Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cyber Security. Show all posts
Cyber Security
AI prompt injection attack API Keys AWS AWS security Cloud Credentials Cyber Security

AgentCorruption Exposes Security Risks in Amazon Bedrock AgentCore

 

A single prompt could have led to the exposure of conversations, source code, stored memories and cloud credentials across multiple AI agents in the same AWS account and region, according to Zenity Labs researchers. The so-called AgentCorruption attack chain targeted Amazon Bedrock AgentCore, which is AWS's managed service for building and running AI agents. 

The researchers' proof-of-concept involved an agent with a web-request tool that was prompted to call the local metadata endpoint at 169.254.169.254, which is where AWS workloads get temporary AWS credentials. Since the request came from inside the agent's Firecracker microVM, it returned credentials for the agent's execution role. 

This created a server-side request forgery (SSRF) vulnerability that was triggered by a prompt injection. "Exploitation didn't require a vulnerability in the chat interface; it required only that the agent have a tool to make the request and that the tool be permitted to call the metadata service," the researchers said. Zenity discovered that the broad permissions typically given to the default execution role allowed them to find agents, obtain container images, invoke other agents and access session events. 

They also discovered permissions that could be used to access conversations and implant false memories that would affect the agent's future responses. The researchers added that the latter capability could be used to implant "instructions" that would cause the agent to take specific actions. In addition, they found that these same permissions could be used to access API keys and secrets stored in AWS Secrets Manager, which could lead to lateral movement to other services and data. 

According to Zenity, metadata access was reported to AWS on Dec. 25, 2025, and excessive permissions in the execution role were reported on Jan. 12, 2026. AWS started the migration to Instance Metadata Service Version 2 in February 2026, and then made it mandatory. On Sept. 29, 2026, Zenity confirmed that AWS had removed the permissions that could be used to invoke other agents, chat with them or access the Secrets Manager. The researchers stated that the problems they reported had been addressed. 

AWS pushed back against the suggestion that this was a vulnerability, noting that it is normal for an agent to have access to its own execution role credentials via the metadata service. In addition, the company stated that cross-account access to agents is not possible without the appropriate permissions on the execution role and resources. 

Security teams should create their own IAM roles with limited permissions, block all outbound network connectivity except what is necessary, isolate agents that are accessible over the public internet and monitor logs in CloudTrail and CloudWatch for anything unusual, the researchers recommended. They also suggested that organizations ensure that the AgentCore Gateway cannot be bypassed to access agents directly. 

An AI agent's access to tools and permissions in the cloud can create security issues if not properly restricted, and this discovery shows why companies need to carefully control and monitor such access before actually launching an agent into production.
Read more »
Water Utilities
Critical Infrastructure Cyber Security Password Theft US Hacking Water Utilities

Stolen Passwords Expose 1,787 US Water Providers to Hackers

 

A new cybersecurity study has found that stolen passwords are exposing more than 1,700 American water and wastewater providers to potential hacking. Research by SpyCloud, shows that password-stealing malware has compromised credentials belonging to 1,787 organizations—nearly two in every ten providers examined. The findings highlight how basic credential theft, rather than advanced artificial intelligence or sophisticated exploits, can create a serious threat to critical infrastructure. 

SpyCloud analyzed a database of more than 66,000 publicly accessible systems registered with the US Environmental Protection Agency, covering roughly 10,000 water-related organizations. The researchers found that malware had stolen passwords and credentials from nearly 20% of these providers. More alarmingly, at least 250 organizations had exposed credentials that appeared to allow access to operational networks and remote-access systems used to control physical pumps and water flows. 

The danger is amplified by infostealer malware, which captures not only saved passwords but also active session tokens. These tokens can keep a user logged into a system, allowing attackers to impersonate legitimate employees and sometimes bypass multi-factor authentication. Stolen credentials are frequently traded or sold on underground marketplaces, giving hackers a ready-made way to enter specific organizations without needing to discover new vulnerabilities themselves. 

The study also revealed a supply-chain risk. Researchers identified an unnamed metering technology provider whose network contained an infected device. That single compromise exposed credentials for 167 US utility companies that relied on the provider’s technology. This shows how one weak link in a vendor’s security can potentially create access routes into hundreds of unrelated water systems, making third-party cybersecurity oversight essential. 

The report comes after a series of cyberattacks on US water providers, which the government has privately linked to Iran-backed hackers. However, SpyCloud said it found no evidence that those particular attacks used stolen passwords; instead, they involved issues such as default passwords on physical controllers and mechanical switches. The broader lesson is clear: water utilities must combine strong password practices, multi-factor authentication, session-security controls, vendor monitoring, and removal of default credentials to protect essential public services.
Read more »
data security
blocking unauthorized access Credential Security CVE CVE exploits CVEs Cyber Security Cyberattacks Data Center data security

Atlassian CVE-2026-21589 Exploited Hours After Public Disclosure

 

Attackers started scanning the systems vulnerable to the Atlassian flaw several hours after the researchers published the technical details and proof-of-concept code. Assigned the identifier CVE-2026-21589, the vulnerability impacts several self-hosted Data Center products and could allow unauthorized access to the credentials in some circumstances. 

The problem was disclosed by Atlassian on October 5, 2026, with a CVSS score of 9.3. The products affected by the bug are Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. The company already released fixes for all software versions. The flaw allows the adversaries to access some files in the application root directory without providing proper authentication. 

However, it is only possible if the attacker knows the exact name and location of the file because the vulnerability does not allow listing the contents of a directory. Therefore, the attack surface is limited, but there is still a potential risk if the adversary somehow manages to guess the file location. The security researchers from WatchTowr posted the proof-of-concept code and technical details of the discovered flaw on October 6, 2026. 

They managed to identify the origin of the issue – a popular library used in all Atlassian products mentioned above. More importantly, they found out that the vulnerability could be chained to get access to the configuration file with Crowd application credentials in some circumstances. According to WatchTowr, Crowd is Atlassian’s identity management system, and the mentioned scenario involves Jira Software connected to it. 

In this case, the attacker could use the credentials to create a new administrative account and assign it to the Jira administration group. As a result, the adversary would be able to attain full privileged access to the targeted Jira Software instance. In addition, the security company showed how the proof-of-concept code could be used to take over a victim’s account in case of success. Moreover, the researcher added that the attacks are not random, but rather targeted. 

Several hours after the publication of the results, the exploitation framework started scanning corporate websites to find the instances of the affected applications. On October 8, 2026, Previdian, the exploitation intelligence company, counted 190 attempts from 32 IP addresses in 10 countries. Although the United States Cybersecurity and Infrastructure Agency (CISA) has not included the vulnerability in the Known Exploited Vulnerabilities list, the attacks indicate that the problem needs urgent attention. 

The companies using Atlassian’s products should make sure that the affected applications are updated to the latest versions. Those who are not able to do it right away should take the vulnerable instances of the software offline or follow the recommendations stated by Atlassian. In particular, the company suggests deploying the blocking rules to the firewalls or using the Web Server rewrite rules. 

In addition, the organizations with Jira Software and Crowd should make sure that the mentioned applications are not at risk of compromise as well. As seen from the recent incident, the response to the exposure of the flaw may take too long. Moreover, the attacks are often launched right after the proof-of-concept code is published. Therefore, it is critical to apply the necessary security updates as soon as possible.
Read more »
Metabase
API Abuse Cyber Security Data Leaks Japan Metabase

Japan Reports Sharp Rise in Web Data Leaks

 

Japan is experiencing a sharp rise in personal-data leaks from web systems, according to an October 2026 alert from the JPCERT Coordination Center. The incidents, which surged around September, are separate from ransomware and other routine breaches, and JPCERT/CC says they may be increasing. While the agency did not identify attackers or affected organizations, it described the available evidence as limited and fragmentary, and cautioned that the same technique was not necessarily used in every case. The pattern points to attackers systematically probing web applications and APIs for basic security weaknesses rather than relying on one universal exploit.

The scale is substantial. Security firm Macnica counted 119 publicly disclosed incidents in Japan through October 6 in which personal data was stolen or leaked through organizations’ web systems—up from 84 in all of 2025 and 62 in 2024. Eighty-one of this year’s cases occurred in July or later. Targets have ranged from online shops and member services to business systems and customer-support platforms, including a library catalog and a tourist train booking system. High-profile examples include Park24’s Times Car service, where data on about 6.6 million accounts was obtained, and Yakiniku King’s app, where more than 10.7 million records reportedly leaked. 

JPCERT/CC identified three main intrusion patterns. First, attackers analyze publicly released mobile apps to discover API endpoints and keys, then send unauthorized requests—sometimes to internal APIs that should not be reachable through the app. These requests have been used to alter user privileges, create unauthorized accounts, test authentication behavior, and extract data through blind NoSQL injection. Attackers have also used API keys stolen in earlier compromises. In other cases, they exploit weak administrator passwords, known software vulnerabilities, excessive data exposure, broken access controls, and session-management flaws. 

A particularly serious vector involves Metabase, an open-source business-intelligence tool. Attackers exploited CVE-2026-72898, a maximum-severity SQL injection flaw that requires no account to abuse and can grant administrator access to Metabase’s application database. From there, an intruder could steal credentials for connected databases and export their contents. Metabase patched the issue on August 6, but attacks continued afterward; the company has urged users to move to newer minimum-safe releases and, where upgrading is not immediately possible, to block the affected password-reset endpoint. 

For defenders, JPCERT/CC recommends applying access controls to every API endpoint, including internal ones; enforcing least-privilege permissions; rate-limiting sensitive functions such as login, password reset, and search; and ensuring tokens expire and can be revoked quickly. Organizations should also avoid embedding API keys or database credentials in shipped apps, review admin functions in vulnerability testing, restrict regional access where appropriate, and remove data no longer needed. Japan’s Personal Information Protection Commission issued a parallel alert, urging businesses to reassess whether the personal data they hold remains necessary. The message is clear: basic API hygiene, configuration review, and prompt patching remain decisive defenses.
Read more »
Rubrik
ai agents AI Code Security Anthropic code Guardian Cyber Security Rubrik

Rubrik Expands Project Hourglass to Bring AI-Powered Code Security to Enterprise

 



When Rubrik launched Project Hourglass at its FORWARD 2026 conference in Las Vegas back in June, the initiative set out to answer a question CISOs were already losing sleep over: what happens when an AI agent writing and deploying your code does something catastrophic and nobody can stop it in time?

On Thursday, at its GSI Summit in Goa, India, the cybersecurity firm announced the next step. Rubrik has expanded Project Hourglass to include a new tool called Rubrik Code Guardian, and has welcomed AHEAD, Trace3, and World Wide Technology (WWT) into the alliance, joining the six systems integrators that signed on at launch. The new capability is powered by Anthropic's Claude Mythos 5 and extends the alliance's reach from securing AI agents during execution to proactively identifying vulnerabilities in software code before deployment.


The Problem Driving All of This

Rubrik Zero Labs surveyed more than 1,600 IT and security leaders for its State of the Agent report and found that 86 percent expect AI agents to outpace their security guardrails within a year, while only 23 percent report full visibility into agents operating in their environments. More than 80 percent said agents require more manual oversight than the efficiency they save.

A separate Rubrik and Economist Enterprise study found 88 percent of enterprises experienced an AI agent security breach in 2026. The picture those numbers paint is one of organizations racing to deploy autonomous systems while the controls meant to govern them are still catching up.


What Code Guardian Does

The original Project Hourglass, which launched with Cognizant, Deloitte, LTM, HCLTech, NTT DATA, and Wipro as founding partners, focused on protecting AI agents at runtime through Rubrik Agent Cloud. That platform operates across three layers: Runtime Agent Security for behavioral guardrails and blast-radius control, Agent Rewind for fast repository recovery, and AI Context Guard for prompt integrity and control-plane protection.

Code Guardian shifts the security lens earlier in the development cycle. Rather than running against live production environments, the system tests a cloned, air-gapped copy of customer repositories. Claude Mythos 5 operates inside Rubrik's security harness to evaluate code against sophisticated, multi-step threat scenarios.

Three core capabilities define the product: isolated red-team analysis inside the air-gapped environment; attack chain discovery that reasons across files, services, identity roles, and cloud perimeters to find chained vulnerabilities that conventional static tools miss; and business impact prioritization that filters findings by actual exploitability and business criticality to reduce alert fatigue.

Alok Agrawal, Chief Solutions Officer at Rubrik, put the challenge plainly. "Engineering teams are turning to AI models to accelerate software delivery, but speed cannot compromise security or architectural integrity. By incorporating Rubrik Code Guardian into Project Hourglass, we are ensuring engineering teams are able to conduct red-team analysis, prioritize business impact and reduce risk."


The New Partners

Each of the three incoming partners brings a different angle to the coalition.

AHEAD, which builds enterprise technology architectures for large clients, framed the problem as one of inherited risk. Steven Sorensen, Specialty Solutions Engineer for Cyber Resiliency at AHEAD, said the goal is to get code attacked, tested, and validated in a safe environment before it ships, so teams can move faster knowing Rubrik's recovery capabilities sit underneath them as a safety net.

WWT's Chris Konrad, Vice President of Global Cyber, pointed to the company's Advanced Technology Center, where isolated threat testing has long been part of how it validates security solutions before recommending them. He said Code Guardian integrates naturally with that process.

Trace3 brought a perspective the others did not: its own teams have been running Rubrik Agent Cloud internally to protect their own agentic AI work before recommending it to clients. Sandy Salty, Chief Marketing Officer at Trace3, said that experience as both a user and a partner gives the firm a clearer view of what actually makes agentic environments more resilient at scale.


Where Things Stand

Rubrik Code Guardian is currently in private preview and accepting select design partners. It is not yet generally available and may change or be discontinued. Rubrik Agent Cloud, the original platform at the center of Project Hourglass, remains available to enterprise clients.

Dev Rishi, GM of AI at Rubrik, has previously described the core problem in stark terms: with AI agents, there is the potential for ten times the damage in one-tenth the time. That framing captures why the urgency behind Project Hourglass is unlikely to ease. As the volume of AI-generated code increases across enterprise environments, the window between a vulnerability being introduced and it being found by someone with bad intentions keeps getting smaller.



Read more »
Severe Flaw
Cyber Security Microsoft Microsoft Exchange Organization Security Severe Flaw

Microsoft Exchange Vulnerability Could Leak Confidential Organizational Info


Microsoft has issued an emergency security update to fix a vulnerability in Exchange Server that could expose confidential organizational communications. The flaw, tracked as CVE-2026-96940, has received a CVSS severity score of 8.8 out of 10.

Reported by TechRadar, the vulnerability could allow attackers who already have valid login credentials to increase their privileges within Exchange and access mailboxes belonging to other users. Microsoft released the fix on October 2, ahead of its originally intended schedule.

About the flaw

The security issue stems from a weakness in authorization controls, which determine what information a user can access. By exploiting the flaw over a network, an authenticated attacker could gain permissions beyond those assigned to their account.

Threat actors could first obtain credentials through phishing attacks or by purchasing stolen login details from underground online markets. Once inside an organization’s Exchange environment, they could exploit the vulnerability to read emails and attachments belonging to other employees.

However, the flaw does not provide unrestricted access across different customer environments, known as tenants. It also does not directly grant administrator-level or SYSTEM-level privileges on the underlying Windows server.

What happens in case of successful exploitation?

Successful exploitation could expose sensitive business information, including financial records, invoices, contracts, customer correspondence, internal discussions, and confidential documents.

Attackers could use the stolen information to support further cyberattacks. For example, they might impersonate company employees, send convincing fraudulent emails, or conduct business email compromise (BEC) scams to trick organizations into transferring money or disclosing additional information.

The vulnerability is particularly problematic because an ordinary employee’s compromised account could potentially provide an entry point for accessing information held in other employees’ mailboxes.

Affected products

The vulnerability affects the following on-premises products:

  • Microsoft Exchange Server Subscription Edition RTM
  • Microsoft Exchange Server 2016 Cumulative Update 23
  • Microsoft Exchange Server 2019 Cumulative Updates 14 and 15

Microsoft has confirmed that Exchange Online customers are protected by a server-side fix. Organizations running affected on-premises installations should install the appropriate security updates promptly.

Exchange Server 2016 and 2019 have reached the end of their standard support lifecycle. Eligible organizations must be enrolled in Microsoft’s Extended Security Update programme to receive the relevant updates for these versions. Microsoft recommends that organizations without the required coverage migrate to Exchange Server Subscription Edition.

Microsoft’s response 

Microsoft reported no evidence that the vulnerability was being actively exploited at the time of the report. However, the company assessed that exploitation was more likely, making timely patching important.

Administrators should run Microsoft’s Exchange Server Health Checker after installing the update to verify successful deployment and identify any additional actions required.

Read more »
https
Chrome Security Cyber Security Cyberattack DNS Google Chrome HTTPS warning HTTP HTTP Attacks https

Chrome Blocks Unauthorized Certificates After Three ccTLD Hijacks

 

Chrome has taken steps to protect users after attackers compromised three country-code top-level domains and exploited the incidents to acquire unauthorized HTTPS certificates for multiple organizations. The affected namespaces are .gh for Ghana, .sl for Sierra Leone and .as for American Samoa. Attackers targeted the third-party registries which own the ccTLDs rather than Google directly. 

In addition to the country-code top-level domain takeovers, the adversaries also modified the authoritative DNS records to compromise several Google domains and domains of other companies. Chrome reported that it is not evident that Certification Authorities (CAs) that issued the certificates acted in bad faith but instead concluded that the problem stemmed from attackers’ tampering with DNS infrastructure of the country-code domains. 

Chrome’s Secure Web and Networking Team responded to the incidents by utilizing CRLSets to block the unauthorized certificates associated with Google properties and coordinated with the CAs to revoke the certificates, protecting the users of the browsers and other clients. The list of impacted entities grew as Chrome analyzed Certificate Transparency (CT) logs and identified a number of large publicly traded companies and popular internet services. 

The team blocked certificates it suspected to be related to the attacks and reached out to the impacted businesses. Users of Chrome do not need to take any action as the protections are designed to be transparent and work in the background. However, Google warned that organizations should not rely on the browser to protect them against the attacks and that Chrome did not identify all the affected domains. Similarly, protections worked on Google Chrome and may have not triggered in other browsers and clients. 

Organizations are advised to ensure that they monitor the CT logs for all the domains and that they are notified if an unauthorized certificate is issued. This is critical because every certificate that is trusted by the public must be reported to CT logs. For domains that are impacted by the ongoing attacks, it is recommended to look over the most recent certificates to ensure that they have not been issued without authorization. Google recommended the use of restricted Certification Authority Authorization (CAA) records and the use of ACME account bindings when available. 

CAA records dictate which CAs can issue certificates and, while they do not prevent an attacker from using a hijacked domain to issue a certificate, they can help in ensuring that unknown CAs are not utilized. Additionally, the CAA records can prevent attackers from using domain-control validation for certificate issuance through misdirection. Using issuing restrictions and validation method restrictions can prevent attackers from using certificates’ domain validation through cached entries. These protections are only effective after the control of the domain is re-established. 

Chrome announced its intent to keep working on long-term projects to improve security and reduce the risks associated with the use of certificates. The proposed changes include shortening the lifespan of certificates and limiting the re-use of domain validation. They will continue to work to improve the Chrome Root Program with the Chrome Quantum-resistant Root Program as the Chrome ecosystem seeks to mitigate the risks posed by DNS and routing compromises.
Read more »
Windows
Backdoor Cyber Security Healthcare Russia Telegram Windows

Belarusian Hackers Compromised Russian Healthcare Network for Two Years


A Belarusian hacktivist gang allegedly maintained access to the network of a Russian healthcare organization for almost two years, potentially gaining access to sensitive medical information, cybersecurity researchers have reported.

Researchers from Russian cybersecurity company Solar said they discovered the intrusion in December 2025. However, their investigation found evidence suggesting that the attackers had entered parts of the organization’s infrastructure as early as 2024.

Attack details

The attack was attributed to the Belarusian Cyber Partisans, a group known for cyber operations against Belarusian and Russian government organizations and businesses.

Despite remaining inside the network for an extended period, the attackers did not appear to destroy systems or cause major disruption. Researchers believe maintaining access may have been more valuable to the attackers than immediately carrying out destructive activity. 

Intrusion details

Solar researchers identified several tools associated with the intrusion, including an updated version of the Vasilek Windows backdoor.

Vasilek was previously documented by Kaspersky as malware used by the Cyber Partisans. The backdoor can communicate with attackers through the Telegram Bot API and receive commands through a Telegram group. It can collect information from infected computers, execute Windows commands, transfer files, capture screenshots and record keystrokes. 

Attack tactic 

Solar said the newer version found during its investigation was version 1.5.8. Researchers also identified techniques for maintaining persistence inside the victim’s environment. These included Windows services and the replacement of the vmtools.dll library associated with VMware Tools.

The attackers also used other communication and tunnelling tools, including DNS tunnels and proxy chains. This gave them alternative methods of communicating with compromised systems if one channel became unavailable. 

Telegram restrictions in Russia affected Vasilek’s communications, but researchers said the attackers could use other methods to maintain their access.

What next?

The compromised organization was not publicly identified. However, researchers said it operated a large infrastructure connected to multiple other healthcare organizations.

This created a potential trusted-relationship attack risk. Once attackers gained control of one organization, its connections with other trusted healthcare entities could potentially provide opportunities to reach additional networks.

The researchers said the attackers accessed sensitive medical data but did not destroy the victim’s systems. The long period of access suggests that espionage, intelligence gathering and maintaining future access may have been more important than immediate disruption. 

Read more »
Subscribe to: Posts (Atom)