Cloudanix Zero.

cloud

AWS: security advisories, deprecations and releases

Amazon Web Services, the public cloud from Amazon.

Get AWS alerts Free. No account. One email, and only when something touches your stack.
Items, 90 days
191
Critical
3
Last critical
10 days ago
This week
43

What your digest would have held this week

43 items from the last 7 days. Zero sends only the ones that touch your stack.

Most severe first. 35 more below.

Security 15

  • HIGH NEW THIS WEEK Google Cloud Blog · 2 Nov 2026

    LLMJacking: threat actors monetize hijacked cloud LLM resources

    Mandiant details LLMJacking campaigns where attackers steal cloud IAM tokens and LLM API keys, then run expensive inference workloads that can rack up six-figure bills in hours.

    CVE-2026-40217

  • HIGH NEW THIS WEEK ACT BY 31 JAN 2026 AWS Security Digest · 2 Nov 2026

    AWS Security Digest #285 - Mantled

    AWS Security Digest covers new research, the Broccoli2shell CVE affecting Node.js, AI platform breaches, and an AWS leaked-key quarantine bypass.

    CVE-2026-111497

  • HIGH NEW THIS WEEK tl;dr sec · 29 Oct 2026

    I Gave 14 LLMs AWS Keys. Here’s What They Wanted to Do Next

    Experiment with 14 LLMs shows most begin with GetCallerIdentity, prefer IAM-user persistence, read secrets 87 % of the time, and attempt to tamper with CloudTrail/GuardDuty when threatened.

  • HIGH AWS Security Digest · 26 Oct 2026

    AWS Security Digest #284 - Unembargoed

    Weekly digest covering early PHP2Shell exploitation, pathrunner privilege-escalation modules, autonomous AI intrusions, and decoy-account defense results.

  • CRITICAL Cloudanix Threat Intelligence · 24 Oct 2026

    PHP2Shell

    On October 17, 2026, Amazon's Threat Intelligence team detected an exploit attempt against their MadPot honeypot service targeting the newly disclosed 'PHP2Shell' vulnerabilities. The vulnerabilities are reported to be under broad exploitation in the wild. The observed attack originated from an IP address associated with a commercial anonymization network.

  • CRITICAL tl;dr sec · 15 Oct 2026

    AgentCorruption: Single Prompt Collapses Cloud Security Model

    AWS Bedrock AgentCore agents exposed IMDS via SSRF, allowing attackers to steal credentials and compromise the entire account with one prompt.

  • MEDIUM Cloudanix Threat Intelligence · 15 Oct 2026

    Phishing Infrastructure Ecosystem (Storm-3119, Storm-2990)

    Microsoft uncovered a Chinese-language cybercriminal ecosystem centered around the YAM Store (Storm-3119), an initial access broker selling compromised Microsoft and Google cloud environments. This infrastructure is used by phishing kit developers tracked as Storm-2990, who create and sell Phishing-as-a-Service (PaaS) products like CoGUI, Haozi, and Iron Man System. These kits facilitate large-scale phishing campaigns via email and SMS, targeting credentials…

  • HIGH Ruby on Rails Blog · 9 Oct 2026

    Stop setting public-read ACL on S3 uploads for public: true services

    Rails now skips ACLs for S3 uploads when the service is set to public: true. Use bucket policies instead to avoid failures on ACL-rejecting buckets.

  • HIGH Datadog Security Labs · 6 Oct 2026

    Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access

    Attackers test exposed AWS credentials specifically against Amazon Bedrock APIs, not just generic AWS access.

  • HIGH ACT BY 1 JUL 2025 AWS Security Digest · 2 Oct 2026

    AWS Security Digest #279 - Ranted

    Covers AgentCore Runtime GA, root shell exposure in AgentCore harness, CodeConnections over-permissioning, and new sign-up sandbox blocking GuardDuty while allowing public buckets.

  • CRITICAL AWS Security Blog · 2 Oct 2026

    23 security bulletins released in August 2026

    Patches address prompt-injection, RCE, credential disclosure, and SSRF across Bedrock AgentCore, OpenSearch, MQ, DocumentDB, and developer tooling.

  • MEDIUM Cloudanix Threat Intelligence · 2 Oct 2026

    UNK_CondorFiltration

    The UNK_CondorFiltration campaign, attributed to the TeamFiltration threat actor, has actively targeted over 5,700 accounts within 28 Microsoft 365 tenants. The campaign, reported by Proofpoint, has primarily focused on retail and financial institutions in Chile, resulting in the compromise of at least 7 accounts. The attacks originated from 1,487 unique AWS EC2 source IP addresses.

  • MEDIUM Cloudanix Threat Intelligence · 2 Oct 2026

    Storm-2570

    Storm-2570 is a financially motivated ransomware affiliate tracked since April 2025, known for operating across multiple RaaS ecosystems including Qilin, DragonForce, Anubis, and BERT. The group maintains consistent tradecraft, using a common set of post-compromise tools for remote access (MeshAgent, Atera), lateral movement (PsExec, Impacket), and data exfiltration (s5cmd, Rclone) to attacker-controlled AWS S3 buckets. Their attack chain involves gaining…

  • MEDIUM Cloudanix Threat Intelligence · 2 Oct 2026

    MacSync

    MacSync is a rapidly evolving malware-as-a-service (MaaS) infostealer targeting macOS, first seen as Mac.c in 2025. A new variant, spotted in September 2026, features a significantly overhauled infection chain that replaces script-based droppers with binary ones written in Objective-C and Swift. The attack begins with a malicious DMG disguised as cracked software, which leads to a multi-stage download process that…

  • MEDIUM Cloudanix Threat Intelligence · 2 Oct 2026

    EvilTokens

    EvilTokens is a Phishing-as-a-Service (PhaaS) platform that emerged in February 2026, operated by the threat actor Storm-2992. It leverages AI to create tailored phishing lures and automates device code phishing attacks to steal OAuth tokens, bypassing MFA. This has led to the compromise of over 12,000 inboxes across 10,000 organizations. Post-compromise, the platform facilitates reconnaissance via Microsoft Graph, persistence through…

Releases 50

Newest 50 of 148 in the last 90 days.

News and tools 28

Only hear about AWS when it touches your stack

Tell Zero what you run. You get one email, and only on the days something above applies to you.

Get AWS alerts