Daily Cyber News coverage tagged Cloud Security.
An active campaign is using stolen GitHub tokens to extract secrets from private repositories. More than 13,500 malicious branches were recovered across over 850 compromised accounts. The attacker plants a workflow that encodes secrets, writes them into a run log, downloads the log through GitHub’s API…
Customers of GMO Internet’s cloud desktop service face possible data theft and unauthorized trading activity. The company shut down the service after discovering unauthorized access and later said information linked to customers and its business appeared online. It warned that 26,739 virtual desktop…
A poisoned LiteLLM release exposed users to credential theft and remote access. The attack began with a master key accidentally published in a public repository in May and removed without being revoked. The attacker later used that key to obtain a privileged GitHub token and compromise additional…
Web server compromise is now more practical because public exploit code is available for two critical PHP issues. A researcher used the pair to win a public Bitcoin challenge, although the published script was developed and tested against a local lab copy and succeeded about seven of ten times there. PHP…
On-premises VeloCloud Orchestrator systems are being targeted through a newly patched issue. An authenticated user with basic privileges and access to the web interface could gain operator privileges and reach internal functions. Successful exploitation could affect the orchestrator, its data, and the…
Customers lost access after Japan’s Onamae.com Desktop Cloud found malware in some server environments and stopped systems across every service plan. The provider listed 26,739 servers as potentially affected, not as a confirmed infection count. Information inside customer servers may have been viewed…
Trust in eight eMudhra intermediate certificates collapsed after researchers reconstructed their weak private keys in under a second. Major browsers and software ecosystems blocked or updated trust for the affected certificates. eMudhra revoked them and announced its withdrawal from the global SSL and TLS…
Customer applications may be exposed after suspicious activity reached Railway systems that store environment variables. The company said an unauthorized third party may have accessed encrypted variables and obtained some decrypted contents, including possible API, database, registry, and cloud…
Developer and cloud credentials were put at risk when attackers compromised LiteLLM’s release pipeline. Version 1.107.0 on PyPI and affected Docker tags carried malware across Windows, Linux, and macOS. The payload ran during Python startup, stole secrets and environment data, and could fetch additional…
Public access to government services was disrupted as agencies took vulnerable PHP systems offline. UK ministers reported 32 services unavailable and four partly disrupted, mostly as a precaution while patches and mitigations were applied; no central government compromise was confirmed. Other governments…
Machine-learning workloads could execute attacker-controlled code and expose cloud credentials because of an unsafe SageMaker Python SDK default. The SDK generated a predictable storage bucket name without confirming that the caller’s account owned the bucket. An attacker who created the bucket first…
Developer secrets were placed at risk when attackers replaced OVHcloud command-line tool assets with malicious binaries. The binaries were available for one hour and 33 minutes and downloaded approximately 250 times. They were designed to retrieve secrets from disk. Attackers used a compromised developer…
Customer metadata and operational records may create downstream risk after attackers accessed PingCAP systems using stolen service-account credentials. PingCAP said the access lasted from September 9 to October 7 and included copied company data and source code. It found no evidence that customer…
Customers may need to replace credentials after unauthorized access to Railway systems that store environment variables. Potentially exposed values include API keys, database passwords, and private registry credentials, including some decrypted data. Railway paused deployments during the investigation and…
Websites, software, and encrypted connections could be impersonated because eight eMudhra intermediate certificates used extremely weak private keys. Six certificates covered web encryption and two covered code signing. Browser and operating-system vendors have begun blocking the affected trust paths, and…
Customer workloads stopped after Japan’s Onamae Desktop Cloud began shutting down servers to contain an intrusion. An unauthorized party installed malicious programs in customer environments, potentially affecting up to 26,739 servers. Data stored on those systems may have been exposed, although no misuse…
Cloud, AI, and developer credentials may be compromised on systems that ran LiteLLM 1.107.0. Attackers inserted a credential stealer and remote-access backdoor into the release distributed through Python and Docker registries. The malware targeted browser data, cloud credentials, AI provider keys, SSH…
Developers who installed five compromised OVHcloud command-line releases may have exposed secrets stored on their machines. Versions v0.11.0 through v0.15.0 were altered on GitHub before the malicious downloads were blocked. A compromised contributor account replaced existing release files without…
Eight compromised eMudhra intermediate certificates created a path to forge certificates for legitimate domains. Their private keys were so weak that researchers could recover them by testing only 256 possible values. The certificates were revoked, and major browsers and operating systems began blocking…
Developer systems and AI services may have executed malware after installing LiteLLM 1.107.0. All seven PyPI wheel files were compromised, and affected images also reached container registries. The payload used Python startup hooks, allowing an unrelated Python command to trigger credential theft. PyPI…