X XFediYour place in the Fediverse
XFEDI

#cloudsecurity

ActivityPub

Public posts with this hashtag.

Security Crawler Carl@[email protected]
↳ In reply to a post

Affected administrators: rotate ConnectWise credentials now, audit M365 sign-in logs for anomalous ConnectWise application authentication, and restrict app permissions immediately.

Reward: You've been issued one Undead Conditional Access Policy. Please apply it before your next performance review. There may not be one.

https://www.csoonline.com/article/4239028/china-linked-hackers-used-agentic-ai-in-attack-on-2250-microsoft-365-tenants.html

#CyberSecurity #CloudSecurity #Microsoft365 (3/3)

CSO OnlineChina-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenantsMicrosoft said Storm-0940 leveraged an open-source AI framework and credentials stolen in a ConnectWise breach to automate cloud intrusions at machine speed.
↩ Reply ♡ 0 · ↻ 0 ↗ Original
Mike F. Robbins@[email protected]

Even #Azure Owners can have requests blocked. Azure RBAC, #AzurePolicy, and resource locks enforce different controls. Learn how each works and the errors they return, with Azure #PowerShell and #AzureCLI examples. https://mikefrobbins.com/2026/10/22/azure-policy-rbac-and-resource-locks/ #CloudSecurity #CloudComputing

mikefrobbins.comAzure RBAC versus Azure Policy versus resource locksLearn the differences between Azure RBAC, Azure Policy, and resource locks by applying each one to the same resource group.
↩ Reply ♡ 0 · ↻ 0 ↗ Original
Security Crawler Carl@[email protected]
↳ In reply to a post

Reward: You've received a Compromised Keys Keychain. It opens nothing. It came with your breach.

https://techcrunch.com/2026/10/22/chinese-hackers-spied-on-thousands-of-companies-after-breaching-it-giant-connectwise/

#Cybersecurity #ConnectWise #Breach #APT #CloudSecurity #AchievementUnlocked (3/3)

TechCrunchChinese hackers spied on thousands of companies after breaching IT giant ConnectWise | TechCrunchMicrosoft points the blame for ConnectWise's breach at a China-aligned hacker, which relied on AI agents to rapidly hack into thousands of its customers.
↩ Reply ♡ 0 · ↻ 0 ↗ Original
C
Cloud 🤖@[email protected]

🤖 Railway (PaaS) discloses an intrusion into systems storing customer environment variables. Encrypted vars may have been accessed, and in some cases decrypted. A subset of users is urged to rotate credentials and secrets.
🔗 https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html
#DataBreach #InfoSec #CloudSecurity #Secrets

The Hacker NewsRailway Says Intruder May Have Accessed Customer Secrets, Urges Credential RotationRailway says an intruder may have accessed decrypted environment variables for some users, as a researcher reports related cryptocurrency theft.
↩ Reply ♡ 0 · ↻ 0 ↗ Original
CyberWorldOps@[email protected]

LiteLLM 1.107.0 was compromised on Oct 21 and distributed a credential stealer via PyPI and container images. The incident reportedly followed a temporary expansion of release permissions on Oct 19. Teams running LiteLLM should treat API keys and cloud credentials as exposed and rotate, while pinning to a known-good build. #SupplyChain #CredentialTheft #CloudSecurity

https://cyberworldops.eu/en/compromised-litellm-11070-release-deployed-a-credential-stealer

Compromised LiteLLM 1.107.0 Release Deployed a Credential Stealer Through PyPI and Containers
CyberWorldOpsCompromised LiteLLM 1.107.0 Spread Credential StealerCompromised LiteLLM v1.107.0 distributed credential-stealing code via PyPI and containers; researchers reported stolen AWS credentials were tested.
↩ Reply ♡ 0 · ↻ 0 ↗ Original
T
thecybersecguru@[email protected]

🚨 PingCAP's TiDB Cloud breach raises some serious questions.

FulcrumSec claims it ran a data collection pipeline every 6 hours for 22 days, allegedly stealing massive amounts of customer data.

The confirmed exposure includes customer metadata, SQL editor history, billing records, encrypted API key values and source code.

PingCAP says there's no evidence TiDB production data was impacted. The alleged 10.6 TB haul and the attacker's collection method remain unverified.

The real concern? Your production database can be untouched while the control plane managing it gets compromised.

Full technical breakdown: https://thecybersecguru.com/news/pingcap-data-breach-tidb-cloud/

#InfoSec #CloudSecurity

❞ Quoted postThe CyberSec Guru

Content warning: PingCAP confirmed stolen service account credentials led to a TiDB Cloud breach. See what was taken, what FulcrumSec claims, and which keys to rotate now

 The CyberSec GuruPingCAP Data Breach: TiDB Cloud Control Plane Exposed | The CyberSec GuruPingCAP confirmed stolen service account credentials led to a TiDB Cloud breach. See what was taken, what FulcrumSec claims, and which keys to rotate now
↩ Reply ♡ 0 · ↻ 0 ↗ Original
Security Crawler Carl@[email protected]
↳ In reply to a post

If you run Onamae Desktop Cloud infrastructure, check for security notifications from the company immediately and follow their containment guidance before this audit gets worse.

Reward: A clipboard, a red pen, and twenty-seven thousand servers you no longer own.

https://osintsights.com/hackers-breach-japans-onamae-desktop-cloud-compromise-27000-servers?utm_source=mastodon&utm_medium=social

#CloudSecurity #DataBreach #Malware #SupplyChain #Japan #AchievementUnlocked (2/2)

osintsights.comHackers Breach Japan's Onamae Desktop Cloud, Compromise 27,000 ServersLearn how hackers breached Japan's Onamae Desktop Cloud, compromising 27,000 servers. Read the full report now and stay safe from cloud security threats today.
↩ Reply ♡ 0 · ↻ 0 ↗ Original
T
thecybersecguru@[email protected]

🚨 Railway Security Breach: Customer secrets may be exposed.

Railway disclosed a security incident involving its internal systems for storing environment variables. An unauthorized third party may have accessed encrypted variables and potentially decrypted values.

The bigger concern? You don't need to break AES-256-GCM if you compromise the system authorized to decrypt the secrets.

🔎 Technical breakdown:
• Envelope encryption & Google Cloud KMS
• Potential exposure of OpenAI and Anthropic API keys
• Credential rotation challenges while deployments are paused
• Multi-tenant isolation and cloud secret management risks

If you use Railway, review the official disclosure, rotate affected credentials, and audit provider usage logs for suspicious activity.

Full technical analysis 👇
https://thecybersecguru.com/news/railway-security-breach-environment-variables/

#InfoSec #CloudSecurity #AppSec

❞ Quoted postThe CyberSec Guru

Content warning: Railway disclosed a security breach that may have exposed environment variables, API keys and database credentials. Read the technical analysis and response steps

 The CyberSec GuruRailway Security Breach: API Keys Exposed | The CyberSec GuruRailway disclosed a security breach that may have exposed environment variables, API keys and database credentials. Read the technical analysis and response steps
↩ Reply ♡ 0 · ↻ 0 ↗ Original
TechnoTenshi (open for work) :verified_trans: :Fire_Lesbian:@[email protected]

Railway says an unauthorized party may have accessed encrypted environment variables and decrypted some, with impact that "may be limited to a subset of users." Yet it tells all users to roll every variable, paused all deployments, and invalidated all API tokens. Its status page showed only an outage until the 22:10 UTC notice, and paused builds blocked applying new keys. Railway gives no count or entry point.

https://blog.railway.com/p/security-disclosure-wednesday-october-21st

#CloudSecurity #DevOps #InfoSec #Cybersecurity

Railway BlogSecurity Disclosure: Wednesday October 21st | Railway BlogRailway detected anomalous activity involving systems that store customer environment variables and recommends your immediate attention
↩ Reply ♡ 0 · ↻ 0 ↗ Original
CyberWorldOps@[email protected]

GMO Internet halted its Onamae Desktop Cloud VPS in Japan after unauthorized access led to malware deployment on customer servers. With up to 26,739 servers potentially exposed, tenants should assume compromise and hunt for persistence. #CloudSecurity #IncidentResponse #Malware

https://cyberworldops.eu/en/gmo-halts-desktop-cloud-after-intrusion-puts-26739-servers-at-risk

GMO Halts Desktop Cloud After Intrusion Puts 26,739 Servers at Risk
CyberWorldOpsGMO Halts Desktop Cloud After 26,739 Servers at RiskGMO shut down Desktop Cloud after unauthorized access potentially exposed up to 26,739 servers, with unauthorized programs in some environments.
↩ Reply ♡ 0 · ↻ 0 ↗ Original
Daily CyberSecurity@[email protected]

Discover the critical PwnEscape vulnerability in the Linux kernel. Learn how this flaw allows attackers to escape virtual machines and seize server control.

#PwnEscape #LinuxKernel #Vulnerability #CloudSecurity #CyberSecurity

https://dailytechnow.com/critical-pwnescape-flaw-linux-virtual-machines/

Daily Tech NowCritical PwnEscape Flaw Found in Linux Virtual MachinesDiscover the critical PwnEscape vulnerability in the Linux kernel. Learn how this flaw allows attackers to escape virtual machines and seize server control.
↩ Reply ♡ 0 · ↻ 0 ↗ Original