Skip to content
HACKTECH

Cyber news digest

What broke, and what we check because of it.

Breaches, exploited vulnerabilities, supply chain compromises and new rules, written up for the people who buy security work, with what each one means for an organisation that runs the same kind of systems. Every item cites at least two sources and was verified against them before publication.

52 items214 cited sourcesLatest item 5 November 2026

Showing 5 items in Cloud & identity. Show all 52 items

October 2026

1 item

  • Cloud & identity

    Northflank breach: control-plane secrets decrypted, customers report AI API key abuse

    Cloud application hosting platform Northflank told customers on 30 October 2026 to assume all environment variables had been decrypted and to disable or rotate all keys, after receiving a threat alert from Wiz at 11:43 UTC. In a 6 November update, Northflank said the first known decryption of secrets occurred between 02:39 and 03:08 UTC that day, that the exploit was patched within 60 minutes of notification, and that it had found no evidence customer workloads or workload data were accessed. Customers reported unauthorised use of AI API keys stored on the platform. Wiz listed Northflank among at least nine AI developer platforms that disclosed incidents in October, while noting that no single vulnerability or dependency links them.

    • Cloud configuration review
    • Incident response
    • AI & LLM application testing

July 2026

1 item

  • Cloud & identity

    CosmosEscape: Azure Cosmos DB flaw exposed a platform key that could open any account

    Wiz Research disclosed on 30 July 2026 a vulnerability chain in Azure Cosmos DB's Gremlin API that it named CosmosEscape. Wiz said the restrictions Cosmos DB's engine applied to Gremlin queries did not sufficiently account for .NET reflection, allowing code execution on the multi-tenant DB Gateway, where a signing key it dubbed the 'Cosmos Master Key' could retrieve the primary key of any Cosmos DB account across tenants, regions and API types. Microsoft deployed a mitigation within 48 hours of the 20 November 2025 report and completed a long-term fix across all regions in July 2026. Microsoft said extensive reviews of access logs found no evidence of unauthorised activity outside the researchers' testing and that no customer action is required.

    • Cloud configuration review
    • Database security audit
    • Threat modelling

June 2026

1 item

  • Cloud & identity

    Klue breach: stolen integration OAuth tokens used to pull customers' Salesforce data

    Competitive-intelligence vendor Klue said it identified unauthorised activity affecting part of its integration infrastructure on 12 June 2026, and disclosed the incident publicly in an 18 June statement. According to a CrowdStrike investigation summarised by Klue, an attacker used a previously compromised GitHub personal access token on 11 June to insert code into Klue's integration service and collect OAuth access and refresh tokens for Salesforce, which were used to pull CRM data from connected customer environments. Huntress, Recorded Future, Tanium, Jamf, Sprout Social, Gong and Insurity were among the organisations that disclosed impact, and Huntress attributed the attack with high confidence to an extortion group calling itself Icarus.

    • Cloud configuration review
    • Incident response
    • Application security audit

April 2026

1 item

  • Cloud & identity

    Vercel breach traced to compromised Context.ai OAuth app in employee's Google Workspace

    Vercel disclosed on 19 April 2026 a security incident involving unauthorised access to certain internal Vercel systems. Vercel said the incident originated with a compromise of Context.ai, a third-party AI tool used by an employee: the attacker took over the employee's Vercel Google Workspace account and Vercel account, pivoted into a Vercel environment, and enumerated and decrypted environment variables that were not marked as sensitive. Context.ai said an attacker who accessed its AWS environment in March likely compromised OAuth tokens for some consumer users and appears to have used one to access Vercel's Google Workspace. Vercel notified affected customers and declared the incident closed on 16 October 2026.

    • Cloud configuration review
    • Red team & purple team
    • Incident response

March 2026

1 item

  • Cloud & identity

    Microsoft and Europol disrupt Tycoon 2FA, an MFA-bypass phishing-as-a-service platform

    On 4 March 2026 Microsoft, acting under a US court order and for the first time in coordination with Europol's Cyber Intelligence Extension Programme, seized 330 domains that powered Tycoon 2FA, an adversary-in-the-middle phishing-as-a-service platform that captured credentials and session cookies and relayed MFA codes to break into accounts on services including Microsoft 365, Outlook and Gmail. Law enforcement in Latvia, Lithuania, Portugal, Poland, Spain and the United Kingdom seized infrastructure, partners including Cloudflare, Proofpoint and Health-ISAC supported the action, and Europol said the investigation began with intelligence shared by Trend Micro. Microsoft said the service was responsible for tens of millions of fraudulent emails reaching over 500,000 organisations each month. Its Q1 2026 email threat report later said phishing pointing to Tycoon2FA fell 15% in March, driven largely by the disruption, and that the operators had since shifted hosting providers and domain registration patterns in a partial recovery.

    • Cloud configuration review
    • Social engineering assessment
    • Incident response

Run the checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Book the scoping callHow incident response works