30
55
30
30
30
30
Your Cloud Security Checklist Doesn't Work the Way You Think It Does
Intruder's 2026 Cloud Security Index found misconfiguration risk profiles differ sharply across AWS, Azure, and Google Cloud across 3,000 organizations.
Intruder analyzed misconfiguration data from 3,000 organizations across AWS, Azure, and Google Cloud for its 2026 Cloud Security Index. Weak IAM controls and missing logging affected 80-98% of accounts regardless of provider, while exposed services ranged from 76% on AWS to just 8% on Google Cloud. Top issues included S3 buckets without HTTPS enforcement (87% of AWS accounts), Entra ID users without MFA (55% of Azure accounts), and missing OS Login MFA (77% of Google Cloud accounts). Weak IAM prevalence rose with organization size, from 87% at SMEs to 98% at large enterprises, and midmarket organizations took the longest to remediate at 35 days on average.
28
30
30
55
30
42
30
30
30
30
30
30
55
42
30
New DDRop Attack Breaks Intel TDX and AMD SEV-SNP With $159 DDR5 Device
DDRop uses a $159 DDR5 RDIMM interposer to silently drop memory writes and break Intel TDX and AMD SEV-SNP confidential VMs.
Researchers published DDRop, a physical attack built from about $159 in parts that uses a custom DDR5 RDIMM interposer to inject parity errors and silently discard selected cache-line writebacks. Intel TDX, Intel Scalable SGX, and AMD SEV-SNP are affected because they lack per-line cryptographic freshness, so processors can accept stale encrypted data as valid state. The team demonstrated deterministic plaintext copying between pages, malicious Secure EPT entry injection, forcing trust domains into debug mode, and forging attestation measurements. The attack requires privileged host control plus brief physical access, and researchers say no simple software patch exists.
65
30
Phishing Research Challenges Conventional Security Awareness Testing
Pistachio's 2.47 million phishing simulations across 1,200 organizations show click rates alone mislead, with 30% of IT staff clicking and leak rates more predictive.
Between June 2025 and May 2026, Pistachio sent 2.47 million simulated phishing attempts to more than 123,000 employees at over 1,200 organizations, analyzing click, credential-leak and reporting behavior. Click rates ranged from 26% in Design to 41% in Construction; 30% of tech development and IT staff clicked at least once, while financial services were the most resilient sector. The report argues that click rate alone creates a false sense of security and that combined click, leak and report trends are better resilience indicators.
45
Weak IAM affects up to 98% of cloud environments
Intruder's 2026 Cloud Security Index finds weak IAM controls affect up to 98% of cloud environments across AWS, Azure, and Google Cloud.
Intruder's 2026 Cloud Security Index report analyzed cloud misconfigurations across midmarket and enterprise environments, finding weak IAM controls and missing logging affected 80% to 98% of accounts across all three major providers. AWS recorded the highest prevalence in five of six categories, including exposed services at 76% versus 8% on Google Cloud. IAM weaknesses worsen with scale, affecting 87% of SMEs, 95% of midmarket organizations, and 98% of large enterprises, while remediation times peak at 35 days for organizations with 1,000 to 5,000 employees.
28
30
55
DDRop Attack Forces Intel TDX Confidential VMs Into Debug Mode and Exposes Memory
KU Leuven and ETH Zurich researchers released DDRop PoC hardware that forces Intel TDX confidential VMs into debug mode and exposes plaintext memory.
Researchers from KU Leuven, ETH Zurich, Google, and Durham University published proof-of-concept code, hardware designs, and firmware for DDRop, a DDR5 interposer that injects parity errors to drop selected cache-line writebacks. Because Intel TDX, Intel Scalable SGX, and AMD SEV-SNP lack per-line cryptographic freshness, processors decrypt and accept stale DRAM contents as current state. The PoC flips a victim's ATTRIBUTES.DEBUG flag to enable TDX debug mode, then copies victim memory in plaintext and can forge attestation reports. Affected environments include Intel 5th- and 6th-generation Xeon Scalable with TDX; Intel says the attack falls outside its cloud-computing threat model.
65
42
30
42
42
30
30
Google’s New Search Redirects Make It Harder to Check Where Links Lead Before Clicking
Malwarebytes reports Google's new encoded google.com/goto?url= redirects break hover-preview link checking, weakening a common phishing defense.
Google now routes some search results through opaque google.com/goto?url= redirects using custom encoding, so browser link previews no longer reveal the true destination, only the claimed label above the result. Malwarebytes found the final destination is visible only in the redirect response's Location header, complicating hover-based safety checks as well as scraping, archiving, and audit tools. The change arrives amid malvertising, search-result poisoning, and fake installer campaigns like the recent Node.js infostealer lure. Google says it deploys measures against evolving abuse but did not explain the change.
30
Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall
Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.
US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.
48
55
55
30
55