# cloud security Security and privacy challenges and safeguards for cloud computing systems. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Patching at Fleet Scale, Twice: How DigitalOcean Closed Januscape and the AMD Safe RET Issue Without Customer Impact DevFeed: [Patching at Fleet Scale, Twice: How DigitalOcean Closed Januscape and the AMD Safe RET Issue Without Customer Impact]() Original publisher: [Read original article]() Author: Tim Lisko Published: 2026-08-24T21:25:19Z Content type: article Language: en Sources: [DigitalOcean]() Topics: [Digital Ocean](), [virtualization](), [vulnerability](), [Cloud](), [cloud security](), [Security](), [Exploit](), [Kernel](), [Linux]() Tags: [cloud](), [cloud-computing](), [cve](), [digitalocean](), [engineering](), [exploit](), [infrastructure](), [kernel](), [linux](), [security](), [trust-security](), [update](), [virtualization](), [vulnerability]() ### AI overview DigitalOcean describes how it responded to two serious vulnerabilities affecting its hypervisor fleet: Januscape, a KVM nested-virtualization flaw, was addressed with fleet-wide livepatching, while a separate AMD hypervisor vulnerability required kernel updates and reboots across roughly 1,600 hypervisors. The article reports zero confirmed customer-facing impact. ### Source excerpt Setting the stakes In early July, security researcher Hyunwoo Kim discovered Januscape (CVE-2026-53359), a flaw in KVM's handling of nested virtualization that could allow a malicious guest to escape into the host hypervisor. It was disclosed publicly on July 6 via the Linux oss-security mailing list. For a cloud provider, a guest-to-host escape is the most serious class of vulnerability there is: the hypervisor is the boundary that keeps each customer's workloads isolated from each other, and from our infrastructure itself. We responded, patched the entire fleet in eight days with zero confirmed customer-facing impact, and drafted a post about how we did it. Then, before we could hit publish, it happened again. In late July we learned of a second and unrelated vulnerability affecting our entire AMD hypervisor fleet, that could not be livepatched. Roughly 1,600 hypervisors needed a kernel update and a reboot. So now this story is about two responses, three weeks apart. The first built the muscle. The second proved it was repeatable, at a larger scale, and on a harder constraint. Here's how both played out, and why two of the most serious vulnerability classes in cloud computing ended up feeling like just another couple of weeks for us. Act one: Januscape The fast path: fleet-wide livepatching Our response kicked off the same night the vulnerability was disclosed. When public exploit code surfaced late in the evening of July 6, the Kernel Engineering team was paged and dug in immediately. Engineers reproduced the exploit in an isolated environment, confirmed which kernel lines were affected, and built the first working livepatch before 1 AM, roughly 45 minutes after answering the page. Livepatching lets us fix a running kernel in place, with no reboot, no migration, and no observed disruption to the customer. A few hours later, patches for the kernel versions (6.1 and 6.12) that run the majority of our hypervisor fleet were ready to ship. For the remainder, we had to ## Technology Short Take 197 DevFeed: [Technology Short Take 197]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-06-19T14:00:00Z Content type: opinion Language: en Sources: [Scott's Weblog]() Topics: [networking](), [Artificial Intelligence](), [code security](), [Vulnerabilities](), [cloud security](), [Amazon Web Services](), [Kubernetes]() Tags: [ai](), [aws](), [cilium](), [cli](), [cloud](), [cni](), [code-security](), [containers](), [cri-o](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubernetes](), [linux](), [networking](), [oci](), [open-source](), [security](), [technology](), [vulnerabilities]() ### AI overview A commentary roundup covering radical network redesign at AWS, quantum computing's implications for encryption, AI's effects on certifications and code security, AI agent exploits, open-source vulnerabilities, Kubernetes resources, cloud operations, the AI bubble, and AWS IAM guidance. ### Source excerpt Welcome to Technology Short Take 197! I've been traveling for business for the last week, so this Technology Short Take has a tad fewer links than I typically include. Even so, I still have links on radical new network designs, the impacts of AI on code security, things beginners get wrong about AWS IAM, and more! Let's get into the content. Networking This story about a radical network redesign at AWS--along with this accompanying arXiv paper--was intriguing to me. I'm not a networking expert, but designing networks with quasi-random connections between endpoints definitely flies in the face of the traditional wisdom. I do wonder, though, if this is the sort of technology that only makes sense for the hyperscalers, and not for the rest of us. Doug Dawson provides a quick update on current encryption standards and what he terms the "pending encryption crisis" presented by quantum computing. It would appear that AI is affecting even Cisco's well-known industry certifications, as outlined by Daniel Dib. Security CodeRabbit shared the results of an analysis of PRs to open source projects showing that AI-written code produces ~1.7x more issues. Along the same lines, Jens Wessling of Veracode indicates that 45% of all AI-generated code samples contained OWASP Top 10 security vulnerabilities. Anyone who didn't expect seemingly-dangerous AI agent security exploits to appear hasn't been paying attention. Enterprise AI tools don't appear exempt, either. The complex interdependencies of open source software projects once again means that a single critical vulnerability threatens a much larger number of projects and tools. Cloud Computing/Cloud Management This is an older post, but the author recently updated it--check out Marcus Noble's recommended resources for Kubernetes newbies. I am not yet sure about pulumi do (direct operations for any cloud resource; see the Pulumi blog post about it). On one hand, I can see the utility in situations where you "just need a quick" whatever ## This month in security with Tony Anscombe - November 2025 edition DevFeed: [This month in security with Tony Anscombe - November 2025 edition]() Original publisher: [Read original article]() Author: Editor Published: 2025-11-28T13:46:36Z Content type: news Language: en Sources: [WeLiveSecurity]() Topics: [Cybersecurity](), [Security](), [Malware](), [ransomware](), [API keys](), [cloud security](), [GitHub](), [Artificial Intelligence](), [Machine Learning, Security Attacks]() Tags: [2025](), [ai](), [api-keys](), [cloud-security](), [cybersecurity](), [data](), [github](), [malware](), [news](), [ransomware](), [security](), [tokens](), [video]() ### AI overview A November 2025 cybersecurity news roundup covers exposed API keys, tokens, and credentials in AI companies' GitHub repositories; Akira ransomware's reported $244 million haul; concerns about X's location feature; Australia's social-media restrictions for children; and a law-enforcement operation disrupting malware families including Rhadamanthys. ### Source excerpt Data exposure by top AI companies, the Akira ransomware haul, Operation Endgame against major malware families, and more of this month's cybersecurity news ## Your Infrastructure Has a Non-Human Trust Problem DevFeed: [Your Infrastructure Has a Non-Human Trust Problem]() Original publisher: [Read original article]() Author: jack.pitts@goteleport.com (Jack Pitts) Published: 2025-06-04T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Security](), [cloud security](), [Zero Trust](), [CI/CD](), [GitHub Actions](), [Kubernetes](), [Amazon Web Services](), [GitLab](), [Jenkins]() Tags: [agent](), [agents](), [auditability](), [aws](), [ci-cd](), [cloud-security](), [credentials](), [github-actions](), [gitlab](), [jenkins](), [kubernetes](), [secrets](), [security](), [token](), [tokens](), [zero-trust]() ### AI overview This article explains how non-human identities, including bots, CI/CD runners, and AI-driven automation, can create cloud security and resiliency risks when they use static credentials and excessive permissions. It presents Teleport Machine & Workload Identity as a way to use short-lived, scoped cryptographic credentials and reviews CI/CD deployment to Kubernetes as an example. ### Source excerpt Non-human identities are a major cloud security risk. Learn how to eliminate static credentials, enforce zero trust, and secure machine-to-machine access. ## Black Hat Asia 2025: My Journey as a Reviewer, Speaker & Community Connector DevFeed: [Black Hat Asia 2025: My Journey as a Reviewer, Speaker & Community Connector]() Original publisher: [Read original article]() Author: Vandana Verma Sehgal Published: 2025-04-28T04:00:00Z Content type: opinion Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [cloud security](), [Cybersecurity](), [Cloud](), [Resilience](), [Cisco Talos]() Tags: [2025](), [black-hat](), [blog](), [cloud](), [cloud-security](), [community](), [conference](), [customer](), [cybersecurity](), [developer](), [devrel](), [interest](), [resilience](), [snyk-platform]() ### AI overview A personal account of Black Hat Asia 2025 in Singapore, covering the author's roles as reviewer, speaker, panelist, and community connector. The article reflects on cloud security discussions, cybersecurity community building, and representation of women in cybersecurity. ### Source excerpt Explore a personal journey through Black Hat Asia 2025 as a speaker, reviewer, and community connector. Discover insights on cloud security, women in cyber, AI, and building connections. ## Kube-Policies: Guardrails for Apps Running in Kubernetes DevFeed: [Kube-Policies: Guardrails for Apps Running in Kubernetes]() Original publisher: [Read original article]() Author: Hardik Darji Published: 2025-01-28T08:00:00Z Content type: article Language: en Sources: [Square Corner Blog RSS Feed]() Topics: [Kubernetes](), [cloud security](), [Open Policy Agent](), [Testing](), [SIEM, Security, Observability]() Tags: [admission-controller](), [engineering](), [kubernetes](), [observability](), [open-policy-agent](), [security](), [security-policies](), [testing]() ### AI overview This article introduces Square's design considerations for security guardrails in Kubernetes environments. It explains why default Kubernetes configurations can leave applications vulnerable and describes requirements for an abstraction layer built on Open Policy Agent, including policy dry-runs, minimal user disruption, testing, exception management, extensibility, and observability. ### Source excerpt Design considerations for highly sensitive environments. ## Why Secure Infrastructure Access Must Evolve: Insights from Teleport's 2024 Survey DevFeed: [Why Secure Infrastructure Access Must Evolve: Insights from Teleport's 2024 Survey]() Original publisher: [Read original article]() Author: jackson.pitts@goteleport.com (Jack Pitts) Published: 2024-11-05T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Security](), [Access Control](), [cloud security](), [Cloud](), [cloud-infrastructure](), [incident]() Tags: [access-control](), [cloud](), [cloud-computing](), [complexity](), [compliance](), [incident](), [infrastructure](), [insights](), [report](), [security](), [security-incidents](), [survey](), [systems](), [vulnerabilities]() ### AI overview Teleport's 2024 State of Secure Infrastructure Access survey of 250 security and engineering leaders examines the growing difficulty of securing access to modern infrastructure. It reports that 89% of organizations experienced at least one security incident in the previous three years, while organizations identified as infrastructure access security Leaders reported lower incident-management costs and fewer incidents than Novices. ### Source excerpt Discover key insights from Teleport's 2024 State of Secure Infrastructure Access report. Learn how Leaders reduce security incidents and costs. ## Heroku ACM Adds Wildcard Domain Support for the Common Runtime DevFeed: [Heroku ACM Adds Wildcard Domain Support for the Common Runtime]() Original publisher: [Read original article]() Author: Ethan Limchayseng Published: 2024-09-27T03:09:00Z Content type: release Language: en Sources: [Heroku]() Topics: [Heroku](), [cloud security](), [certificates](), [Cloud]() Tags: [announce](), [certificates](), [cloud-infrastructure](), [cloud-security](), [heroku](), [https](), [news](), [product-features](), [security]() ### AI overview Heroku Automated Certificate Management now supports wildcard domains for the Common Runtime, allowing one wildcard certificate to cover multiple subdomains. Heroku ACM handles certificate issuance, renewal, and management. ### Source excerpt We are thrilled to announce that Heroku Automated Certificate Management (ACM) now supports wildcard domains for the Common Runtime! Heroku ACM's support for wildcard domains streamlines your cloud management by allowing Heroku's Certificate management to cover all your desired subdomains with only one command, reducing networking setup overhead and providing more flexibility while enhancing the [...] The post Simplify Your Cloud Security: Heroku ACM Now Supports Wildcard Domains appeared first on Heroku. ## Improving Laravel Application Security with Aikido DevFeed: [Improving Laravel Application Security with Aikido]() Original publisher: [Read original article]() Author: James Brooks Published: 2024-07-08T14:30:00Z Content type: news Language: en Sources: [Laravel Blog]() Topics: [Laravel](), [Application Security](), [Vulnerabilities](), [PHP](), [cloud security]() Tags: [application-security](), [cloud-security](), [hipaa](), [integration](), [iso-27001](), [laravel](), [php](), [scanners](), [security](), [security-vulnerabilities](), [soc2]() ### AI overview Laravel has partnered with Aikido to add security scanning for Laravel applications using Forge. The integration identifies potential vulnerabilities and security flags, surfaces findings within Forge, and combines code and cloud security scanners to help developers manage application security and compliance requirements. ### Source excerpt As your Laravel application grows, managing security objectives becomes more challenging, especially for small teams or solo developers. Today, Laravel has teamed up with Aikido to provide a seamless solution for securing your Laravel application. With Aikido, Laravel developers using Forge can effortlessly scan for and identify potential security vulnerabilities, all in less than 1 minute. ## Hugging Face partners with Wiz Research to Improve AI Security DevFeed: [Hugging Face partners with Wiz Research to Improve AI Security]() Original publisher: [Read original article]() Author: Josef Fukano; Guillaume Salou; Michelle Habonneau; Adrien Carreira; Luc Georges; Nicolas Patry; Julien Chaumond Published: 2024-04-04T00:00:00Z Content type: article Language: en Sources: [Hugging Face - Blog]() Topics: [hugging face](), [Security](), [vulnerability management](), [cloud security](), [Kubernetes]() Tags: [cloud-security](), [hugging-face](), [kubernetes](), [security](), [wiz]() ### AI overview Hugging Face describes its collaboration with Wiz researchers and security improvements to its platform. The post says issues involving sandboxed compute environments and pickle were resolved, and outlines use of Wiz for vulnerability management, cloud security posture management, and automated remediation. ### Source excerpt We're on a journey to advance and democratize artificial intelligence through open source and open science. ## Snyk highlights AWS re:Invent 2023 DevFeed: [Snyk highlights AWS re:Invent 2023]() Original publisher: [Read original article]() Author: David Lugo Published: 2023-12-14T06:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Generative AI](), [Securing AI](), [Amazon Web Services](), [ai security](), [code security](), [Application Security](), [Application Development](), [Language models](), [cloud security](), [Infrastructure as code](), [Containers](), [sdlc]() Tags: [acquisition](), [ai](), [ai-code-security](), [ai-coding](), [ai-security](), [ai-tools](), [amazon](), [application-development](), [aspm](), [awareness](), [aws](), [blog](), [cloud](), [cloud-computing](), [code](), [code-security](), [coding](), [container-security](), [containers](), [devops](), [executive](), [generative-ai](), [iac-security](), [interest](), [megawatt](), [related-content](), [sdlc](), [security](), [security-solutions](), [snyk](), [snyk-apprisk](), [snyk-container](), [snyk-iac](), [tool]() ### AI overview This recap covers Snyk's AWS re:Invent 2023 highlights, including AWS partnership achievements, new AWS integrations, generative AI developments, and the use of AI coding assistants. It emphasizes the need for AI security solutions because AI-generated code can increase vulnerabilities. ### Source excerpt In this blog, we recap the most exciting developments from AWS re:Invent 2023, including Snyk's industry-leading progress with generative AI, ASPM, and the importance of AI security. ## Detecting Failed Sign In Attempts to AWS and Alerting DevFeed: [Detecting Failed Sign In Attempts to AWS and Alerting]() Original publisher: [Read original article]() Author: Guillermo Ojeda Published: 2023-10-26T15:26:47Z Content type: tutorial Language: en Sources: [Guille Ojeda]() Topics: [AWS CloudTrail](), [AWS IAM](), [MFA](), [Amazon Web Services](), [Security](), [cloud security]() Tags: [aws](), [aws-cloudtrail](), [aws-iam](), [best-practices](), [mfa](), [password](), [phishing](), [security]() ### AI overview A tutorial describes detecting failed AWS sign-in attempts caused by failed MFA checks and using AWS CloudTrail event logs to investigate authentication activity. It explains that CloudTrail records requests from the AWS Console, CLI, SDKs, and APIs, and that trails can export events to Amazon S3 or CloudWatch Logs for analysis. ### Source excerpt Note: This content was originally published at the Simple AWS newsletter. Imagine this scenario: You're careful with security, and you set up Multi-Factor Authentication for your AWS IAM or IAM Identity Center user. At one point, a malicious agent of... ## Best Practices for Secure Infrastructure Access DevFeed: [Best Practices for Secure Infrastructure Access]() Original publisher: [Read original article]() Author: info@goteleport.com (Virag Mody) Published: 2020-09-10T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [cloud-infrastructure](), [cloud security](), [Networks](), [Software as a service]() Tags: [best-practices](), [cloud](), [cloud-computing](), [identity](), [infrastructure](), [networks]() ### AI overview An excerpt from a technical paper on securing infrastructure access. It recommends basing access decisions on identity, avoiding trust in private networks, and centralizing auditing. ### Source excerpt This paper explains how companies can secure infrastructure access by basing decisions on identity, not trusting private networks, and centralizing auditing. ## Announcing our Series A DevFeed: [Announcing our Series A]() Original publisher: [Read original article]() Author: ev@goteleport.com (Ev Kontsevoy) Published: 2019-11-20T00:00:00Z Content type: release Language: en Sources: [Teleport]() Topics: [Cloud](), [cloud-infrastructure](), [Development](), [DevOps](), [Open Source](), [cloud security]() Tags: [audit](), [aws](), [cloud-computing](), [cloud-infrastructure](), [development](), [devops](), [funding](), [mfa](), [open-source](), [product](), [product-development](), [series]() ### AI overview Gravitational announces a $25 million Series A funding round led by Kleiner Perkins. The company says the funding will accelerate product development and expand enterprise support. The article also describes Gravity for packaging and moving production environments across cloud providers and Teleport for certificate-based secure access to multi-cloud infrastructure. ### Source excerpt Announcing our Series A funding to unchain applications from the cloud providers. ## Actionable Followups from the Capital One Breach DevFeed: [Actionable Followups from the Capital One Breach]() Original publisher: [Read original article]() Author: Adam Published: 2019-07-30T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Security](), [cloud security](), [Authorization](), [Code](), [Agile]() Tags: [agile](), [breach](), [cloud-security](), [code](), [permissions](), [security]() ### AI overview The article draws actionable security lessons from the Capital One breach, focusing on avoiding overly broad permissions and using static analysis and commit hooks to detect or block risky access grants. It also argues that security guidance can be progressively turned into code and improved through an agile approach. ### Source excerpt What have we learned and what steps can we take? ## 2017 and Tidal Forces DevFeed: [2017 and Tidal Forces]() Original publisher: [Read original article]() Author: Adam Published: 2017-01-13T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [cloud security](), [Cloud](), [Amazon Web Services](), [Architecture & Design]() Tags: [2017](), [aws](), [blog](), [cloud-security]() ### AI overview The article argues that cloud security changes the skills and operating practices required of security professionals and organizations. Because cloud services evolve continuously, practitioners need ongoing learning and modeling skills, while organizations must adapt their training plans and curricula. ### Source excerpt [no description provided]