https://cybersecuritytracker.ai/?stack=1Stories and vulnerabilities involving Amazon Web Services.Sun, 26 Jul 2026 22:32:51 GMThttps://elastic.co/security-labs/agentic-soc-token-budget-architecturecst-3189Elastic InfoSec compares two architectural approaches for agentic security operations centers: a single agent with a library of skills versus a fleet of specialized agents orchestrated through deterministic workflows. Testing on 36,822 real production investigations shows the specialized agent approach costs $0.69 per alert triage versus $3.42 for the single-agent method, a 5.7x difference at scale. The choice between architectures depends on investigation patterns, team maturity, and whether analysts need flexible on-demand skill loading or deterministic methodologies.Fri, 24 Jul 2026 00:00:00 GMThttps://thehackernews.com/2026/07/aws-kiro-flaw-let-poisoned-web-page.htmlcst-2952Intezer and Kodem Security discovered a vulnerability in AWS Kiro, an agentic coding IDE, that allowed hidden text on a web page to trigger configuration file rewrites and arbitrary code execution on a developer's machine without requiring user approval. AWS has released a patch, and the flaw remains unassigned a CVE identifier.Tue, 21 Jul 2026 16:06:12 GMThttps://helpnetsecurity.com/2026/07/21/amazon-guardduty-investigation-agent-on-demandcst-2895Amazon Web Services introduced an AI-powered investigation agent for GuardDuty that automates threat investigation workflows. The feature is in public preview at no additional cost, available in 10 AWS regions, with usage limits of 10 investigations per account per day during the preview period.Tue, 21 Jul 2026 09:14:25 GMThttps://thehackernews.com/2026/07/new-nadmesh-botnet-hunts-exposed-ai.htmlcst-2778A Go-based botnet named NadMesh emerged in early July 2024, targeting exposed AI services to harvest AWS keys and Kubernetes tokens. The malware uses Shodan scanning to identify vulnerable instances of tools like ComfyUI, Ollama, and Gradio that are often deployed without adequate firewall protection. The operator's dashboard reportedly tracks over 3,800 unique AWS credentials stolen from these compromised systems.Fri, 17 Jul 2026 17:12:23 GMThttps://techcrunch.com/2026/07/17/amazon-fixing-bug-that-billed-some-aws-customers-billions-of-dollarscst-2773Amazon Web Services experienced a billing calculation error that generated inflated bill estimates for some customers, showing charges in the billions of dollars. The company is working to resolve the issue. The error appears to have been temporary and affected bill display rather than actual charges.Fri, 17 Jul 2026 15:29:21 GMThttps://tenable.com/blog/black-hat-2026-swarm-event-build-AI-security-agentscst-2687Tenable is hosting Swarm, a collaborative build event at Black Hat 2026 where security practitioners will develop open-source AI agents and tools together. The event aims to address isolated development of agentic AI in security teams by fostering community collaboration on agents, skills, and model context protocol servers to improve collective cyber defenses.Thu, 16 Jul 2026 13:00:00 GMThttps://thehackernews.com/2026/07/unpatched-shark-vacuum-flaw-could-let.htmlcst-2676A researcher disclosed an unpatched vulnerability in Shark RV2320EDUS robot vacuums that allows extracting a certificate from one device to gain root access to other vacuums operating on the same AWS region. An attacker exploiting this flaw could control cameras, movement, access home maps, and retrieve plaintext Wi-Fi passwords from affected devices.Thu, 16 Jul 2026 09:23:19 GMThttps://rapid7.com/blog/post/dr-investigating-aws-persistence-mechanismscst-2587This article examines AWS persistence mechanisms that attackers use to maintain long-term access after gaining initial compromise. It details how adversaries create or modify IAM users, add credentials and permissions, and provides detection logic and investigation workflows using CloudTrail logs to identify these hidden footholds. The guidance includes LEQL query examples to hunt for suspicious IAM user creation and modification activity.Wed, 15 Jul 2026 13:00:00 GMThttps://helpnetsecurity.com/2026/07/15/aws-security-hub-ai-workload-protectioncst-2558AWS expanded its Security Hub platform to include AI workload protection capabilities and native monitoring for Microsoft Azure environments, with plans to support additional cloud platforms. The update aims to help organizations contextualize and act on security findings more rapidly across multicloud deployments.Wed, 15 Jul 2026 08:56:09 GMThttps://arstechnica.com/security/2026/07/now-defenders-are-embracing-the-prompt-injection-toocst-2424Researchers from Tracebit discovered that defenders can embed prompt injections into stored secrets on AWS to disable attacking AI agents. By placing specially crafted prompts alongside passwords and cryptographic keys, the LLM encounters instructions that violate its safety guardrails and halts its operation.Mon, 13 Jul 2026 15:06:34 GMThttps://krebsonsecurity.com/2026/07/lessons-learned-from-cisas-recent-github-leakcst-2418CISA experienced a six-month exposure of internal credentials, including AWS GovCloud administrative keys, after a contractor published sensitive data to a public GitHub repository in May 2026. The agency's postmortem identified delays in secret rotation, unclear incident reporting channels, and gaps in monitoring public code repositories as contributing factors. CISA has since committed to improving key management practices, establishing clearer reporting procedures, and implementing continuous scanning for exposed secrets.Mon, 13 Jul 2026 15:03:28 GMThttps://tenable.com/blog/fedramp-high-il5-federal-government-cloud-securitycst-2423Cloud security has become critical for federal civilian and defense agencies as environments grow more complex, shifting from adoption decisions to securing what is already deployed at scale. Modern federal cloud infrastructures featuring multi-cloud architectures, containerized workloads, and AI applications create significant risk gaps that adversaries exploit, including misconfigured storage, overprivileged accounts, and hidden lateral movement paths. Achieving mature zero trust architecture requires deep, real-time visibility across seven pillars (users, devices, applications, data, network, automation, and analytics) to enable continuous operational discipline rather than reactive risk management.Mon, 13 Jul 2026 14:00:00 GMThttps://helpnetsecurity.com/2026/07/10/aws-agentic-ai-erp-automationcst-2305AWS has released enhancements to its ERP agent that include deny-by-default authorization rules and a separate identity mechanism. These improvements aim to address security concerns while allowing the agent to automate exception handling in enterprise resource planning workflows across finance operations.Fri, 10 Jul 2026 05:00:52 GMThttps://helpnetsecurity.com/2026/07/09/aws-claude-apps-gateway-governancecst-2231AWS released Claude apps gateway, a self-hosted control plane that centralizes access, cost tracking, and policy management for Claude Code and Claude Desktop across organizations. The gateway replaces per-developer credentials and manual configuration distribution, and works with both Amazon Bedrock and Claude Platform on AWS.Thu, 09 Jul 2026 08:37:07 GMThttps://darkreading.com/cloud-security/lone-attacker-ai-breach-aws-cloud-environmentcst-2195A solo attacker leveraged artificial intelligence workflows, chained multiple cloud misconfigurations, and compromised credentials to breach an Amazon Web Services (AWS) customer environment and conduct extortion within 72 hours. The incident demonstrates how AI tooling combined with cloud security gaps and credential theft can rapidly escalate attacks.Wed, 08 Jul 2026 20:32:22 GMThttps://helpnetsecurity.com/2026/07/08/codenotary-launches-ai-security-platform-that-learns-from-ai-agent-behaviorcst-2145Codenotary released AgentMon 3, an enterprise AI security platform featuring adaptive runtime security policies that evolve by learning from AI agent behavior, workflows, and emerging threats within customer environments. The platform is now available through AWS Marketplace to simplify deployment for AWS-based organizations.Wed, 08 Jul 2026 08:33:38 GMThttps://microsoft.com/en-us/security/blog/2026/06/30/whats-new-in-microsoft-security-june-2026cst-326Microsoft announced security updates for June 2026 including MDASH, a multi-model AI scanning system for discovering and remediating vulnerabilities, extended endpoint protection for local AI agents, and new capabilities for identity backup and recovery. Additional releases include database threat protection for open-source AWS RDS instances and customizable reporting features in Microsoft Purview for data security posture management.Tue, 30 Jun 2026 16:00:00 GMThttps://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rcecst-557Splunk published CVE-2026-20253, a pre-authentication remote code execution vulnerability in the PostgreSQL Sidecar Service with a CVSS score of 9.8. The vulnerability affects Splunk Enterprise version 10 and above, with Splunk Enterprise on AWS being vulnerable by default, while on-premises Windows installations require the sidecar to be explicitly enabled. The researchers analyzed the vulnerable service listening on local ports and confirmed the exposure in default deployments.Fri, 12 Jun 2026 20:35:13 GMThttps://wiz.io/blog/introducing-wiz-cloud-costcst-1266Wiz has released a cloud cost management tool that combines cloud and AI cost visibility across AWS, Azure, and GCP environments. The platform aims to help teams identify and eliminate waste to improve spending efficiency.Mon, 08 Jun 2026 12:00:00 GMThttps://krebsonsecurity.com/2026/05/lawmakers-demand-answers-as-cisa-tries-to-contain-data-leakcst-136A CISA contractor intentionally published AWS GovCloud credentials and internal secrets on a public GitHub account in May 2025, exposing plaintext credentials to dozens of agency systems. Congressional lawmakers are demanding answers about the security lapse, as CISA struggles to invalidate the leaked credentials more than a week after GitGuardian first notified the agency. CISA claims no sensitive data was compromised, but security experts note the exposure provided adversaries with information and access pathways to federal networks.Fri, 22 May 2026 16:34:24 GMThttps://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-githubcst-138A CISA contractor maintained a public GitHub repository that exposed privileged AWS GovCloud credentials, plaintext passwords, API tokens, and internal system details for several months until security researchers alerted the agency in May. The exposed files included administrative access to cloud infrastructure, credentials to CISA's secure code development environment, and access to internal software repositories, representing significant credential mismanagement and disabled security controls. Security experts characterized the incident as one of the most severe government data leaks in recent history due to the sensitivity of exposed assets and potential for lateral movement attacks.Mon, 18 May 2026 20:48:21 GMThttps://sentinelone.com/labs/cloud-worm-evicts-teampcp-and-steals-credentials-at-scalecst-606SentinelLABS discovered PCPJack, a credential theft worm that targets exposed cloud infrastructure including Docker, Kubernetes, Redis, and MongoDB, while removing artifacts from the TeamPCP threat actor group. The framework harvests credentials from cloud services, containers, developer tools, and financial applications, then spreads to additional hosts via a dropper script that downloads Python-based modules from attacker-controlled infrastructure. Unlike typical cloud malware, PCPJack does not deploy cryptominers, instead suggesting monetization through credential fraud, spam campaigns, extortion, or resale of stolen access.Thu, 07 May 2026 10:00:17 GMThttps://elastic.co/security-labs/proactive-threat-hunting-ai-generated-leadscst-624Elastic has developed AI-generated threat hunting leads that automatically identify patterns and anomalies in security telemetry by analyzing contextual entity data rather than waiting for human analysts to form hypotheses. The system uses an entity store that tracks user, host, and service characteristics over time, combining attributes, lifecycle events, behavioral signals, and risk scores to surface suspicious patterns that would be difficult for analysts to discover manually. This approach aims to shift security operations from reactive alerting to proactive, environment-specific threat hunting.Tue, 05 May 2026 00:00:00 GMThttps://elastic.co/security-labs/detecting-cicd-pipeline-abuse-with-llm-augmented-analysiscst-630Attackers are increasingly targeting CI/CD pipelines rather than production systems directly, compromising developer credentials and modifying workflow files to exfiltrate secrets at scale. The article details specific attack patterns including the GhostAction campaign (327 users, 3,325 stolen secrets), the Shai-Hulud npm worm (46,000 malicious packages), and automated scanning for misconfigurations like the pull_request_target trigger. A new open-source tool, cicd-abuse-detector, has been released to identify suspicious pipeline modifications across GitHub Actions, GitLab CI, and Azure DevOps using regex patterns and language model analysis.Wed, 29 Apr 2026 00:00:00 GMThttps://cloud.google.com/blog/topics/threat-intelligence/unc6692-social-engineering-custom-malwarecst-314Google Threat Intelligence identified UNC6692, a previously unknown threat group, conducting a multistage intrusion campaign that combined mass email bombardment, Microsoft Teams social engineering impersonating IT helpdesk staff, and a custom malware suite. The attack chain involved tricking victims into downloading a renamed AutoHotkey binary that deployed SNOWBELT, a malicious Chromium browser extension, with persistence established through scheduled tasks and startup folder shortcuts.Thu, 23 Apr 2026 14:00:00 GMThttps://risky.biz/risky-bulletin-aws-kills-bucketsquattingcst-220Amazon Web Services introduced a security feature to mitigate S3 bucket namesquatting attacks, where attackers register expired or deleted buckets with predictable names to intercept traffic and collect sensitive data. The technique, documented since 2019, exploits naming conventions to target organizations whose traffic still routes to abandoned buckets.Fri, 20 Mar 2026 02:20:46 GMThttps://reliaquest.com/blog/threat-spotlight-casting-a-wider-net-clickfix-deno-and-leaknets-scaling-threatcst-2119LeakNet ransomware operators are expanding their attack capabilities by adopting ClickFix social engineering lures hosted on compromised websites and deploying a Deno-based in-memory loader for command-and-control delivery. The group maintains a consistent post-exploitation sequence across incidents, including jli.dll side-loading into Java, PsExec lateral movement, and S3 bucket payload staging. This shift toward self-directed campaigns reduces LeakNet's reliance on initial access brokers and accelerates their timeline from initial compromise to encryption.Tue, 17 Mar 2026 09:00:00 GMThttps://thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026cst-397Pwn2Own Berlin 2026 will take place May 14-16 with over $1 million in prizes across 31 targets in 10 categories, including newly expanded artificial intelligence categories and increased rewards for Firecracker vulnerabilities. AWS has joined as a co-sponsor, and the competition returns to OffensiveCon after a successful 2025 inaugural event. Registration closes May 7, and the winner will be crowned Master of Pwn with prizes including ZDI reward points, a trophy, and a jacket.Thu, 12 Mar 2026 16:25:15 GMThttps://risky.biz/risky-bulletin-ai-driven-hacking-campaign-breaches-600-fortinet-devicescst-234A Russian-speaking threat actor used commercial AI toolkits to compromise over 600 Fortinet FortiGate firewalls starting in January by targeting exposed management ports protected only by weak passwords without multi-factor authentication (MFA). The campaign did not rely on zero-day or legacy vulnerabilities but instead exploited basic security configuration weaknesses. AWS security researchers documented the campaign and its techniques.Mon, 23 Feb 2026 00:51:20 GMThttps://wiz.io/blog/introducing-ai-cyber-model-arena-a-real-world-benchmark-for-ai-agents-in-cyberseccst-1348Wiz Research has created AI Cyber Model Arena, a benchmark that evaluates offensive AI security capabilities across 257 real-world scenarios including zero-day vulnerabilities, CVEs, API and web attacks, and cloud misconfigurations on AWS, Azure, Google Cloud, and Kubernetes. The benchmark measures what AI models and agents can accomplish in practical cybersecurity contexts.Thu, 12 Feb 2026 18:05:58 GMThttps://wiz.io/blog/wiz-research-codebreach-vulnerability-aws-codebuildcst-1360Wiz Research identified a critical supply chain vulnerability that exploited a CodeBuild misconfiguration to gain unauthorized access to AWS GitHub repositories, including the one hosting the JavaScript SDK for the AWS Console. The attack demonstrates how misconfigurations in build infrastructure can be leveraged to compromise widely-used software dependencies that impact many downstream users.Thu, 15 Jan 2026 15:00:00 GMThttps://doublepulsar.com/merry-christmas-day-have-a-mongodb-security-incident-9537f54289eb?source=rss----8343faddf0ec---4cst-587A public exploit for CVE-2025-14847 was released on Christmas Day, enabling unauthenticated memory reads from MongoDB instances. The vulnerability affects all MongoDB versions over the past decade and allows attackers to extract sensitive data such as database passwords and AWS secret keys. With over 200,000 MongoDB instances exposed to the internet and the exploit now publicly available, mass exploitation is expected.Fri, 26 Dec 2025 16:52:57 GMThttps://wiz.io/blog/top-aws-re-invent-announcements-for-security-teams-in-2025cst-1375AWS re:Invent 2025 included several announcements relevant to security teams, though the specific technical details were not provided in the source material. Security practitioners should review the full announcements to determine which services and capabilities align with their organization's security posture and operational needs.Mon, 08 Dec 2025 21:54:29 GMThttps://wiz.io/blog/1-billion-aws-marketplace-lifetime-salescst-1379Wiz, a cloud security software vendor, has become the fastest independent software vendor to reach $1 billion in lifetime sales through the AWS Marketplace. The achievement reflects customer adoption of the platform and the strength of Wiz's partnership with AWS.Tue, 02 Dec 2025 16:55:57 GMThttps://wiz.io/blog/a-new-type-of-long-lived-key-on-aws-bedrock-api-keyscst-1429AWS has introduced a new type of long-lived API key for Bedrock that simplifies authentication processes. These keys persist over time rather than requiring periodic rotation, which presents both convenience and security tradeoffs for practitioners managing foundation model access.Thu, 21 Aug 2025 12:18:13 GMThttps://wiz.io/blog/wiz-mcp-server-now-available-in-the-new-aws-marketplace-ai-agents-and-tools-categcst-1446Wiz announced availability of its Model Context Protocol (MCP) server in AWS Marketplace's new AI Agents and Tools category. The MCP server enables users to leverage natural language workflows for security posture improvement and risk remediation.Thu, 17 Jul 2025 09:00:01 GMThttps://greynoise.io/blog/coordinated-cloud-based-scanning-operation-targets-75-known-exposure-pointscst-1901GreyNoise detected a coordinated reconnaissance campaign on May 8 involving 251 malicious IP addresses hosted on Amazon AWS and geolocated to Japan, targeting 75 known exposure points in a single day. The synchronized nature and infrastructure patterns indicate centralized planning and direction of the scanning activity.Tue, 27 May 2025 00:00:00 GMThttps://wiz.io/blog/wiz-deployed-on-awscst-1469Wiz has announced its 'Deployed on AWS' status through AWS Marketplace, reflecting an expanded partnership between the two companies. This designation is intended to help customers make informed purchasing decisions about Wiz's cloud security offerings.Tue, 06 May 2025 19:06:04 GMThttps://wiz.io/blog/aws-vpc-endpoint-cloudtrailcst-1483AWS has introduced new CloudTrail network activity events that provide visibility into Virtual Private Cloud (VPC) Endpoint traffic. These logs enable security teams to audit endpoint policies, detect anomalous data flows, and investigate potential data exfiltration attempts.Thu, 20 Mar 2025 12:00:00 GMThttps://wiz.io/blog/aws-infrastructure-security-basicscst-1499This article outlines foundational strategies for securing AWS infrastructure, emphasizing layered protection approaches and the shared responsibility model between AWS and customers. It serves as a guide for organizations to improve their overall security posture within Amazon Web Services deployments.Thu, 30 Jan 2025 13:00:00 GMThttps://wiz.io/blog/avoiding-mistakes-with-aws-oidc-integration-conditionscst-1510The article discusses common security mistakes made when integrating OpenID Connect (OIDC) with AWS and how to avoid them. Practitioners working with AWS identity federation should review their OIDC configurations to ensure they are properly secured.Wed, 01 Jan 2025 14:00:00 GMThttps://wiz.io/blog/the-many-ways-to-obtain-credentials-in-awscst-1511A resource explores various methods through which credentials can be obtained in AWS environments, focusing on understanding AWS Identity and Access Management (IAM) credential mechanisms and SDK behaviors. The article emphasizes how defenders can improve their security posture by developing deeper knowledge of these credential procurement vectors and service-specific implementations.Fri, 20 Dec 2024 13:00:00 GMThttps://wiz.io/blog/jinx-2401-llm-hijacking-awscst-1514A campaign named JINX-2401 is targeting AWS environments using identity and access management (IAM) privilege escalation tactics. The activity involves hijacking large language model (LLM) environments to gain elevated permissions within cloud infrastructure.Sun, 15 Dec 2024 14:07:55 GMThttps://wiz.io/blog/recapping-wiz-at-reinvent-2024cst-1518Wiz presented updates at Amazon's Re:Invent 2024 conference, highlighting its continued partnership with AWS to help secure customer environments. The announcement emphasizes Wiz's role in the AWS security ecosystem and ongoing collaboration between the two companies.Mon, 09 Dec 2024 14:06:45 GMThttps://wiz.io/blog/how-to-use-aws-resource-control-policiescst-1522This article discusses AWS Resource Control Policies as a security and governance tool for organizations using AWS. The piece covers how to implement and leverage these policies to enforce consistent security standards across infrastructure.Thu, 28 Nov 2024 05:00:00 GMThttps://wiz.io/blog/deloitte-cyber-cloud-managed-services-integrationcst-1524Deloitte has launched Cyber Cloud Managed Services (CCMS), a service powered by Wiz that provides automated security workflows and risk management capabilities for AWS cloud environments. The offering aims to streamline vulnerability identification and remediation across cloud infrastructure.Tue, 26 Nov 2024 12:00:00 GMThttps://wiz.io/blog/amazon-q-developer-plugincst-1529Wiz has released a new Amazon Q Developer plugin that integrates with Amazon Web Services (AWS) to help customers improve their cloud security posture using generative AI capabilities. The plugin enables AWS and Wiz customers to leverage AI-powered insights within their existing development and security workflows.Thu, 14 Nov 2024 12:48:19 GMThttps://wiz.io/blog/accelerating-our-commitment-to-europe-with-even-more-investmentscst-1531Wiz announced expanded investments in Europe, including support for Amazon Web Services European Sovereign Cloud and establishment of new regional headquarters to serve European customers.Wed, 13 Nov 2024 15:00:00 GMThttps://wiz.io/blog/wiz-expands-runtime-protection-to-serverless-containerscst-1538Wiz has expanded its runtime protection capabilities to cover serverless container environments, adding support for AWS Fargate and Azure Container Apps. The extension provides visibility, blocking, and threat hunting features for these managed container platforms.Mon, 28 Oct 2024 14:00:00 GMThttps://wiz.io/blog/scaling-aws-account-management-from-landing-zones-to-account-vendingcst-1543AWS account vending and landing zones are two distinct strategies for provisioning and managing cloud environments. Account vending focuses on automated deployment of pre-configured accounts to users or teams, while a landing zone provides a foundational architectural framework for multi-account governance. Understanding the differences helps organizations choose the right approach for their account management and operational needs.Thu, 10 Oct 2024 14:00:00 GMT