security reports Elastic says attackers logged in about 8 minutes after infostealer infections; review remote tools and sign-in methods.ai-toolsai-toolsendpointcloudenterprisehttps://vulnpocalypse.dev/advisories/cpython-bug-enables-jinja-sandbox-escape-in-ai-inference-servers-runsybil-says/https://vulnpocalypse.dev/advisories/cpython-bug-enables-jinja-sandbox-escape-in-ai-inference-servers-runsybil-says/Mon, 09 Nov 2026 12:00:00 +0000RunSybil reports a CPython bug it says lets a malicious model template escape the Jinja sandbox; treat untrusted model templates as code until patched.ai-toolsai-toolsopen-sourcecloudhttps://vulnpocalypse.dev/advisories/digicert-data-breach-2026-11/https://vulnpocalypse.dev/advisories/digicert-data-breach-2026-11/Mon, 09 Nov 2026 12:00:00 +0000A Feb 2025 migration exposed a DigiCert business system; unauthorised accounts read archived customer contact data and some ID documents. CA unaffected.breachenterprisecloudhttps://vulnpocalypse.dev/advisories/gitbook-breach-sso-flaw-led-to-infrastructure-access-api-tokens-revoked/https://vulnpocalypse.dev/advisories/gitbook-breach-sso-flaw-led-to-infrastructure-access-api-tokens-revoked/Mon, 09 Nov 2026 12:00:00 +0000GitBook disclosed a November 2026 breach that exposed API tokens and integration secrets; create new GitBook API tokens and rotate connected secrets.ai-toolswebcloudai-toolscryptohttps://vulnpocalypse.dev/advisories/eclypsium-claims-ai-server-hardware-can-be-tampered-to-alter-chatbot-answers/https://vulnpocalypse.dev/advisories/eclypsium-claims-ai-server-hardware-can-be-tampered-to-alter-chatbot-answers/Mon, 09 Nov 2026 12:00:00 +0000Eclypsium says attackers with network access to DPUs or BMCs could alter AI model weights in memory; restrict that access and enable memory protections.ai-toolsai-toolscloudenterprisehttps://vulnpocalypse.dev/advisories/linux-kernel-tcp-cve-2026-98432/https://vulnpocalypse.dev/advisories/linux-kernel-tcp-cve-2026-98432/Mon, 09 Nov 2026 12:00:00 +0000A race in Linux's IPv4 TCP handshake, present since 4.4, allows remote code execution. Install a fixed kernel or drop IPv4 packets carrying IP options.exploitedopen-sourcecloudnetwork-edgehttps://vulnpocalypse.dev/advisories/gmo-internet-onamae-desktop-cloud-breach-leaks-data-draws-ransom-demand-and-unau/https://vulnpocalypse.dev/advisories/gmo-internet-onamae-desktop-cloud-breach-leaks-data-draws-ransom-demand-and-unau/Mon, 09 Nov 2026 12:00:00 +0000GMO Internet shut down its Onamae Desktop Cloud after a breach, an 8 billion yen extortion demand, a data leak and unauthorized trades on customer accounts.breachcloudenterprisehttps://vulnpocalypse.dev/advisories/artex-agentic-ai-used-in-connectwise-supply-chain-attack-and-vapor-panda-espiona/https://vulnpocalypse.dev/advisories/artex-agentic-ai-used-in-connectwise-supply-chain-attack-and-vapor-panda-espiona/Mon, 09 Nov 2026 12:00:00 +0000China-aligned actors used the ARTEX agentic AI framework against ConnectWise customers and 200+ organizations, so review Microsoft 365 app access now.supply-chainai-toolscloudenterpriseopen-sourcehttps://vulnpocalypse.dev/advisories/aoki-and-aokigahara-infostealers-target-ai-coding-assistant-credentials/https://vulnpocalypse.dev/advisories/aoki-and-aokigahara-infostealers-target-ai-coding-assistant-credentials/Mon, 09 Nov 2026 12:00:00 +0000Infostealers dubbed Aoki and Aokigahara steal AI coding assistant tokens and cloud keys, so rotate them if a developer machine may be infected.ai-toolsai-toolsendpointcloudci-cdcryptohttps://vulnpocalypse.dev/advisories/tensorlake-says-leaked-github-token-exposed-cloud-secrets-and-emails/https://vulnpocalypse.dev/advisories/tensorlake-says-leaked-github-token-exposed-cloud-secrets-and-emails/Sun, 08 Nov 2026 12:00:00 +0000Tensorlake's Trust Center says a leaked GitHub token let an attacker read internal cloud secrets and customer emails; read its update.breachcloudhttps://vulnpocalypse.dev/advisories/dosu-says-attacker-abused-org-invite-flaw-to-reach-its-db-ci-and-cloud/https://vulnpocalypse.dev/advisories/dosu-says-attacker-abused-org-invite-flaw-to-reach-its-db-ci-and-cloud/Sun, 08 Nov 2026 12:00:00 +0000Dosu says an attacker abused an org-invitation flaw to reach its database, CI and cloud; it advises customers to check logs for its listed indicators.ai-toolsci-cdcloudai-toolshttps://vulnpocalypse.dev/advisories/stolen-entra-id-app-credentials-and-azure-devops-identities-used-to-breach-27-or/https://vulnpocalypse.dev/advisories/stolen-entra-id-app-credentials-and-azure-devops-identities-used-to-breach-27-or/Sun, 08 Nov 2026 12:00:00 +0000Attackers used stolen Microsoft Entra ID app credentials and Azure DevOps identities to reach at least 27 organizations via MSPs, with no Microsoft flawbreachcloudenterpriseci-cdhttps://vulnpocalypse.dev/advisories/lxd-microcloud-cve-2026-112816/https://vulnpocalypse.dev/advisories/lxd-microcloud-cve-2026-112816/Sun, 08 Nov 2026 12:00:00 +0000LXD and MicroCloud accepted a trusted public certificate anywhere in a client's chain, enabling impersonation. Refresh to LXD 6.10.1, 5.21.9, 5.0.11 or 4.0.15.exploitedcloudopen-sourcehttps://vulnpocalypse.dev/advisories/the420in-reports-protesters-entered-microsoft-amsterdam-data-centre-site/https://vulnpocalypse.dev/advisories/the420in-reports-protesters-entered-microsoft-amsterdam-data-centre-site/Fri, 06 Nov 2026 12:00:00 +0000The420.in reports about 100 protesters entered a Microsoft data centre construction site near Amsterdam; no technical action is stated.ecosystemcloud