https://cybersecuritytracker.ai/?cats=cloud-saasCurated cybersecurity news and vulnerability intelligence.Sun, 26 Jul 2026 22:32:50 GMThttps://darkreading.com/cloud-security/default-azure-automation-setting-cross-tenant-identity-takeovercst-3183Microsoft patched a publicly enabled default configuration and code vulnerabilities in Azure Automation that could have allowed attackers to hijack identities across tenants and access other organizations' data, credentials, and workloads. The issue stemmed from overly permissive default settings combined with multiple code flaws in the platform.Fri, 24 Jul 2026 12:48:16 GMThttps://helpnetsecurity.com/2026/07/23/axonius-cyber-assets-exposurescst-3062Axonius announced new capabilities for its Asset Cloud platform focused on asset intelligence and exposure management. The updates improve configuration management database (CMDB) visibility, vulnerability response, and extend asset tracking to Internet of Things (IoT) and operational technology (OT) devices.Thu, 23 Jul 2026 07:07:42 GMThttps://helpnetsecurity.com/2026/07/23/defense-in-depth-strategy-videocst-3056Venkata Pavan Kumar Gummadi from Broadridge describes a defense in depth approach for protecting sensitive data across its lifecycle using multiple coordinated layers. He argues that single controls like disk encryption or data loss prevention (DLP) alone create gaps, and advocates for layered defenses that include data classification to identify sensitive fields such as Social Security numbers.Thu, 23 Jul 2026 04:00:12 GMThttps://elastic.co/security-labs/esql-completion-curl-wget-detection-triagecst-3130Elastic Security deployed a detection rule for curl and wget file transfers that uses ES|QL COMPLETION, an LLM-powered triage feature, to filter out legitimate cloud activity before alerts reach analysts. Running the rule on Elastic's production fleet for seven days, the system reduced noise by using deterministic filtering and LLM reasoning to distinguish between expected automation, CI/CD jobs, and potential attacker activity. The approach maintains security visibility for file transfer detection in cloud environments while eliminating false positives that would otherwise overwhelm security teams.Thu, 23 Jul 2026 00:00:00 GMThttps://helpnetsecurity.com/2026/07/22/arista-networks-edge-threat-managementcst-2990Arista Networks has integrated AI-driven Edge Threat Management (ETM) into its VeloCloud SD-WAN platform to deliver zero trust security at enterprise branch offices. The integration consolidates multiple security appliances into a single unified edge platform, offered as a software upgrade that provides perimeter protection at the wide area network edge.Wed, 22 Jul 2026 10:07:27 GMThttps://helpnetsecurity.com/2026/07/22/servicenow-data-exposure-snowpick-open-source-scannercst-2980Bishop Fox developed Snowpick, an open-source Go tool that scans ServiceNow instances for exposure to unauthenticated access. During authorized penetration testing across 166 ServiceNow instances, the scanner found 31% were vulnerable and returned records or confirmations to unauthenticated requests. The firm published both the tool and its findings to help organizations identify and remediate this configuration weakness.Wed, 22 Jul 2026 05:30:05 GMThttps://krebsonsecurity.com/2026/07/lg-to-ban-residential-proxies-from-smart-tv-appscst-2970LG Electronics announced plans to suspend smart TV apps that include residential proxy software development kits after research found over 42 percent of apps in its webOS store contained such components. The company is requiring developers to remove proxy functionality or face app suspension, citing that residential proxy networks are not an intended use for smart TVs. Bright Data, a major residential proxy provider, accounts for most of the proxy SDKs found across LG and Samsung smart TV apps.Wed, 22 Jul 2026 01:10:38 GMThttps://wiz.io/blog/agentless-visibility-uncovering-cloud-blind-spotscst-2949Agentless workload detection represents an approach to identifying threats in cloud environments without deploying agents on individual assets. The method aims to address visibility gaps that arise when monitoring virtual appliances and distributed cloud infrastructure. This technique can help security teams detect threats that traditional agent-based monitoring might miss in complex cloud networks.Tue, 21 Jul 2026 13:26:13 GMThttps://helpnetsecurity.com/2026/07/21/shufti-simplifies-cross-border-compliance-with-the-glocal-platformcst-2911Shufti launched the Glocal Platform, a compliance lifecycle management solution that consolidates identity verification, fraud prevention, risk assessment, and regulatory compliance into a single system for global operations. The platform aims to reduce the complexity of managing multiple compliance providers across different regions and regulatory environments.Tue, 21 Jul 2026 11:06:36 GMThttps://helpnetsecurity.com/2026/07/21/amazon-guardduty-investigation-agent-on-demandcst-2895Amazon Web Services introduced an AI-powered investigation agent for GuardDuty that automates threat investigation workflows. The feature is in public preview at no additional cost, available in 10 AWS regions, with usage limits of 10 investigations per account per day during the preview period.Tue, 21 Jul 2026 09:14:25 GMThttps://schneier.com/blog/archives/2026/07/on-flock-license-plate-tracking-cameras.htmlcst-2833Flock Safety's license plate recognition system misidentified a vehicle after police entered an incomplete plate number into the system, leading to the wrongful tracking and arrest of a writer. The company's machine learning matched partial plates to full plates based on law enforcement requests, without requiring additional verification of the complete plate. Additionally, Flock cameras are being used by police departments to track people by physical descriptions rather than vehicles, raising concerns about accuracy and potential for abuse.Mon, 20 Jul 2026 11:03:45 GMThttps://techcrunch.com/2026/07/17/the-zoom-hack-that-says-dont-record-mecst-2788A commentary on the proliferation of recording and transcription features in video conferencing platforms like Zoom, questioning whether ubiquitous automated transcription and summarization serves practical value or creates information overload.Fri, 17 Jul 2026 21:20:47 GMThttps://techcrunch.com/2026/07/17/amazon-fixing-bug-that-billed-some-aws-customers-billions-of-dollarscst-2773Amazon Web Services experienced a billing calculation error that generated inflated bill estimates for some customers, showing charges in the billions of dollars. The company is working to resolve the issue. The error appears to have been temporary and affected bill display rather than actual charges.Fri, 17 Jul 2026 15:29:21 GMThttps://darkreading.com/cloud-security/google-bets-agentic-defense-strategy-outpace-attackerscst-2761Google Cloud has integrated Wiz capabilities into a platform designed to automate threat detection and remediation using agentic approaches. The integration aims to address emerging AI-driven attacks through automated defense mechanisms.Fri, 17 Jul 2026 11:50:25 GMThttps://helpnetsecurity.com/2026/07/16/valorc3-backup-as-a-service-baascst-2685ValorC3 Data Centers released a fully managed backup service for SaaS applications including Microsoft 365, Entra ID, and Salesforce, featuring immutable backup copies to protect against deletion, corruption, and ransomware. The service addresses a common misconception that cloud vendors automatically provide data backup protection. Recent governance research indicates 80% of organizations have encountered at least one cloud security incident.Thu, 16 Jul 2026 11:48:49 GMThttps://wired.com/story/heres-the-truth-about-whether-metas-nametag-face-recognition-existscst-2639Meta executives have provided conflicting statements about whether the company's NameTag facial recognition system exists following WIRED's reporting on the technology. The company's public messaging has created confusion regarding the status and nature of the project.Wed, 15 Jul 2026 20:58:16 GMThttps://tenable.com/blog/claude-tag-slack-access-modelcst-2608Anthropic's Claude Tag is a Slack AI agent that operates using admin-configured shared credentials rather than individual user credentials, following a service-identity pattern similar to deploy bots and workflow automations. Access to connected services is controlled by admin-configured bundles at the workspace or channel level, with organization-wide controls governing who can direct the agent. Channel members can collaborate with Claude, but their participation does not grant new permissions beyond what the admin bundle defines.Wed, 15 Jul 2026 15:08:00 GMThttps://cloud.google.com/blog/topics/threat-intelligence/exposed-cloud-functions-hardencst-2607Mandiant security assessments identify publicly exposed serverless applications and functions lacking authentication that frequently contain vulnerabilities in custom code or third-party packages. Successful exploitation of application-level flaws like local file inclusion or command injection can grant attackers remote code execution and container-level access, which may lead to lateral movement and cloud environment compromise. The article describes attack scenarios and hardening strategies for securing serverless deployments that must remain publicly accessible.Wed, 15 Jul 2026 14:00:00 GMThttps://rapid7.com/blog/post/dr-investigating-aws-persistence-mechanismscst-2587This article examines AWS persistence mechanisms that attackers use to maintain long-term access after gaining initial compromise. It details how adversaries create or modify IAM users, add credentials and permissions, and provides detection logic and investigation workflows using CloudTrail logs to identify these hidden footholds. The guidance includes LEQL query examples to hunt for suspicious IAM user creation and modification activity.Wed, 15 Jul 2026 13:00:00 GMThttps://securityweek.com/virtual-event-today-cloud-data-security-summitcst-2574SecurityWeek is hosting a virtual event focused on cloud and data security where attendees can network with solution providers and peers managing similar cloud security challenges.Wed, 15 Jul 2026 12:52:10 GMThttps://helpnetsecurity.com/2026/07/15/radware-defensepro-x-cloud-augmented-protectioncst-2580Radware extended its DefensePro X platform with cloud-augmented protection architecture that combines AI-powered cloud algorithms with local traffic inspection and mitigation. The initial offering, Cloud Web DDoS Protection, improves detection and characterization of application-layer DDoS attacks without requiring organizations to route traffic through the cloud.Wed, 15 Jul 2026 12:16:27 GMThttps://helpnetsecurity.com/2026/07/15/nudge-security-agentic-capabilitiescst-2583Nudge Security released automated agents that identify and remediate malicious or high-risk OAuth grants and browser extensions across enterprise environments. The agents continuously monitor these attack surfaces, flag risky configurations, and enable automated remediation with human approval. This capability extends Nudge Security's existing Vendor Risk Analyst agent.Wed, 15 Jul 2026 11:51:27 GMThttps://thehackernews.com/2026/07/sase-has-ai-blind-spot-inspecting.htmlcst-2569Secure Access Service Edge (SASE) platforms that rely solely on packet inspection are insufficient for modern enterprise environments where workflows span SaaS applications, browsers, and generative AI tools. Traditional cloud proxy routing approaches fail to detect risks from unsanctioned extensions, autonomous agents, and employee actions like sharing intellectual property within these new workflow paradigms.Wed, 15 Jul 2026 11:50:01 GMThttps://thehackernews.com/2026/07/new-webinar-closing-approval-gap-in-ai.htmlcst-2571A webinar discusses the approval gap in ad technology where authorized marketing tags can load unapproved third-party code with access to sensitive customer data and transaction pages. The presentation outlines how this gap develops and provides guidance for security teams to address it proactively.Wed, 15 Jul 2026 11:06:57 GMThttps://helpnetsecurity.com/2026/07/15/aws-security-hub-ai-workload-protectioncst-2558AWS expanded its Security Hub platform to include AI workload protection capabilities and native monitoring for Microsoft Azure environments, with plans to support additional cloud platforms. The update aims to help organizations contextualize and act on security findings more rapidly across multicloud deployments.Wed, 15 Jul 2026 08:56:09 GMThttps://helpnetsecurity.com/2026/07/15/fortinet-fortiai-assistcst-2560Fortinet announced new AI visibility, control, and data loss prevention capabilities integrated into its FortiEndpoint unified endpoint platform. The additions include endpoint risk scoring, AI-assisted security operations, and features to govern AI usage and reduce sensitive data exposure across distributed environments.Wed, 15 Jul 2026 07:47:57 GMThttps://helpnetsecurity.com/2026/07/15/product-showcase-strike-graph-trust-chain-tprmcst-2561Strike Graph launched Trust Chain, an AI-native third-party risk management platform that evaluates vendor compliance through submitted evidence rather than self-reported questionnaires. The solution uses Strike Graph's Verify AI technology to test submissions against an organization's specific requirements, delivering verified assurance instead of vendor attestation.Wed, 15 Jul 2026 07:30:16 GMThttps://thehackernews.com/2026/07/oauth-client-id-spoofing-lets-attackers.htmlcst-2479Security researchers identified threat actors using OAuth client ID spoofing to enumerate and validate stolen credentials against Microsoft Entra ID without triggering sign-in logs. The technique bypasses standard telemetry detection, allowing attackers to confirm compromised credentials while evading defender alerts.Tue, 14 Jul 2026 11:21:35 GMThttps://thehackernews.com/2026/07/grok-build-uploads-entire-git.htmlcst-2463xAI's Grok Build coding CLI tool was uploading complete Git repositories, including full commit history, to xAI's Google Cloud Storage infrastructure rather than only the specific files needed for a task. A researcher discovered this behavior while testing version 0.2.93 and was able to recover files from an intercepted upload that the agent had been instructed not to access.Tue, 14 Jul 2026 09:02:48 GMThttps://helpnetsecurity.com/2026/07/14/chatto-self-hosted-chat-app-privacycst-2461Chatto is an open-source team messaging application that enables organizations to host their own chat infrastructure rather than using commercial platforms. The software aims to provide privacy and control by keeping message data on operator-controlled infrastructure, with installation simplified through a single executable binary.Tue, 14 Jul 2026 04:30:51 GMThttps://microsoft.com/en-us/security/blog/2026/07/13/defending-saas-based-applications-against-shinyhunters-oauth-abusecst-2451Microsoft identified ShinyHunters-associated threat actors conducting campaigns from mid-2025 to mid-2026 that abused OAuth relationships to compromise Salesforce and other SaaS applications across retail, education, and manufacturing sectors. The attackers used voice phishing to trick users into authorizing malicious apps, exploited supply chain compromises in third-party integrations like Salesloft, and leveraged misconfigured guest access to gain persistence and exfiltrate customer relationship management data. These intrusion paths operated within legitimate OAuth workflows, allowing the threat actors to inherit user privileges and evade conventional authentication detection without exploiting any Salesforce vulnerability.Mon, 13 Jul 2026 22:02:41 GMThttps://microsoft.com/en-us/security/blog/2026/07/13/microsoft-entra-id-security-updates-passkeys-are-the-default-authentication-method-in-entra-idcst-2441Microsoft Entra ID will make passkeys the default authentication method beginning September 1, 2026, automatically enrolling users currently using SMS or voice authentication. SMS and voice authentication will be retired as native Microsoft Entra capabilities on February 1, 2027, though organizations can continue using these methods through third-party telecom partners via the Microsoft Security Store at additional cost.Mon, 13 Jul 2026 17:00:00 GMThttps://helpnetsecurity.com/2026/07/13/cloudflare-precursorcst-2422Cloudflare announced general availability of Precursor, a bot management tool that uses continuous behavioral analysis running in web browsers to detect sophisticated bot automation in real time. The system monitors entire user sessions rather than relying on static CAPTCHAs, aiming to catch advanced bots while minimizing disruption to legitimate users.Mon, 13 Jul 2026 13:28:04 GMThttps://helpnetsecurity.com/2026/07/13/lumen-defender-amdrcst-2405Lumen Technologies announced Lumen Defender Advanced Managed Detection and Response for Palo Alto Networks Cortex XSIAM, combining its managed detection and response capabilities with threat intelligence from Black Lotus Labs and Cortex XSIAM's AI-driven security operations platform. The service aims to help enterprises modernize security operations and manage the accelerating threat landscape.Mon, 13 Jul 2026 13:17:25 GMThttps://wiz.io/blog/iac-coverage-security-dashboardcst-2430Infrastructure as Code (IaC) coverage represents a funnel that tracks what portion of an organization's infrastructure is governed, traceable, and ready for rapid remediation. The article proposes reconceptualizing IaC coverage as a key security metric that should appear alongside other indicators on security dashboards.Mon, 13 Jul 2026 12:34:03 GMThttps://helpnetsecurity.com/2026/07/13/entra-id-oauth-client-id-spoofingcst-2406Attackers conducting account enumeration against Microsoft cloud tenants are spoofing OAuth client IDs to evade detection in sign-in logs. By using fake identifiers in authentication requests, the attackers' probing activity avoids appearing in the normal telemetry that Microsoft Entra ID records. Microsoft and operators are working to address this detection gap.Mon, 13 Jul 2026 12:10:50 GMThttps://helpnetsecurity.com/2026/07/13/fastnetmon-netomicscst-2392FastNetMon launched Netomics, a self-hosted platform that consolidates BGP routing intelligence, including live routing data, registry information, RPKI validation, routing history, and AI-assisted querying. The tool is designed for ISPs, cloud providers, Internet Exchange Points, and enterprises to gain visibility into global internet routing without relying on external lookup services. Network engineers can investigate routing incidents and validate prefixes from a single application.Mon, 13 Jul 2026 09:27:07 GMThttps://helpnetsecurity.com/2026/07/13/claude-code-weekly-limits-promotion-extendedcst-2393Anthropic has extended a promotional offer that grants Claude Code users on Pro, Max, and Team plans 50% higher weekly usage limits through July 19, 2026. After the promotion concludes, usage limits will revert to standard levels without affecting plan terms or costs. Free and consumption-based Enterprise plans are excluded from the offer.Mon, 13 Jul 2026 09:06:55 GMThttps://helpnetsecurity.com/2026/07/13/colocation-for-ai-workloads-reportcst-2376Enterprises are reassessing infrastructure choices for AI applications based on compute, power, cooling, and latency requirements. Public cloud remains popular for experimentation and fast deployment, while colocation facilities are gaining adoption for workloads demanding predictable performance and dedicated resources. More than half of surveyed organizations have implemented or are upgrading AI technologies.Mon, 13 Jul 2026 04:00:45 GMThttps://bleepingcomputer.com/news/artificial-intelligence/openai-temporarily-relaxes-gpt-56-sol-usage-limitscst-2375OpenAI has temporarily eased usage restrictions on GPT-5.6 Sol, its most advanced model, in response to exceptionally high demand over the previous two days. The adjustment allows more users to access the system while the company manages capacity constraints.Mon, 13 Jul 2026 00:44:44 GMThttps://helpnetsecurity.com/2026/07/10/aws-agentic-ai-erp-automationcst-2305AWS has released enhancements to its ERP agent that include deny-by-default authorization rules and a separate identity mechanism. These improvements aim to address security concerns while allowing the agent to automate exception handling in enterprise resource planning workflows across finance operations.Fri, 10 Jul 2026 05:00:52 GMThttps://wiz.io/blog/how-prodsec-uses-wizcst-2275This article appears to be promotional content about how Wiz, a cloud security platform, supports product security workflows. The piece lacks substantive details about specific capabilities, findings, or actionable insights for practitioners.Thu, 09 Jul 2026 16:20:08 GMThttps://helpnetsecurity.com/2026/07/09/aws-claude-apps-gateway-governancecst-2231AWS released Claude apps gateway, a self-hosted control plane that centralizes access, cost tracking, and policy management for Claude Code and Claude Desktop across organizations. The gateway replaces per-developer credentials and manual configuration distribution, and works with both Amazon Bedrock and Claude Platform on AWS.Thu, 09 Jul 2026 08:37:07 GMThttps://darkreading.com/cloud-security/lone-attacker-ai-breach-aws-cloud-environmentcst-2195A solo attacker leveraged artificial intelligence workflows, chained multiple cloud misconfigurations, and compromised credentials to breach an Amazon Web Services (AWS) customer environment and conduct extortion within 72 hours. The incident demonstrates how AI tooling combined with cloud security gaps and credential theft can rapidly escalate attacks.Wed, 08 Jul 2026 20:32:22 GMThttps://helpnetsecurity.com/2026/07/08/censys-internet-map-links-real-time-dns-data-to-internet-infrastructurecst-2177Censys has expanded its Internet Map platform to integrate real-time DNS visibility, enabling security teams to pivot between domains, DNS records, and infrastructure details in a single interface. The addition consolidates workflows that previously required multiple datasets and tools into one cohesive platform.Wed, 08 Jul 2026 13:45:21 GMThttps://helpnetsecurity.com/2026/07/08/falconstor-cloud-clean-room-enables-validated-recovery-without-dedicated-infrastructurecst-2160FalconStor introduced Cloud Clean Room, an on-demand platform for validated recovery testing within isolated secure enclaves, built on its zero trust secure enclave technology. The platform starts each test from a known state to avoid carrying over issues from previous recovery exercises. The standalone infrastructure can be deployed across multiple use cases and integrated by third-party vendors.Wed, 08 Jul 2026 13:10:24 GMThttps://helpnetsecurity.com/2026/07/08/dnsfilter-oem-programcst-2161DNSFilter launched an original equipment manufacturer (OEM) program allowing ISPs, cybersecurity firms, device makers, and application developers to integrate its DNS threat protection, domain analysis, and privacy capabilities into their own offerings. Partners can choose between Protective DNS for DNS-layer filtering and threat blocking, Guardian Firewall and VPN services for device-wide encryption and privacy, or both products bundled together.Wed, 08 Jul 2026 12:46:07 GMThttps://wiz.io/blog/wiz-asm-auto-reconcst-2167Wiz announced new features for its Attack Surface Management (ASM) platform, including auto-reconnaissance capabilities, deep internal context analysis, and a Red Agent tool designed to identify risks across different environments.Wed, 08 Jul 2026 12:19:24 GMThttps://helpnetsecurity.com/2026/07/08/automox-mcp-server-2-2cst-2142Automox released MCP Server 2.2, which adds visual review interfaces, automated patch policy creation based on severity, and real-time capability discovery for endpoint management. The update enables IT teams to review and approve endpoint operations through an agentic interface with improved governance controls beyond natural language interaction alone.Wed, 08 Jul 2026 09:21:45 GMThttps://helpnetsecurity.com/2026/07/08/sciencelogic-adds-geographic-service-visibility-to-skylar-onecst-2144ScienceLogic has released the Kyoto update for Skylar One, its observability platform, adding geographic service visibility, simplified location and device management, and enhanced relationship mapping. The update targets organizations managing hybrid infrastructure, cloud environments, and AI workloads, with improvements to service issue investigation, location access management, and platform scalability.Wed, 08 Jul 2026 08:56:13 GMT