September 26, 2024 at 10:45AM Combining software development, operations, and deployment into DevOps teams promises greater efficiency, but also increases the attack surface. Organizations face challenges in securing the entire pipeline, software components, and infrastructure, requiring continuous monitoring and attention to areas such as code quality, open source components, and container security. AI and automation … Read more
August 21, 2024 at 07:42AM A privilege escalation vulnerability in Microsoft Azure Kubernetes Services allowed attackers to access sensitive information, including cluster credentials. The flaw impacted clusters using Azure CNI and Azure for network policy. Exploiting this flaw, attackers could access secrets, compromise clusters, and abuse cloud services and metadata servers, potentially leading to network … Read more
August 20, 2024 at 05:14PM Microsoft addressed a critical privilege escalation vulnerability in its Azure Kubernetes Service (AKS). Attackers could gain access to credentials and perform malicious actions in affected AKS clusters. The vulnerability, which did not require special privileges, led to unauthorized access to cluster contents. Security teams should audit AKS configurations and take … Read more
August 6, 2024 at 08:48PM RAD Security aims to address cloud-native platform challenges by citing statistics and offering a behavioral cloud detection and response solution. The company’s “behavioral workload fingerprinting” approach detects anomalous activity and drift events, and it is being positioned as the standard for cloud security detection and response. As a Black Hat … Read more
May 7, 2024 at 11:00AM Cloud security company Wiz raised $1 billion at a $12 billion valuation in a funding round led by Andreessen Horowitz, Lightspeed Venture Partners, and Thrive Capital. The company’s platform offers various security capabilities, with a focus on cloud security posture management and infrastructure entitlement management. Wiz aims to continue innovating … Read more
March 13, 2024 at 01:21PM A security bug in Kubernetes allows attackers to remotely execute code with System privileges on Windows endpoints, potentially leading to full takeover of all Windows nodes in a cluster. Tracked as CVE-2023-5528 with a CVSS score of 7.2, the vulnerability can be exploited by manipulating Kubernetes volumes. The flaw affects … Read more
March 8, 2024 at 06:09AM In the cybersecurity realm, secrets management is essential in safeguarding sensitive data. This involves avoiding common mistakes such as hard coding secrets, inadequate key rotation, public storage, and over-provisioning of privileges. Additional pitfalls include improper lifecycle management, lack of audit trails, and failure to encrypt Kubernetes secrets. Strategies for remedying … Read more
January 31, 2024 at 05:27PM Researchers uncovered four vulnerabilities in container engine components called “Leaky Vessels,” with one impacting runC and three impacting BuildKit in Docker environments. The most urgent vulnerability, CVE-2024-21626, enables container escape, potentially compromising host systems. Snyk advises updating affected components promptly. Container vulnerabilities are increasingly concerning, with high-profile cases indicating inadequate … Read more
January 24, 2024 at 11:18AM A misconfiguration in Google Kubernetes Engine (GKE) has allowed a security loophole, enabling attackers to access sensitive information and take over clusters. Cloud security startup Orca Security reported that the issue is due to privileges granted to the system:authenticated group. Approximately 250,000 GKE clusters were found exposed, with over 1,300 … Read more
January 3, 2024 at 02:55PM SentinelOne plans to acquire PingSafe in a cash-and-stock deal, expanding its cloud-native application protection platform (CNAPP) capabilities. The financial terms were undisclosed, and the deal is expected to close in the first quarter. PingSafe, with headquarters in the US and India, provides real-time monitoring of multi-cloud workloads and advanced secrets … Read more