Posted on AI Security Cloud Security Incidents & Breaches Security Operations

Microsoft’s Storm-0558 postmortem highlights identity signing-key leakage paths and validation gaps that can bridge consumer and enterprise trust domains

Microsoft’s MSRC investigation into Storm-0558 concludes that operational errors likely allowed Microsoft Account (MSA) consumer signing key material to escape a secure token signing environment via a crash-dump/debug workflow, after which the actor (attributed by Microsoft as China-based) likely obtained it by compromising a Microsoft engineer’s corporate account with access to the debugging environment. A separate engineering failure—missing issuer/scope validation when mail systems relied on a common key metadata endpoint—meant a consumer key could be used to forge tokens accepted for enterprise email access. Microsoft says it has since corrected the race condition, improved key-material detection and credential scanning, and updated libraries to automate scope validation. Read more

Posted on Cloud Security Incidents & Breaches Security Operations Vulnerability Intelligence

CISA/FBI: CL0P turned MOVEit Transfer into a repeatable mass data-theft pathway via CVE-2023-34362

A joint CISA and FBI advisory details how the CL0P ransomware group (also tracked as TA505) exploited a previously unknown SQL injection flaw (CVE-2023-34362) in Progress Software’s MOVEit Transfer managed file transfer (MFT) product to implant a web shell (“LEMURLOOT”) and exfiltrate data from underlying databases. The advisory frames MOVEit as the latest example of a broader TA505 pattern: targeting internet-facing MFT platforms with zero-day exploits (Accellion FTA in 2020–2021, GoAnywhere MFT in early 2023, and MOVEit in May 2023) to conduct large-scale theft and extortion—often emphasizing data exfiltration over encryption. Read more

Posted on Cloud Security Identity & Governance Incidents & Breaches Security Operations

Microsoft’s Secure Future Initiative: a multi-year, hyperscaler-scale reset on how Microsoft builds and operates security

Microsoft’s Secure Future Initiative (SFI), launched in November 2023, is a multi-year, cross-company program intended to “increasingly secure” how Microsoft designs, builds, tests, and operates its products and services. Microsoft says the first year prioritized security across the company through internal training and substantial engineering investment to reduce risk. SFI is structured around security principles (innovate, implement, guide) and six engineering pillars mapped to Zero Trust principles and the NIST Cybersecurity Framework, signaling a governance-and-engineering approach rather than a point-product response. For global cloud, identity, and security teams, SFI matters because it describes Microsoft’s internal hardening focus areas—identity and secrets, tenant isolation, network segmentation, SDLC/build integrity, unified detection, and faster remediation—that can influence default configurations, platform controls, and operational expectations across Microsoft’s cloud and software ecosystem over time. Microsoft also publishes periodic SFI progress reports (including references to a November 2025 report and earlier updates), indicating the initiative is intended to be measured and iterated in “waves” as threats evolve. Read more

Posted on AI Infrastructure Risk Cloud Security Vulnerability Intelligence

HTTP/2 Rapid Reset (CVE-2023-44487) highlights a web-scale protocol abuse pattern for DDoS

Cloudflare documented a record-scale DDoS wave that abused HTTP/2 stream cancellation (RST_STREAM) to generate extreme request rates with a relatively small botnet. The “Rapid Reset” technique (tracked as CVE-2023-44487) exploits HTTP/2’s ability to open many concurrent streams and then instantly cancel them, letting attackers recycle concurrency slots faster than some servers and intermediaries can clean up state. Cloudflare said attacks began Aug. 25, 2023 and peaked just above 201 million requests per second, observed alongside similar activity reported by Google and AWS, prompting coordinated disclosure to vendors and critical infrastructure providers. Read more

Posted on AI Infrastructure Risk AI Security Cloud Security Identity & Governance

OWASP formalizes a shared security baseline for GenAI apps with the Top 10 for LLM Applications (now part of the broader GenAI Security Project)

OWASP’s Top 10 for Large Language Model (LLM) Applications has been published as a community security baseline that catalogs common failure modes in GenAI applications—ranging from prompt injection to model theft. OWASP says the effort has expanded beyond a list into the OWASP GenAI Security Project, a broader open initiative covering risks across LLMs, agentic systems, and AI-driven applications, with a large global contributor community and separate project resources and participation tracks. Read more

Posted on AI Security Cloud Security Identity & Governance Security Operations

Google’s SAIF reframed AI security as operational controls, not just model research

Google introduced the Secure AI Framework (SAIF) in June 2023 as a conceptual security framework for AI systems, explicitly mapping AI-specific threats (e.g., model theft, data poisoning, prompt injection, and training-data leakage) to familiar security disciplines such as secure-by-default infrastructure, detection and response, automation, consistent platform controls, continuous testing/feedback loops, and end-to-end risk assessment. While SAIF is not a standard, Google positioned it as a bridge between traditional security programs and emerging AI risks, and tied it to ongoing industry work including NIST’s AI Risk Management Framework and ISO/IEC 42001. Read more

Posted on AI Infrastructure Risk AI Security Cloud Security Identity & Governance

NIST AI RMF: the U.S. government’s voluntary baseline for AI trust, security, and resilience—now expanding to generative AI and critical infrastructure

NIST’s AI Risk Management Framework (AI RMF) established a shared, voluntary vocabulary and process model for managing AI risks across the lifecycle—supporting “trustworthiness” goals such as safety, security, and resilience. Since the AI RMF 1.0 release on Jan. 26, 2023, NIST has expanded implementation support via the AI RMF Playbook and Resource Center, published a Generative AI Profile (NIST-AI-600-1) in July 2024, and, as of Apr. 7, 2026, issued a concept note for a forthcoming profile focused on Trustworthy AI in Critical Infrastructure—signaling growing expectations that AI governance and security controls will be tailored to high-consequence environments. Read more

Posted on AI Security Cloud Security Identity & Governance Incidents & Breaches

CrowdStrike publishes RCA for July 2024 “Channel File 291” Windows sensor outage, reframing update resilience as a board-level risk

CrowdStrike released a root-cause analysis (RCA) and executive summary for the July 19, 2024 “Channel File 291” incident, in which a content configuration update delivered via channel files for its Windows sensor triggered a widespread outage. The company says the specific scenario is now incapable of recurring and outlines mitigations and process improvements intended to enhance resilience. CrowdStrike also reported that by July 29, 2024 at 8:00 p.m. EDT, approximately 99% of Windows sensors were back online, which it compares to a typical ~1% week-over-week variance in sensor connections. Read more

Posted on Cloud Security Identity & Governance Incidents & Breaches Security Operations

UNC5537’s Snowflake data-theft campaign made SaaS identity controls a first-order data platform risk

Mandiant (Google Cloud) reported a financially motivated cluster, UNC5537, systematically accessing Snowflake customer instances using stolen credentials—then stealing data and pursuing extortion and resale. Mandiant says it found no evidence the activity originated from a breach of Snowflake’s own enterprise environment; incidents it investigated traced back to compromised customer credentials, often sourced from historical infostealer infections dating to 2020. The campaign’s success, per Mandiant, was strongly associated with missing MFA, long-lived unrotated credentials, and lack of network allow lists—shifting the security conversation from “SaaS breach” to “identity hygiene as data-platform blast radius.” Read more

Posted on AI Infrastructure Risk AI Security Cloud Security Identity & Governance

AWS frames “AI sovereignty” as control-and-choice across the AI stack, highlighting Nitro isolation, Bedrock data-use commitments, and sovereign deployment options

In a Security Blog post, AWS outlines how it approaches “AI sovereignty” as an extension of digital sovereignty, centered on data sovereignty (including residency and operator access restrictions) and operational sovereignty (including resilience and independence). AWS positions its sovereignty offering as “control and choice” across the AI stack—deployment location options (including on-premises and isolated deployments), model/service selection, and governance controls. The post highlights AWS Nitro System isolation properties for EC2 instances (including AI accelerator instances), a commitment that Amazon Bedrock customer inputs/outputs are not used to train Amazon Nova or third-party models, and references third-party validation of Nitro’s design by NCC Group. AWS also notes its ISO/IEC 42001 accredited certification coverage for certain AI services and a 2025 surveillance audit with no findings, framing these as assurance mechanisms for customers with sovereignty and compliance requirements. Read more