https://blog.itsdavidg.co/tags/devops-engineering/ Recent content in DevOps Engineering on David Gomez - Technology & Business Insights Hugo en-us Mon, 31 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-31-aws-security-audit-aurora-ransomware-operators-use-cursor-ai-in-attacks-again/ Mon, 31 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-31-aws-security-audit-aurora-ransomware-operators-use-cursor-ai-in-attacks-again/ Threat actors associated with Aurora (aka Aur0ra) ransomware have been observed using SpaceX's artificial intelligence (AI)-powered coding assistant Cursor to break into target networks, according to findings from CloudSEK and Gambit Security. The two independent analyses are based on exposed infrastructure associated with the Russian-speaking cybercrime gro https://blog.itsdavidg.co/posts/2026-08-30-aws-security-audit-amazon-kiro-prompt-injection-can-exfiltrate-sensitive-data/ Sun, 30 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-30-aws-security-audit-amazon-kiro-prompt-injection-can-exfiltrate-sensitive-data/ Cybersecurity researchers have disclosed details of a vulnerability in Amazon Kiro, an artificial intelligence (AI)-powered, agentic integrated development environment (IDE), that could facilitate data exfiltration via prompt injection and Kiro Powers. The security flaw, which does not have a CVE identifier, works against Kiro IDE 0.7.45 on Windows, accordin https://blog.itsdavidg.co/posts/2026-08-29-aws-security-audit-owncloud-flaw-exploited-to-steal-nuclear-records-from-phil/ Sat, 29 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-29-aws-security-audit-owncloud-flaw-exploited-to-steal-nuclear-records-from-phil/ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting ownCloud to its Known Exploited Vulnerabilities (KEV) catalog following reports that a Chinese-speaking threat actor weaponized the vulnerability to target a nuclear research body in the Philippines. The vulnerability, tracked as CVE-2023-491 https://blog.itsdavidg.co/posts/2026-08-28-aws-security-audit-openai-says-reward-hacking-drove-ai-agents-to-exploit-zero/ Fri, 28 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-28-aws-security-audit-openai-says-reward-hacking-drove-ai-agents-to-exploit-zero/ OpenAI on Wednesday revealed that reward hacking was a key driver behind the artificial intelligence (AI)-powered hack of Hugging Face last month, adding that it found evidence of misaligned behavior as early as late May. The incident, the company said, took place during cybersecurity evaluations of several OpenAI models, and that it was mainly fueled by wha https://blog.itsdavidg.co/posts/2026-08-27-aws-security-audit-cisa-adds-six-exploited-flaws-to-kev-including-netscaler-l/ Thu, 27 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-27-aws-security-audit-cisa-adds-six-exploited-flaws-to-kev-including-netscaler-l/ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added six flaws to its Known Exploited Vulnerabilities (KEV) catalog, including a high-severity security vulnerability impacting Citrix NetScaler ADC and NetScaler Gateway, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2019-1068 - A remote code https://blog.itsdavidg.co/posts/2026-08-26-aws-security-audit-critical-gitea-rce-actively-exploited-as-reported-attack-d/ Wed, 26 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-26-aws-security-audit-critical-gitea-rce-actively-exploited-as-reported-attack-d/ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned of active exploitation efforts targeting a recently patched critical security flaw impacting Gitea. The vulnerability in question is CVE-2026-60004 (CVSS score: 9.8), a case of remote code execution that allows an attacker with ordinary write access to a repository to execute https://blog.itsdavidg.co/posts/2026-08-25-aws-security-audit-sagemaker-mlflow-now-supports-customer-managed-keys/ Tue, 25 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-25-aws-security-audit-sagemaker-mlflow-now-supports-customer-managed-keys/ SageMaker MLflow now enables customers to encrypt their data using customer-managed keys (CMK) through AWS Key Management Service (KMS). This enhancement allows organizations with strict security and compliance requirements to manage their own encryption keys. With customer-managed keys, you gain enhanced security control and comprehensive audit capabilities https://blog.itsdavidg.co/posts/2026-08-24-aws-security-audit-critical-keycloak-password-reset-flaw-could-let-unauthenti/ Mon, 24 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-24-aws-security-audit-critical-keycloak-password-reset-flaw-could-let-unauthenti/ Red Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management server that could allow an unauthenticated remote attacker to take over any user account by forcing a password reset. The vulnerability, assigned the CVE identifier CVE-2026-18963, is rated 9.1 on the CVSS scoring syste https://blog.itsdavidg.co/posts/2026-08-23-aws-security-audit-why-shady-ai-is-security-s-next-big-governance-problem/ Sun, 23 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-23-aws-security-audit-why-shady-ai-is-security-s-next-big-governance-problem/ In March 2026, an internal AI agent at Meta triggered a “Sev 1” incident after sensitive company and user data was exposed to employees who weren’t authorized to access it. The incident began when a Meta employee posted a technical question on an internal forum. An engineer used an approved AI agent to analyze it, but the agent posted its response publicly w https://blog.itsdavidg.co/posts/2026-08-22-aws-security-audit-isolated-vm-flaw-lets-sandboxed-javascript-escape-to-host/ Sat, 22 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-22-aws-security-audit-isolated-vm-flaw-lets-sandboxed-javascript-escape-to-host/ Cybersecurity researchers have disclosed a critical security flaw in isolated-vm, a popular open-source sandbox with more than 2,900 stars and 190 forks on GitHub, that could allow attackers to escape the confines of the isolated environment. The vulnerability ("GHSA-864f-rcv7-6rh4"), which has yet to be assigned a CVE identifier, impacts all versions of the https://blog.itsdavidg.co/posts/2026-08-21-aws-security-audit-gitlab-cve-2026-19478-comes-under-active-exploitation-with/ Fri, 21 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-21-aws-security-audit-gitlab-cve-2026-19478-comes-under-active-exploitation-with/ A newly disclosed security flaw in GitLab has come under active exploitation within days of public disclosure, according to watchTowr. The vulnerability in question is CVE-2026-19478 (CVSS score: 9.4), a case of code injection that allows an unauthenticated attacker to modify or delete publicly accessible GitLab projects and rewrite their data under certain https://blog.itsdavidg.co/posts/2026-08-20-aws-security-audit-elementor-pro-flaw-could-let-unauthenticated-attackers-upl/ Thu, 20 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-20-aws-security-audit-elementor-pro-flaw-could-let-unauthenticated-attackers-upl/ Cybersecurity researchers have disclosed details of a critical flaw in the Elementor Pro WordPress plugin that, if successfully exploited, could lead to remote code execution. The vulnerability, tracked as CVE-2026-32475, carries a CVSS score of 9.0 out of 10.0. It has been described as a case of unrestricted upload of a file with a dangerous type. "The flaw https://blog.itsdavidg.co/posts/2026-08-19-aws-security-audit-aws-iam-identity-federation-to-external-services-is-now-av/ Wed, 19 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-19-aws-security-audit-aws-iam-identity-federation-to-external-services-is-now-av/ AWS Identity and Access Management (IAM) now enables AWS workloads in the AWS European Sovereign Cloud (Germany) Region to securely authenticate with external services using short-lived JSON Web Tokens (JWTs). The AWS European Sovereign Cloud is an independent cloud for Europe entirely located within the European Union (EU), designed to help customers meet t https://blog.itsdavidg.co/posts/2026-08-18-aws-security-audit-apple-macos-screen-sharing-flaw-exploited-on-internet-expo/ Tue, 18 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-18-aws-security-audit-apple-macos-screen-sharing-flaw-exploited-on-internet-expo/ A recently patched security flaw in Apple macOS has come under active exploitation in the wild to deploy a cryptocurrency miner, the Netherlands National Cyber Security Centre (NCSC-NL) has warned. The vulnerability in question is CVE-2026-65400 (CVSS score: 9.8), a critical authentication issue impacting the Screen Sharing component that could allow an atta https://blog.itsdavidg.co/posts/2026-08-17-aws-security-audit-suspected-china-nexus-actor-exploits-vmware-vcenter-flaw-d/ Mon, 17 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-17-aws-security-audit-suspected-china-nexus-actor-exploits-vmware-vcenter-flaw-d/ Cybersecurity researchers have attributed the exploitation of a newly patched security flaw in Broadcom VMware vCenter to a suspected China-nexus advanced persistent threat (APT). The attacks involve the exploitation of CVE-2026-59310 (CVSS score: 9.8), a severe directory-traversal vulnerability in the VMware vCenter server that could be weaponized by a mali https://blog.itsdavidg.co/posts/2026-08-16-aws-security-audit-attackers-exploit-vmware-vcenter-vulnerability-to-gain-per/ Sun, 16 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-16-aws-security-audit-attackers-exploit-vmware-vcenter-vulnerability-to-gain-per/ Threat actors have begun to actively exploit a recently patched critical security flaw in Broadcom VMware vCenter, according to new findings from QUIRSO. The vulnerability in question is CVE-2026-59310 (CVSS score: 9.8), a directory-traversal vulnerability in the VMware vCenter server that a malicious actor with network access can exploit to execute arbitrar https://blog.itsdavidg.co/posts/2026-08-15-aws-security-audit-adobe-patches-three-cvss-10-0-coldfusion-and-campaign-clas/ Sat, 15 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-15-aws-security-audit-adobe-patches-three-cvss-10-0-coldfusion-and-campaign-clas/ Adobe has shipped updates to address multiple critical security vulnerabilities impacting ColdFusion, Commerce, and Campaign Classic that, if successfully exploited, could result in arbitrary code execution and privilege escalation. The most severe of the flaws are listed below - CVE-2026-48362 (CVSS score: 10.0) - An operating system command injection vulne https://blog.itsdavidg.co/posts/2026-08-14-aws-security-audit-attackers-exploit-sharepoint-authentication-bypass-after-p/ Fri, 14 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-14-aws-security-audit-attackers-exploit-sharepoint-authentication-bypass-after-p/ Threat actors have begun to exploit a newly disclosed Microsoft SharePoint vulnerability following the release of a proof-of-concept (PoC) code. The vulnerability in question is CVE-2026-55040 (CVSS score: 9.1), which refers to a critical security feature bypass that stems from weak authentication. It was patched by Microsoft as part of its July 2026 Patch T https://blog.itsdavidg.co/posts/2026-08-13-aws-security-audit-openai-launches-gpt-5-6-cyber-with-reduced-safeguards-for/ Thu, 13 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-13-aws-security-audit-openai-launches-gpt-5-6-cyber-with-reduced-safeguards-for/ OpenAI on Monday unveiled a new cybersecurity-focused model called GPT‑5.6‑Cyber that it said is focused on vulnerability research, penetration testing, and incident response. "Built on GPT‑5.6 Sol, it is trained to improve capabilities on several specialized cybersecurity tasks (e.g., finding zero-day vulnerabilities and developing exploit chains) and to re https://blog.itsdavidg.co/posts/2026-08-12-aws-security-audit-shieldbreak-zero-day-poc-claims-microsoft-defender-patch-b/ Wed, 12 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-12-aws-security-audit-shieldbreak-zero-day-poc-claims-microsoft-defender-patch-b/ The security researcher going by the name Chaotic Eclipse (aka INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) has released a proof-of-concept (PoC) for a new Microsoft zero-day called ShieldBreak. The vulnerability, rooted in Microsoft Defender for Windows, demonstrates a patch bypass for CVE-2026-50656 (CVSS score: 7.8), otherwise known as RoguePla https://blog.itsdavidg.co/posts/2026-08-11-aws-security-audit-gunra-ransomware-exploits-fortinet-and-schneider-electric/ Tue, 11 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-11-aws-security-audit-gunra-ransomware-exploits-fortinet-and-schneider-electric/ Cybersecurity and intelligence agencies from South Korea and the U.S. warned of Gunra ransomware attacks targeting critical infrastructure sectors and organizations across the world. Targets of these attacks include healthcare and public health, financial services, government services and facilities, and professional and nonprofit services. "Gunra is another https://blog.itsdavidg.co/posts/2026-08-10-aws-security-audit-new-passkey-attacks-can-recover-synced-private-keys-or-byp/ Mon, 10 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-10-aws-security-audit-new-passkey-attacks-can-recover-synced-private-keys-or-byp/ Three separate research efforts last week demonstrated ways to defeat passkey protections without breaking the cryptography they rest on. Passkeys are designed to replace reusable passwords and resist phishing. The attacks instead reused signed authentication material that Windows had exposed, abused a cloud-synced passkey system from malware already on the https://blog.itsdavidg.co/posts/2026-08-09-aws-security-audit-progress-kemp-loadmaster-flaw-hits-cisa-kev-after-792-repo/ Sun, 09 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-09-aws-security-audit-progress-kemp-loadmaster-flaw-hits-cisa-kev-after-792-repo/ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical-severity security flaw impacting Progress Kemp LoadMaster to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild. The vulnerability, tracked as CVE-2026-8037 (CVSS score: 9.6), is a command injection flaw that could https://blog.itsdavidg.co/posts/2026-08-08-aws-security-audit-metabase-zero-day-exploited-in-wild-allows-admin-access-wi/ Sat, 08 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-08-aws-security-audit-metabase-zero-day-exploited-in-wild-allows-admin-access-wi/ Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day. The vulnerability (CVSS score: 10.0), which does not carry a CVE identifier, allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application databas https://blog.itsdavidg.co/posts/2026-08-07-aws-security-audit-new-zapscape-kvm-flaw-could-let-privileged-l1-guest-code-e/ Fri, 07 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-07-aws-security-audit-new-zapscape-kvm-flaw-could-let-privileged-l1-guest-code-e/ Zapscape, a new Linux kernel vulnerability, could allow an attacker with kernel privileges inside an L1 guest virtual machine (VM) to escape KVM isolation and execute code on the host. The risk applies when nested virtualization is exposed to untrusted guests. The flaw is tracked as CVE-2026-64561 and affects KVM/x86's shadow memory management unit (MMU), wh https://blog.itsdavidg.co/posts/2026-08-06-aws-security-audit-cisa-flags-teamcity-cve-2026-63077-rce-flaw-under-active-e/ Thu, 06 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-06-aws-security-audit-cisa-flags-teamcity-cve-2026-63077-rce-flaw-under-active-e/ A newly patched security flaw impacting on-premise versions of JetBrains TeamCity has come under active exploitation in the wild, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The vulnerability in question is CVE-2026-63077 (CVSS score: 9.8), a case of deserialization of untrusted data that could allow an unauthenticated atta https://blog.itsdavidg.co/posts/2026-08-05-aws-security-audit-new-ovswrap-linux-kernel-flaw-lets-local-users-gain-root-v/ Wed, 05 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-05-aws-security-audit-new-ovswrap-linux-kernel-flaw-lets-local-users-gain-root-v/ A memory corruption flaw in the Linux kernel's Open vSwitch datapath gives ordinary local users a path to root on a broad set of default-configured distributions, and a public exploit ships with pre-built records for roughly 800 kernel builds. The vulnerability, tracked as CVE-2026-64531 (CVSS score: 7.8) and codenamed OVSwrap by its discoverer, was disclose https://blog.itsdavidg.co/posts/2026-08-04-aws-security-audit-cisa-adds-exploited-n-able-n-central-flaw-to-kev-after-cus/ Tue, 04 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-04-aws-security-audit-cisa-adds-exploited-n-able-n-central-flaw-to-kev-after-cus/ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity security flaw impacting N-able N-central to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation in the wild. The vulnerability, tracked as CVE-2026-18577 (CVSS score: 8.2), is a case of incomplete patching for CVE-2026-18556 https://blog.itsdavidg.co/posts/2026-08-03-aws-security-audit-pnld-breach-exposes-u-k-police-and-government-contact-deta/ Mon, 03 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-03-aws-security-audit-pnld-breach-exposes-u-k-police-and-government-contact-deta/ The Police National Legal Database (PNLD) has confirmed that police, government and customer contact information was compromised and published on the dark web. The data included names, organisations and work email addresses belonging to police officers, police staff, criminal justice professionals, government partners and customers. The incident, identified https://blog.itsdavidg.co/posts/2026-08-02-aws-security-audit-ruflo-mcp-flaw-lets-unauthenticated-attackers-run-commands/ Sun, 02 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-02-aws-security-audit-ruflo-mcp-flaw-lets-unauthenticated-attackers-run-commands/ Cybersecurity researchers have flagged a maximum-severity security flaw in Ruflo, an open-source agent meta-harness for Anthropic Claude Code and OpenAI Codex, that could result in unauthenticated remote code execution. The vulnerability, tracked as CVE-2026-59726 (CVSS score: 10.0), impacts all versions of the project before version 3.16.3. It has been code https://blog.itsdavidg.co/posts/2026-08-01-aws-security-audit-adobe-campaign-classic-cvss-10-0-flaw-could-run-code-witho/ Sat, 01 Aug 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-08-01-aws-security-audit-adobe-campaign-classic-cvss-10-0-flaw-could-run-code-witho/ Adobe has released security updates to address a maximum-severity security flaw in Campaign Classic (ACC), its enterprise-focused marketing automation platform, that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-48449, carries a severity score of 10.0 on the CVSS scoring system. It has been described as a case of incorrect https://blog.itsdavidg.co/posts/2026-07-31-aws-security-audit-anthropic-says-claude-mistook-the-open-internet-for-a-ctf/ Fri, 31 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-31-aws-security-audit-anthropic-says-claude-mistook-the-open-internet-for-a-ctf/ Anthropic on Thursday became the latest artificial intelligence (AI) company to reveal that three of its models, including Claude Opus 4.7, Mythos 5, and an unnamed research model, had breached three unnamed organizations during cybersecurity testing without its knowledge. The AI firm said the earliest incidents date back to April 2026, adding it made the di https://blog.itsdavidg.co/posts/2026-07-30-aws-security-audit-cisco-fmc-zero-day-actively-exploited-static-credentials-c/ Thu, 30 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-30-aws-security-audit-cisco-fmc-zero-day-actively-exploited-static-credentials-c/ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a newly disclosed security flaw impacting Cisco Secure Firewall Management Center (FMC) Software to its Known Exploited Vulnerabilities (KEV) catalog, following reports of zero-day exploitation. The vulnerability, assigned CVE-2026-20316 (CVSS score: 5.3), could permit an una https://blog.itsdavidg.co/posts/2026-07-29-aws-security-audit-openai-agent-used-exposed-credentials-across-four-services/ Wed, 29 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-29-aws-security-audit-openai-agent-used-exposed-credentials-across-four-services/ OpenAI on Tuesday revealed the rogue artificial intelligence (AI) agent that escaped its sealed evaluation environment and broke into Hugging Face's production environment also hacked multiple third-party accounts and services as part of the attack. The latest disclosure shows that the security incident, which stemmed from an internal security test, was more https://blog.itsdavidg.co/posts/2026-07-28-aws-security-audit-critical-teamcity-flaw-could-let-attackers-run-os-commands/ Tue, 28 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-28-aws-security-audit-critical-teamcity-flaw-could-let-attackers-run-os-commands/ JetBrains is urging customers of on-premise versions of TeamCity to update to the latest version following the discovery of a critical security issue that could result in arbitrary code execution. The vulnerability, assigned CVE-2026-63077 (CVSS score: 9.8), affects all TeamCity On-Premises versions. It has been addressed in versions 2025.11.7 and 2026.1.3. https://blog.itsdavidg.co/posts/2026-07-27-aws-security-audit-adobe-acrobat-extension-flaw-let-malicious-sites-read-what/ Mon, 27 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-27-aws-security-audit-adobe-acrobat-extension-flaw-let-malicious-sites-read-what/ Cybersecurity researchers have disclosed details of a now-patched vulnerability chain in the Adobe Acrobat Chrome extension that has over 314 million users, which, if exploited, could facilitate a silent hijack of a user's WhatsApp data. The shortcoming has been codenamed HermeticReader by Guardio Labs. It's officially tracked as CVE-2026-48294 (CVSS score: https://blog.itsdavidg.co/posts/2026-07-26-aws-security-audit-fastjson-1-x-rce-vulnerability-targeted-in-attacks-with-no/ Sun, 26 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-26-aws-security-audit-fastjson-1-x-rce-vulnerability-targeted-in-attacks-with-no/ Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process. Tracked as CVE-2026-16723, the vulnerability carries an Alibaba-assigned CVSS score of https://blog.itsdavidg.co/posts/2026-07-25-aws-security-audit-opus-4-8-sonnet-5-and-user-activity-monitoring-now-availab/ Sat, 25 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-25-aws-security-audit-opus-4-8-sonnet-5-and-user-activity-monitoring-now-availab/ Two new models are now available in the Kiro IDE and CLI for the AWS GovCloud (US) Regions. Claude Opus 4.8 is the most intelligent Opus model, delivering stronger self-verification, more efficient tool calling, and better follow-through on long-horizon projects. It plans before it edits, catches its own mistakes, and finds creative paths around obstacles in https://blog.itsdavidg.co/posts/2026-07-24-aws-security-audit-chatgpt-agentforger-flaw-could-deploy-rogue-workspace-agen/ Fri, 24 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-24-aws-security-audit-chatgpt-agentforger-flaw-could-deploy-rogue-workspace-agen/ Cybersecurity researchers have disclosed a critical vulnerability in OpenAI's ChatGPT Workspace Agents that could have allowed a single phishing link to stealthily build, authorize, and deploy an autonomous artificial intelligence (AI) agent inside a victim's organization. The vulnerability has been codenamed AgentForger by Zenity Labs. The issue has since b https://blog.itsdavidg.co/posts/2026-07-23-aws-security-audit-ubuntu-snap-confine-flaw-could-give-local-users-root-on-de/ Thu, 23 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-23-aws-security-audit-ubuntu-snap-confine-flaw-could-give-local-users-root-on-de/ Cybersecurity researchers have disclosed details of a new local privilege escalation (LPE) vulnerability in snap-confine that an unprivileged user can trigger to obtain root access and gain complete control of a target environment. The high-severity flaw, tracked as CVE-2026-8933 (CVSS score: 7.8), impacts default installations of Ubuntu Desktop 24.04, 25.10 https://blog.itsdavidg.co/posts/2026-07-22-aws-security-audit-qilin-ransomware-attackers-exploit-pan-os-authentication-b/ Wed, 22 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-22-aws-security-audit-qilin-ransomware-attackers-exploit-pan-os-authentication-b/ Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability as an entry point to deploy Qilin (aka Agenda) ransomware on victim environments. Arctic Wolf Labs said it investigated multiple intrusions in June 2026 that began with the exploitation of CVE-2026-0257 (CVSS score: 7.8), an authentication bypass f https://blog.itsdavidg.co/posts/2026-07-21-aws-security-audit-critical-servicenow-ai-platform-flaw-exploited-for-unauthe/ Tue, 21 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-21-aws-security-audit-critical-servicenow-ai-platform-flaw-exploited-for-unauthe/ Threat actors are now exploiting a recently disclosed critical security flaw impacting ServiceNow AI Platform, according to Defused Cyber. In a post shared on X, the threat intelligence firm said it's observing in-the-wild exploitation of CVE-2026-6875 (CVSS score: 9.5), a sandbox escape vulnerability that could allow an unauthenticated user to run arbitrary https://blog.itsdavidg.co/posts/2026-07-20-aws-security-audit-sonicwall-sma-zero-days-exploited-before-disclosure-to-gai/ Mon, 20 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-20-aws-security-audit-sonicwall-sma-zero-days-exploited-before-disclosure-to-gai/ A previously undocumented threat actor has been attributed to the exploitation of recently disclosed SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances as zero-days prior their public disclosure since June 22, 2026. Cybersecurity company Volexity is tracking the activity under the moniker UTA0533. The discovery was made following an incident res https://blog.itsdavidg.co/posts/2026-07-19-aws-security-audit-aws-iam-identity-center-achieves-fedramp-class-c-certifica/ Sun, 19 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-19-aws-security-audit-aws-iam-identity-center-achieves-fedramp-class-c-certifica/ AWS IAM Identity Center is now in scope for FedRAMP Class C in the US East (Ohio), US East (N. Virginia), US West (N. California), and US West (Oregon) Regions. You can now use IAM Identity Center to enable workforce access to AWS accounts and applications that are subject to FedRAMP Class C compliance. The Federal Risk and Authorization Management Program ( https://blog.itsdavidg.co/posts/2026-07-18-aws-security-audit-goldeneyedog-subgroup-linked-to-digicert-breach-and-code-s/ Sat, 18 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-18-aws-security-audit-goldeneyedog-subgroup-linked-to-digicert-breach-and-code-s/ Cybersecurity researchers have attributed the April 2026 DigiCert security incident to a threat activity cluster dubbed CylindricalCanine. Expel, which shared technical details of the event, described the threat actor as a sub-group of GoldenEyeDog (aka APT-Q-27, Dragon Breath, and Miuuti Group), a Chinese cybercrime group known for its targeting of the gamb https://blog.itsdavidg.co/posts/2026-07-17-aws-security-audit-cisa-adds-exploited-sharepoint-rce-zero-day-cve-2026-58644/ Fri, 17 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-17-aws-security-audit-cisa-adds-exploited-sharepoint-rce-zero-day-cve-2026-58644/ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a newly patched security flaw impacting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by July 19, 2026. The vulnerability in question is CVE-2026-58644 (CVSS scor https://blog.itsdavidg.co/posts/2026-07-16-aws-security-audit-zoom-patches-critical-windows-flaw-that-could-enable-accou/ Thu, 16 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-16-aws-security-audit-zoom-patches-critical-windows-flaw-that-could-enable-accou/ Zoom has released security updates for a critical security flaw impacting Zoom Workplace for Windows that could facilitate account takeover. The vulnerability, tracked as CVE-2026-53412 (CVSS score: 9.8), affects Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows. "Improper Input Validation in Zoom Desktop Client f https://blog.itsdavidg.co/posts/2026-07-15-aws-security-audit-microsoft-patches-record-622-flaws-including-two-zero-days/ Wed, 15 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-15-aws-security-audit-microsoft-patches-record-622-flaws-including-two-zero-days/ Microsoft shipped its largest Patch Tuesday on record today, and two of the fixes close holes that attackers are already exploiting. The release covers 622 of Microsoft's own CVEs by its Security Update Guide count, more than triple June's previous high of around 200. Those two live bugs are the ones to grab first. Microsoft credits incident responders for b https://blog.itsdavidg.co/posts/2026-07-14-aws-security-audit-apple-says-former-employee-exploited-rare-bug-to-download/ Tue, 14 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-14-aws-security-audit-apple-says-former-employee-exploited-rare-bug-to-download/ Apple would not comment on the "security breach," which allegedly allowed a former employee to download sensitive files from Apple's network long after he departed the company for rival OpenAI. https://blog.itsdavidg.co/posts/2026-07-13-aws-security-audit-icagenda-and-balbooa-forms-joomla-flaws-reportedly-exploit/ Mon, 13 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-13-aws-security-audit-icagenda-and-balbooa-forms-joomla-flaws-reportedly-exploit/ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two maximum-severity security flaws impacting iCagenda and Balbooa extensions for Joomla to its Known Exploited Vulnerabilities (KEV) catalog, following reports of zero-day exploitation in the wild. The vulnerabilities, both rated 10.0 on the CVSS scoring system, are below - CVE-2026- https://blog.itsdavidg.co/posts/2026-07-12-aws-security-audit-us-cybersecurity-agency-cisa-had-to-build-its-incident-pla/ Sun, 12 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-12-aws-security-audit-us-cybersecurity-agency-cisa-had-to-build-its-incident-pla/ Independent cybersecurity journalist Brian Krebs reported in May that a security researcher with cyber firm GitGuardian alerted him to reams of exposed passwords stored in a publicly accessible GitHub repository, which an employee of a CISA contractor had uploaded. https://blog.itsdavidg.co/posts/2026-07-11-aws-security-audit-critical-zimbra-flaw-could-let-crafted-emails-run-maliciou/ Sat, 11 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-11-aws-security-audit-critical-zimbra-flaw-could-let-crafted-emails-run-maliciou/ Zimbra is urging customers to apply updates to address a critical security vulnerability impacting the Classic Web Client that could result in arbitrary code execution. The vulnerability has been described as a case of stored cross-site scripting (XSS) that could allow specially crafted emails to execute malicious scripts in a user's session. It has yet to b https://blog.itsdavidg.co/posts/2026-07-10-aws-security-audit-ubiquiti-patches-critical-unifi-flaws-across-connect-talk/ Fri, 10 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-10-aws-security-audit-ubiquiti-patches-critical-unifi-flaws-across-connect-talk/ Ubiquiti has shipped updates to address multiple critical security flaws impacting UniFi Connect, UniFi Talk, UniFi Access, UniFi Protect, and UniFi OS that could result in privilege escalation and arbitrary command execution. The list of vulnerabilities is as follows - CVE-2026-50746 (CVSS score: 10.0) - An improper access control vulnerability in UniFi Con https://blog.itsdavidg.co/posts/2026-07-09-aws-security-audit-microsoft-patches-rogueplanet-defender-flaw-that-can-grant/ Thu, 09 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-09-aws-security-audit-microsoft-patches-rogueplanet-defender-flaw-that-can-grant/ Microsoft has released security updates for a Defender vulnerability known as RoguePlanet, nearly a month after details of the flaw became public. The vulnerability, tracked as CVE-2026-50656 (CVSS score: 7.8), is a privilege escalation issue in the Microsoft Malware Protection Engine ("mpengine.dll"), which provides scanning, detection, and cleaning capabil https://blog.itsdavidg.co/posts/2026-07-08-aws-security-audit-hacked-leaked-and-held-for-ransom-the-worst-breaches-of-20/ Wed, 08 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-08-aws-security-audit-hacked-leaked-and-held-for-ransom-the-worst-breaches-of-20/ From a massive DOGE data breach and the hacking of critical energy and water systems to the hack of an FBI surveillance system, here are the most damaging security incidents and data breaches of 2026. https://blog.itsdavidg.co/posts/2026-07-07-aws-security-audit-beyondtrust-patches-critical-auth-bypass-flaws-in-remote-s/ Tue, 07 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-07-aws-security-audit-beyondtrust-patches-critical-auth-bypass-flaws-in-remote-s/ BeyondTrust has released updates to address two critical security flaws affecting Remote Support (RS) and Privileged Remote Access (PRA) products that, if successfully exploited, could allow unauthenticated attackers to take control of susceptible devices. The vulnerabilities are listed below - CVE-2026-40138 (CVSS score: 9.2) - A pre-authentication vulnerab https://blog.itsdavidg.co/posts/2026-07-06-aws-security-audit-u-s-government-entity-paid-kairos-1-million-in-data-theft/ Mon, 06 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-06-aws-security-audit-u-s-government-entity-paid-kairos-1-million-in-data-theft/ A U.S. government entity paid about $1 million to keep stolen files from being leaked, according to a new case study by Rakesh Krishnan for Ransom-ISAC, built on a leaked negotiation chat and the blockchain trail the payment left. The odd part: the group that took the money calls itself Kairos, but it may not be a ransomware gang at all. Krishnan found no si https://blog.itsdavidg.co/posts/2026-07-05-aws-security-audit-sharepoint-rce-cve-2026-45659-added-to-cisa-kev-after-acti/ Sun, 05 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-05-aws-security-audit-sharepoint-rce-cve-2026-45659-added-to-cisa-kev-after-acti/ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a high-severity flaw impacting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-45659 (CVSS score: 8.8), is a case of remote code execution arising from the deseria https://blog.itsdavidg.co/posts/2026-07-04-aws-security-audit-new-avalon-malware-framework-packs-crownx-ransomware-capab/ Sat, 04 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-04-aws-security-audit-new-avalon-malware-framework-packs-crownx-ransomware-capab/ Cybersecurity researchers have discovered a previously undocumented modular malware framework codenamed Avalon that's distributed by means of a multi-stage phishing chain capable of bypassing traditional security controls. Avalon combines credential collection, lateral movement, remote access, recovery disruption, and ransomware execution, bringing together https://blog.itsdavidg.co/posts/2026-07-03-aws-security-audit-ransomware-groups-turn-to-citrix-bleed-2-byovd-and-supply/ Fri, 03 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-03-aws-security-audit-ransomware-groups-turn-to-citrix-bleed-2-byovd-and-supply/ Threat actors associated with the Anubis ransomware operation have been observed exploiting the Citrix Bleed 2 (CVE-2025-5777) vulnerability to obtain initial access. "Although tactics differ between affiliates, common patterns emerged in tradecraft through use of legitimate Remote Management and Monitoring (RMM) tooling, credential access, and hands-on-keyb https://blog.itsdavidg.co/posts/2026-07-02-aws-security-audit-aws-artifact-now-includes-assurance-assistant-for-complian/ Thu, 02 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-02-aws-security-audit-aws-artifact-now-includes-assurance-assistant-for-complian/ AWS Artifact now includes Assurance Assistant, an AI-powered capability that generates citation-backed responses to security and compliance questions about AWS services. AWS Artifact is the service through which AWS provides compliance reports, certifications, and agreements to customers. Assurance Assistant helps third-party risk managers, compliance office https://blog.itsdavidg.co/posts/2026-07-01-aws-security-audit-langflow-rce-exploited-to-deploy-monero-miner-on-exposed-a/ Wed, 01 Jul 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-07-01-aws-security-audit-langflow-rce-exploited-to-deploy-monero-miner-on-exposed-a/ Threat actors are continuing to exploit a critical Langflow vulnerability as part of fresh attacks designed to deliver a Monero cryptocurrency miner. The activity has been found to weaponize CVE-2026-33017 (CVSS score: 9.3), an unauthenticated remote code execution (RCE) vulnerability in Langflow, indicating threat actors are scanning and targeting exposed a https://blog.itsdavidg.co/posts/2026-06-30-aws-security-audit-attackers-exploit-simplehelp-cve-2026-48558-to-deploy-task/ Tue, 30 Jun 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-06-30-aws-security-audit-attackers-exploit-simplehelp-cve-2026-48558-to-deploy-task/ An unknown threat actor has been observed exploiting a recently disclosed maximum-severity security flaw in SimpleHelp to deliver two previously unreported malware families, TaskWeaver and Djinn Stealer. The intrusion involves the exploitation of CVE-2026-48558 (CVSS score: 10.0), a critical authentication bypass vulnerability impacting the OpenID Connect (O https://blog.itsdavidg.co/posts/2026-06-29-aws-security-audit-gamaredon-expands-ukraine-attacks-with-new-malware-and-clo/ Mon, 29 Jun 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-06-29-aws-security-audit-gamaredon-expands-ukraine-attacks-with-new-malware-and-clo/ A Russian advanced persistent threat (APT) group has continued to evolve and expand its malware arsenal as part of its ongoing cyber onslaught against Ukraine throughout 2025. Slovakian cybersecurity company ESET said it observed 35 distinct spear-phishing campaigns mounted by Gamaredon against new targets, with most of them taking place in the second half o https://blog.itsdavidg.co/posts/2026-06-28-aws-security-audit-new-dirtyclone-linux-kernel-flaw-lets-local-users-gain-roo/ Sun, 28 Jun 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-06-28-aws-security-audit-new-dirtyclone-linux-kernel-flaw-lets-local-users-gain-roo/ DirtyClone is a new Linux kernel privilege escalation in the DirtyFrag family. JFrog Security Research published a working exploit walkthrough for the flaw on June 25, the first public demonstration for this variant. Tracked as CVE-2026-43503 (CVSS 8.8), it lets a local user corrupt file-backed memory through a cloned network packet and gain root. The patch https://blog.itsdavidg.co/posts/2026-06-27-aws-security-audit-cisa-adds-exploited-ptc-windchill-rce-flaw-to-kev-as-web-s/ Sat, 27 Jun 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-06-27-aws-security-audit-cisa-adds-exploited-ptc-windchill-rce-flaw-to-kev-as-web-s/ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical remote code execution vulnerability impacting PTC Windchill PDMlink and PTC FlexPLM enterprise Product Data Management (PDM) and Product Lifecycle Management (PLM) software to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. https://blog.itsdavidg.co/posts/2026-06-26-aws-security-audit-cisa-warns-critical-lantronix-eds5000-flaw-is-being-active/ Fri, 26 Jun 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-06-26-aws-security-audit-cisa-warns-critical-lantronix-eds5000-flaw-is-being-active/ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned of active exploitation of a critical security flaw impacting Lantronix EDS5000 Series devices, urging Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by June 26, 2026. The vulnerability in question is CVE-2025-67038 (CVSS score: 9.8), a code injection flaw https://blog.itsdavidg.co/posts/2026-06-25-aws-security-audit-cisco-catalyst-sd-wan-zero-day-cve-2026-20245-exploited-to/ Thu, 25 Jun 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-06-25-aws-security-audit-cisco-catalyst-sd-wan-zero-day-cve-2026-20245-exploited-to/ An unknown threat actor exploited a recently disclosed high-severity security flaw impacting Cisco Catalyst SD-WAN as a zero-day at least two months before it was publicly disclosed, according to new findings from Google-owned Mandiant. The vulnerability, tracked as CVE-2026-20245 (CVSS score: 7.8), allows an authenticated, local attacker to execute arbitrar https://blog.itsdavidg.co/posts/2026-06-24-aws-security-audit-cisco-unified-cm-flaw-exploited-after-poc-reveals-file-wri/ Wed, 24 Jun 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-06-24-aws-security-audit-cisco-unified-cm-flaw-exploited-after-poc-reveals-file-wri/ Threat actors have begun to exploit a recently disclosed critical security flaw impacting Cisco Unified Communications Manager (Unified CM) and Unified Communications Manager Session Management Edition (Unified CM SME). The vulnerability, tracked as CVE-2026-20230 (CVSS score: 8.6), is a case of improper input validation for specific HTTP requests that could https://blog.itsdavidg.co/posts/2026-06-23-aws-security-audit-shareholders-sue-uber-s-board-over-sexual-assaults-other-i/ Tue, 23 Jun 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-06-23-aws-security-audit-shareholders-sue-uber-s-board-over-sexual-assaults-other-i/ The lawsuit, led by a Detroit pension fund, alleges Uber's board and management has cut too many compliance corners, resulting in thousands of lawsuits. https://blog.itsdavidg.co/posts/2026-06-22-aws-security-audit-interpol-warns-phishing-ransomware-and-ai-scams-are-rising/ Mon, 22 Jun 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-06-22-aws-security-audit-interpol-warns-phishing-ransomware-and-ai-scams-are-rising/ A new report from INTERPOL has revealed a "dramatic increase" in cybercrime in Asia and the South Pacific, fueled by rapid digitalization, internet penetration, new technologies, organized criminal networks, and a disparity in cybersecurity maturity. According to INTERPOL's 2025/2026 Asia and South Pacific Cyberthreat Assessment Report, phishing has emerged https://blog.itsdavidg.co/posts/2026-06-21-aws-security-audit-f5-patches-two-critical-nginx-open-source-flaws-enabling-r/ Sun, 21 Jun 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-06-21-aws-security-audit-f5-patches-two-critical-nginx-open-source-flaws-enabling-r/ F5 has released security updates to address two critical security flaws in NGINX Open Source that could be exploited to achieve code execution on affected systems. The vulnerabilities are listed below - CVE-2026-42530 (CVSS v4 score: 9.2) - A use-after-free vulnerability in the ngx_http_v3_module that could be triggered by a remote unauthenticated attacker w https://blog.itsdavidg.co/posts/2026-06-20-aws-security-audit-hackers-exploit-gravity-smtp-wordpress-plugin-bug-to-expos/ Sat, 20 Jun 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-06-20-aws-security-audit-hackers-exploit-gravity-smtp-wordpress-plugin-bug-to-expos/ Threat actors are exploiting a recently patched security flaw impacting Gravity SMTP, a WordPress plugin that's installed on about 100,000 sites. The vulnerability, tracked as CVE-2026-4020 (CVSS score: 5.3), is a medium-severity information disclosure flaw that can allow unauthenticated attackers to extract sensitive data, such as configuration data, API ke https://blog.itsdavidg.co/posts/2026-06-19-aws-security-audit-amazon-eks-now-supports-customer-routed-control-plane-egre/ Fri, 19 Jun 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-06-19-aws-security-audit-amazon-eks-now-supports-customer-routed-control-plane-egre/ Today, Amazon Elastic Kubernetes Service (Amazon EKS) introduces customer-routed control plane egress, a capability that lets you route outbound Kubernetes API server traffic through your own Amazon VPC. This includes admission webhook callbacks, OpenID Connect (OIDC) provider lookups, and aggregate API server requests. With customer-routed control plane egr https://blog.itsdavidg.co/posts/2026-06-18-aws-security-audit-announcing-web-search-on-amazon-bedrock-agentcore-for-agen/ Thu, 18 Jun 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-06-18-aws-security-audit-announcing-web-search-on-amazon-bedrock-agentcore-for-agen/ As AI agents become more capable, they need access to information beyond a model's training data - to answer questions, retrieve latest facts, and take action grounded in current developments. Today, we're making that easy with the general availability of Web Search on AgentCore. Web Search is a fully managed tool that enables agents to ground responses in c https://blog.itsdavidg.co/posts/2026-06-17-aws-security-audit-the-top-10-attack-surface-exposures-in-2026/ Wed, 17 Jun 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-06-17-aws-security-audit-the-top-10-attack-surface-exposures-in-2026/ Breaches don't always start with a zero-day. An exposed admin panel can get brute-forced, or credentials reused from a previous attack. But when a vulnerability does drop — like MongoBleed earlier this year, which let attackers pull credentials and session tokens from server memory without authentication — anything internet-facing is immediately at risk. Wit https://blog.itsdavidg.co/posts/2026-06-16-aws-security-audit-attackers-exploit-three-fortinet-fortisandbox-flaws-one-pa/ Tue, 16 Jun 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-06-16-aws-security-audit-attackers-exploit-three-fortinet-fortisandbox-flaws-one-pa/ Bad actors are exploiting multiple security vulnerabilities in Fortinet FortiSandbox, according to threat intelligence firm Defused Cyber. In a post shared on X, the company said it has observed exploitation of CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089 over the past 24 hours. CVE-2026-39813 (CVSS score: 9.1) refers to a path traversal vulnerability https://blog.itsdavidg.co/posts/2026-06-15-aws-security-audit-palo-alto-warns-of-active-exploitation-of-pan-os-globalpro/ Mon, 15 Jun 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-06-15-aws-security-audit-palo-alto-warns-of-active-exploitation-of-pan-os-globalpro/ Palo Alto Networks has revealed that it has observed "active exploitation" of a recently disclosed PAN-OS vulnerability by an unknown threat actor to obtain unauthorized access to GlobalProtect portals. The vulnerability in question is CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw affecting the portal and gateway components of PAN-OS softwar https://blog.itsdavidg.co/posts/2026-06-14-aws-security-audit-critical-splunk-enterprise-flaw-lets-attackers-run-code-wi/ Sun, 14 Jun 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-06-14-aws-security-audit-critical-splunk-enterprise-flaw-lets-attackers-run-code-wi/ Splunk has released security updates to address a critical security flaw in Splunk Enterprise that could be exploited to conduct unauthenticated file operations and even remote code execution. The vulnerability, tracked as CVE-2026-20253, is rated 9.8 on the CVSS scoring system. "In Splunk Enterprise versions below 10.2.4 and 10.0.7, an unauthenticated user https://blog.itsdavidg.co/posts/2026-06-13-aws-security-audit-langflow-vulnerability-cve-2026-5027-exploited-for-unauthe/ Sat, 13 Jun 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-06-13-aws-security-audit-langflow-vulnerability-cve-2026-5027-exploited-for-unauthe/ A high-severity security flaw in Langflow, an open-source low-code platform to build artificial intelligence (AI) applications, has come under active exploitation in the wild, according to findings from VulnCheck. The vulnerability in question is CVE-2026-5027 (CVSS score: 8.8), a case of path traversal that could allow an attacker to write files to arbitrar https://blog.itsdavidg.co/posts/2026-06-12-aws-security-audit-shinyhunters-exploits-oracle-peoplesoft-zero-day-cve-2026/ Fri, 12 Jun 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-06-12-aws-security-audit-shinyhunters-exploits-oracle-peoplesoft-zero-day-cve-2026/ The ShinyHunters extortion crew exploited an unpatched flaw in Oracle PeopleSoft to break into enterprise systems, steal data, and demand payment to keep it private. The campaign hit universities hardest. Google's Mandiant attributes it to the group it tracks as UNC6240, and dates the activity between May 27 and June 9. Oracle did not publish its advisory un https://blog.itsdavidg.co/posts/2026-06-11-aws-security-audit-ivanti-fortinet-and-sap-release-patches-for-multiple-criti/ Thu, 11 Jun 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-06-11-aws-security-audit-ivanti-fortinet-and-sap-release-patches-for-multiple-criti/ Fortinet, Ivanti, and SAP have released security updates to address multiple critical security vulnerabilities that could result in arbitrary code execution and information disclosure. The security flaw patched by Fortinet relates to a command injection vulnerability in FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS WEB UI. It's tracked as CVE-2026- https://blog.itsdavidg.co/posts/2026-06-10-aws-security-audit-chrome-v8-zero-day-cve-2026-11645-exploited-in-the-wild-pa/ Wed, 10 Jun 2026 12:00:00 +0000 https://blog.itsdavidg.co/posts/2026-06-10-aws-security-audit-chrome-v8-zero-day-cve-2026-11645-exploited-in-the-wild-pa/ Google has released security updates to address 74 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-11645 (CVSS score: 8.8), has been described as an out-of-bounds memory access in V8, Chrome's JavaScript and WebAssembly engine. "Out-of-bounds read and write in V8 in Goog https://blog.itsdavidg.co/posts/2026-06-10-how-to-reduce-aws-bill-cost-optimization-guide/ Wed, 10 Jun 2026 09:00:00 +0000 https://blog.itsdavidg.co/posts/2026-06-10-how-to-reduce-aws-bill-cost-optimization-guide/ A practical guide to AWS cost optimization - the highest-leverage ways to reduce your AWS bill without breaking production, from killing waste to commitment-based discounts. https://blog.itsdavidg.co/posts/2026-06-10-fractional-cto-cost-pricing-guide/ Wed, 10 Jun 2026 08:30:00 +0000 https://blog.itsdavidg.co/posts/2026-06-10-fractional-cto-cost-pricing-guide/ A clear breakdown of fractional CTO cost and pricing models in 2026 - retainers, hourly, and pay-per-outcome - and how it compares to the fully loaded cost of a full-time CTO hire. https://blog.itsdavidg.co/posts/2026-06-10-aws-security-audit-checklist-30-point-guide/ Wed, 10 Jun 2026 08:00:00 +0000 https://blog.itsdavidg.co/posts/2026-06-10-aws-security-audit-checklist-30-point-guide/ A practical, 30-point AWS security audit checklist covering IAM, network exposure, data protection, logging, and incident readiness - the same list used on real client accounts before findings worth more than the audit itself.