In-depth security research across CVEs, incidents, TTPs and defensive practice. When a post is rule-bound, the canonical CloudSigma rule evidence is named in the article.
Flowise and Semantic Kernel flaws show the same defensive problem: a prompt event is weak evidence until it is tied to process execution, secret access, and cloud API use from the workload identity.
Microsoft, GMO Flatt and Anthropic now show the same weak point in agentic CI: untrusted repository text can steer a coding agent towards runner secrets unless defenders bind GitHub events to cloud token use.
Unit 42's autonomous cloud-agent test shows the useful defender signal: AI-driven attacks still leave cloud audit traces when they enumerate, impersonate and exfiltrate.
Prompt injection is becoming an operations problem: defenders need to join agent prompts, tool calls, SaaS access, and cloud audit logs before a hidden instruction turns into data access.
MCP security research is strong on attack design and thin on runtime detection. Here is a reproducible model that maps tool poisoning, output poisoning, sampling abuse and covert tool invocation to concrete signals in MCP and agent audit logs.
The current TanStack and Mini Shai-Hulud wave is less about poisoned packages and more about stealing the developer tokens that let attackers publish the next wave.
Unit 42's AD CS research is a useful reminder that certificate services are now part of the identity attack surface, not a quiet infrastructure corner.
Canonicalized CloudSigma rule for CVE-2026-42823 (T1548). Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.
Google says it found an AI-assisted zero-day exploit, but the harder problem is the AI software supply chain now becoming an initial access path.
MOVEit Automation CVE-2026-4670 is a critical authentication bypass in managed file transfer automation. Patch with the full installer, then investigate access to transfer jobs and stored credentials.
GitHub Enterprise Server CVE-2026-3854 turns repository push access into possible server compromise. Patch GHES, review push logs, and check CI trust paths.
cPanel and WHM CVE-2026-41940 is a KEV-listed authentication bypass in a hosting control plane. Patch the service, then investigate sessions and tenant impact.
Reviewed CloudSigma rule for CVE-2026-31431 (T1068). In the Linux kernel, crypto algif_aead reverted to operating out-of-place.
LiteLLM CVE-2026-42208 turns an exposed model gateway into a credential exposure problem. Patch first, then treat stored provider keys as potentially read.
CVE-2023-34192 is a stored XSS flaw in Zimbra Collaboration Suite. The CloudSigma rule detects CRS 941xxx XSS blocks against the autoSaveDraft endpoint.