Search: “code-to-cloud”

33 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll

SeverityAll critical 0 high 0 medium 0 low 0 info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Code to Cloud Platform Archives

Unit 42 archive page for Code to Cloud platform product-category articles; no new research or announcements.

This Unit 42 archive page lists product-category posts about Palo Alto Networks' Code to Cloud platform, which secures public cloud environments, SaaS applications and remote locations. It contains no new research, incidents, or announcements.

Palo Alto Unit 42Aug 19, 12:04 UTC · 28d agoIndustry

Top 10 Best CNAPP (Cloud-Native Application Protection) Platforms in 2026

GBHackers ranks 10 CNAPP platforms for 2026, naming Wiz, Prisma Cloud, and Microsoft Defender for Cloud as category leaders.

The guide describes CNAPP as the umbrella combining CSPM, CWPP, CIEM, and DSPM, arguing that cross-pillar correlation of attack paths is the platform's core value. Wiz is ranked best for graph-based correlation, Prisma Cloud for the broadest module set, and Microsoft Defender for Cloud for Azure economics. It also cites Google's approximately $32 billion agreement to acquire Wiz, announced in March 2025, as buyer leverage and a reason to seek roadmap and neutrality protections in multi-year contracts.

Cyber Security NewsSep 11, 07:21 UTC · 5d agoIndustry1

Cortex Cloud Archives

Palo Alto Networks publishes a product category page for Cortex Cloud, an AI and automation platform for cloud and SOC workflows.

This item is a product category archive page for Palo Alto Networks' Cortex Cloud, describing it as an AI and automation-driven platform spanning code to cloud to SOC. The page contains no new research, incident, or product release details beyond marketing language about prioritizing risks and accelerating remediation.

Palo Alto Unit 42Aug 20, 19:01 UTC · 26d agoIndustry

11 Best CSPM Tools Compared (2026): Features & Pricing

CSPM comparison ranks Wiz first for agentless attack-path analysis; notes Ermetic absorbed into Tenable and Lacework into Fortinet FortiCNAPP.

An editorial comparison of eleven CSPM tools ranks Wiz as the agentless attack-path momentum leader, Prisma Cloud as the breadth benchmark, and Orca as the agentless SideScanning pioneer. It highlights consolidation: Ermetic now powers Tenable Cloud Security and Lacework became Fortinet's FortiCNAPP. The guide recommends starting with free tiers from Defender for Cloud, Prowler, and native cloud tools before buying.

GBHackersSep 15, 06:37 UTC · 1d agoIndustry1

Cloud Security Assessment

Palo Alto Unit 42Aug 9, 16:06 UTC · Aug 9, 2026Industry

SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code

SAP patched a CVSS 10.0 unauthenticated RCE flaw (CVE-2026-58231) in Commerce Cloud's Data Hub Adapter, plus three critical flaws in NetWeaver and Manufacturing.

SAP's August 2026 updates fix CVE-2026-58231, a CVSS 10.0 flaw in Commerce Cloud's Data Hub Adapter where insufficient authorization checks and input validation let unauthenticated attackers execute arbitrary code. Onapsis urged customers to patch and redeploy, with an IP Filter Set on the vulnerable endpoint offered as a temporary workaround. The update also fixed CVE-2026-44772 (CVSS 9.9) and CVE-2026-44758 (CVSS 9.1), code injection flaws in Manufacturing Integration and Intelligence involving SSRF and SSTI, and CVE-2026-34265 (CVSS 9.8), an out-of-bounds write in NetWeaver ABAP's DIAG protocol parsing that can leak information or crash systems.

The Hacker NewsAug 12, 07:31 UTC · Aug 12, 2026Vulnerability CVE-2026-58231 CVE-2026-44772 CVE-2026-34265+1 CVEs

Threat Matrix: Mapping threats across cloud web applications

Microsoft released a Cloud Web Applications Threat Matrix, a MITRE ATT&CK-aligned framework mapping threats to cloud-hosted web apps and serverless platforms.

Microsoft introduced the cloud web applications threat matrix, which organizes attack techniques for cloud-hosted web apps and serverless platforms using MITRE ATT&CK tactics, from resource development through impact. The framework covers attack paths spanning application code, managed runtimes, workload identities, and deployment pipelines, cataloging techniques such as subdomain takeover, code injection in connected repositories, compromised registry images, exposed admin interfaces, and serverless trigger injection. It builds on Microsoft's earlier Kubernetes and storage services matrices to help defenders identify visibility gaps, prioritize hardening, and plan investigations in cloud-native environments.

Microsoft Security BlogSep 9, 21:30 UTC · 6d agoTools

Google’s open-source HEIR lets AI work with data it can’t see

Google open-sourced HEIR, a compiler toolchain that converts pre-trained AI models to operate on homomorphically encrypted data without exposing it.

Google's HEIR (Homomorphic Encryption Intermediate Representation) is an open-source compiler toolchain and development platform for fully homomorphic encryption, announced in 2023 and now supporting four peer-reviewed publications. It compiles Python programs handling sensitive data into implementations that process encrypted inputs, supporting multiple FHE schemes, libraries, front-end languages, and hardware accelerators such as GPUs, TPUs, FPGAs, and custom ASICs. Demonstrated applications include private recommendations, credit card fraud detection, network intrusion detection, and hotword recognition.

Help Net SecurityAug 18, 00:00 UTC · 29d agoTools

PacketFence Cloud: Enterprise Network Access Control, Now a Managed Service

Akamai announces PacketFence Cloud, delivering PacketFence enterprise network access control as a managed service.

Akamai published a blog post introducing PacketFence Cloud, an offering that delivers enterprise network access control (NAC) as a managed service. No further article text was available, so additional technical details are limited.

Akamai BlogAug 20, 12:00 UTC · 27d agoTools

Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models

Cloudflare launches invitation-only Vulnerability Discovery and Remediation within Managed Defense, using OpenAI Daybreak models and WAF context to prioritize and patch vulnerabilities.

Cloudflare announced early access to Vulnerability Discovery and Remediation, an invitation-only service within Cloudflare Managed Defense. The service uses OpenAI Daybreak models, including GPT-5.6 Cyber, via the Daybreak Defense Network to hunt and validate vulnerabilities in customer-authorized codebases across Workers and proxied applications. Findings are prioritized using production traffic, WAF rule, and security event context, and proposed patches and WAF mitigations are automatically checked before customer review.

Cloudflare BlogSep 3, 21:03 UTC · 12d agoTools

Secure all your internal vibe-coded applications — in one click

Cloudflare launched Access for Workers, letting admins attach one zero-trust policy to a Worker across all routes, domains, and previews automatically.

Cloudflare announced Access for Workers, a feature that binds an Access (zero-trust) policy directly to a Worker rather than to individual routes. The policy then applies automatically everywhere the Worker runs, including custom domains, workers.dev subdomains, routes, and preview URLs. Cloudflare positions it as one-click protection for internal, quickly built (vibe-coded) applications.

Cloudflare BlogAug 14, 13:00 UTC · Aug 14, 2026Tools1

Putting models to the secure coding test: Plan vs default mode

Datadog Security Labs tested Sonnet 5, Composer 2.5, and GPT 5.5 to see if plan mode yields more secure code than default mode.

Datadog Security Labs evaluated whether plan mode produces measurably more secure code than default mode. The test covered three frontier coding models: Sonnet 5, Composer 2.5, and GPT 5.5. The results inform how engineering teams should configure AI coding assistants to reduce insecure code. This is an AI security evaluation, not an incident report.

Datadog Security LabsAug 19, 00:00 UTC · 28d agoAI safety & security

Google Cloud Targets 2027 for First Major Post-Quantum Security Milestone

Google Cloud set 2027 for its first major post-quantum cryptography milestone to counter store-now-decrypt-later risks, migrating through 2028.

Google Cloud announced a post-quantum cryptography roadmap targeting its first major security milestone in 2027. The plan aims to mitigate store-now-decrypt-later harvest risks, with wider migration goals extending through 2028. The roadmap affects cryptographic protections for Google Cloud services and customer migration planning timelines.

Infosecurity MagazineAug 13, 15:00 UTC · Aug 13, 2026Industry

Version Control DFIR: a Cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps

Wiz published a DFIR cheatsheet covering log visibility, incident readiness, and threat hunting across GitHub, GitLab, Bitbucket, and Azure DevOps.

Wiz researchers released a practitioner's guide to version control system forensics, incident response, and threat hunting. The cheatsheet maps log sources, audit capabilities, and hunting workflows across GitHub, GitLab, Bitbucket, and Azure DevOps. It aims to improve incident readiness for source code and CI/CD compromise scenarios.

Wiz BlogAug 27, 12:00 UTC · 20d agoResearch1

TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse

Microsoft details TerminalFix, a ClickFix variant using fake Cloudflare CAPTCHAs to make users run PowerShell payloads with reverse-tunnel implants.

Microsoft disclosed TerminalFix campaigns that direct users to run commands in Windows Terminal or PowerShell instead of the Run dialog, increasing the chance multi-line scripts execute. Compromised websites serve fake Cloudflare CAPTCHA verifications; the resulting PowerShell command downloads a ZIP with legitimate LockScreenContentServer.exe and rogue dui70.dll for DLL sideloading, retrieves payloads hidden in PNG images from attacker domains, persists via Registry Run keys and scheduled tasks, and performs domain trust and Active Directory reconnaissance. A Python-based reverse-tunnel implant (client.py) tunnels arbitrary TCP traffic over an encrypted WebSocket to gitnow[.]dev:443, giving attackers network-level proxy access that could enable privilege escalation, security-tool tampering, data theft or ransomware. Microsoft recommends AppLocker restrictions, PowerShell script block logging and ClickFix awareness training.

The Hacker NewsAug 30, 07:36 UTC · 17d agoPhishing & fraud in the wild

Identifying a BOLA Vulnerability in Harbor, a Cloud

Unit 42 found a BOLA flaw, CVE-2024-22278 (CVSS 6.4), letting Maintainers improperly alter Harbor project metadata; fixed in versions 2.9.5, 2.10.3, and 2.11.0.

Unit 42 researchers identified a broken object-level authorization flaw, CVE-2024-22278, in Harbor, a CNCF-graduated cloud-native container registry with 1.8 million downloads. The flaw (CVSS 6.4) lets users with the Maintainer role create, update, and delete project metadata, actions reserved for ProjectAdmin, risking data exposure, integrity compromise, and circumvention of vulnerability scanning. Harbor patched the issue in versions 2.9.5, 2.10.3, and 2.11.0. The finding came from Unit 42's automated BOLA detection tool built on generative AI.

Palo Alto Unit 42Aug 17, 12:35 UTC · 29d agoVulnerability CVE-2024-22278

Towards Scalable and Cost-Efficient Vulnerability Detection: A Study on Automatic Query Generation

A study finds LLM-synthesized CodeQL queries improve average F1-score by 82% over baseline queries, offering scalable vulnerability detection versus direct LLM scanning.

Researchers conducted an empirical study evaluating whether LLMs can synthesize executable CodeQL queries from National Vulnerability Database vulnerability data. LLM-generated queries significantly enhanced baseline CodeQL suites, yielding an 82% improvement in average F1-score across a diverse set of real-world vulnerabilities. A cost-benefit analysis shows direct LLM-based scanning of entire repositories is often computationally and financially prohibitive, while LLM query synthesis offers a scalable and cost-effective alternative for large-scale vulnerability detection.

arXiv cs.CRSep 9, 16:31 UTC · 6d agoResearch1

[webapps] Langflow 1.8.4 - Path Traversal to Remote Code Execution

A path traversal to remote code execution exploit for Langflow 1.8.4, a popular LLM application builder, was published on Exploit-DB.

Exploit-DB lists a proof-of-concept exploit chaining path traversal to remote code execution in Langflow 1.8.4, an open-source tool used to build LLM applications and agents. The chain allows an attacker to write arbitrary files outside the intended directory and achieve code execution on the host. The provided text does not include a CVE identifier or reports of exploitation in the wild, but RCE in a widely deployed AI tooling product is notable for defenders.

Exploit-DBAug 31, 00:00 UTC · 16d agoExploit / PoC1

Give every teammate and agent the right level of access to your Workers

Cloudflare launches per-Worker granular access controls with four roles, enabling least-privilege access for teammates, AI agents, and CI/CD pipelines.

Cloudflare announced granular authorization for Workers, letting admins scope access to a single Worker instead of the whole account. Four new roles are available: Metadata Read-Only (observability without source code), Content Read-Only (read code without changes), Editor (deploy without delete), and Admin (full control of one Worker). Roles apply at Developer Platform, product, or resource level, can be attached to dashboard users or API tokens, and are available to all customers now, with plans to extend to D1, R2, and KV.

Cloudflare BlogSep 15, 13:00 UTC · 23h agoTools

Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)

Cloudflare's Automatic Key Exchange probes origins to lead with preferred key exchange, cutting HelloRetryRequests from 52% to 3.7% and enabling automatic post-quantum origin connections.

Cloudflare announced Automatic Key Exchange, an extension of Automatic SSL/TLS that probes each origin's supported key agreement algorithms and leads with the preferred one, favoring the post-quantum hybrid X25519MLKEM768. Rollover across roughly 45 billion daily origin connections cut HelloRetryRequests from about 52% to 3.7%, saving more than 150 ms of p90 handshake latency. Hundreds of thousands of domains now receive post-quantum origin connections without manual configuration, supporting Cloudflare's goal of quantum-safe encryption by 2029 to counter harvest-now-decrypt-later attacks.

Cloudflare BlogSep 8, 13:10 UTC · 7d agoResearch

GitHub Introduces Project HydraFusion: Runtime Multi-Model Orchestration That Builds a Workflow Per Coding Task in Copilot CLI

GitHub's Project HydraFusion research preview builds per-task multi-model workflows (Single, Cascade, Critique) in Copilot CLI, reporting +4.9 quality at 67% lower cost on TerminalBench 2.1.

Project HydraFusion is a research preview available on all GitHub Copilot plans inside Copilot CLI that treats model routing as workflow selection, choosing among Single, Cascade (draft plus quality gate), and Critique (cross-family reviewer) execution patterns per request. Against Claude Opus 5 baselines at medium reasoning, fixed HydraFusion policies cut estimated cost 67% while adding 4.9 quality points on TerminalBench 2.1, and cut cost 36% and 65% with slight quality dips on DeepSWE and CheckpointBench. Billing is per token at each underlying model's standard rate; there are no open weights or self-hosting options.

MarkTechPostSep 5, 19:40 UTC · 10d agoAI tools & infra1

Certificate Transparency Monitoring is now generally available

Cloudflare's Certificate Transparency Monitoring is now generally available, and it no longer alerts on certificates Cloudflare issued for your own domains.

Cloudflare announced general availability of its Certificate Transparency Monitoring service. The key behavioral change is that alerts are no longer generated for certificates that Cloudflare itself issued for a customer's domains, so any alert received now indicates a certificate issued by another certificate authority. Defenders can use the service to detect mis-issued or unauthorized TLS certificates for their domains.

Cloudflare BlogAug 13, 13:00 UTC · Aug 13, 2026Tools

Serving the most critical missions: Cloudflare for Government achieves FedRAMP Class D (High) Certified status

Cloudflare for Government earns FedRAMP Class D (High) certification and commits to pursuing DoD IL4 authorization.

Cloudflare announced that Cloudflare for Government has achieved FedRAMP Class D (High) Certified status. The company also committed to pursuing DoD IL4 authorization. The offering brings Cloudflare security, performance, and developer products to public sector missions.

Cloudflare BlogAug 10, 13:00 UTC · Aug 10, 2026Industry

Nigeria Looks to Sovereign Cloud for Cyber, National Security

Nigeria launches financing, procurement, and infrastructure policies to build a sovereign cloud for cyber and national security.

Nigeria has introduced financing, procurement, and infrastructure policies to accelerate its sovereign cloud initiative. The program aims to keep government data under national control and expand domestic technical expertise. It is framed as part of a broader effort to strengthen cyber and national security capabilities in West Africa's largest economy.

Dark ReadingAug 26, 08:00 UTC · 21d agoPolicy & legal

SAP Commerce Cloud CVE-2026

Attackers actively exploit unauthenticated RCE CVE-2026-58231 (CVSS 10.0) in SAP Commerce Cloud days after patch release.

CVE-2026-58231, a maximum-severity flaw in SAP Commerce Cloud (CVSS 10.0), allows unauthenticated attackers to abuse a default authentication client and bypass insufficient validation, achieving arbitrary code execution and compromise of internal components. Defused Cyber researchers observed exploitation attempts against honeypots only three days after SAP released the patch. The flaw had no public PoC and was not previously known to be exploited. The attackers are unknown, though past critical SAP flaws have been exploited by China-linked groups UNC5221 and UNC5174 and ransomware gangs.

Security AffairsAug 15, 17:14 UTC · Aug 15, 2026Exploit / PoC in the wildCVE-2026-58231

Coop – Isolated VM Environments for Running Claude Code and Codex

Trail of Bits releases Coop, running Claude Code and OpenAI Codex agents inside isolated virtual machines for safer agentic coding.

Coop, published on GitHub by security firm Trail of Bits, provides isolated VM environments for executing AI coding agents such as Claude Code and Codex. Isolation contains the filesystem and network side effects of autonomous agent actions, reducing risk from unsupervised tool use. The project drew 61 points and 16 comments on Hacker News.

Hacker News · AISep 7, 04:18 UTC · 9d agoAI tools & infra HN 61↑ · 16 comments1

Introducing automatic remediation policies with Cloudflare CASB

Cloudflare CASB now offers automatic remediation policies that revoke risky SaaS file shares or trigger webhooks within five minutes of detection.

Cloudflare introduced automatic remediation policies for its CASB product, letting security teams define event-driven logic that revokes risky file shares, dispatches custom webhooks, or forwards findings to SOAR platforms without manual intervention. Native remediation actions currently support Microsoft and Google Workspace file and folder findings, with a target of completing remediation within five minutes of detection. The engine is built on the Cloudflare developer platform, using Cloudflare Queues, Workers and Workflows for durable execution with automatic retries and rate-limit backoff.

Cloudflare BlogSep 11, 13:00 UTC · 4d agoTools

Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise

Wiz found LiteLLM auth bypass (CVE-2026-59822) and post-auth RCE (CVE-2026-59821) chainable to cloud compromise; the bypass is in CISA KEV with in-the-wild exploitation.

Wiz scanned roughly 3,074 internet-facing LiteLLM deployments and found 9.6% accepted the default master key sk-1234 or required no authentication, making post-auth attacks effectively pre-auth. The MCP endpoint accepts any Bearer token and grants a valid session (CVE-2026-59822), confirmed exploited in the wild via honeypots and added to CISA's Known Exploited Vulnerabilities catalog. Custom code guardrails allow post-auth root-level RCE via exec(compile(...)) (CVE-2026-59821), while pass-through endpoints lack URL validation, enabling cloud credential theft in post-auth scenarios. All assigned vulnerabilities have been patched; the research was presented at DEF CON 34.

Wiz Blogupdated Sep 10, 12:56 UTC · 5d agofirst Sep 9, 16:06 UTC · 6d agoExploit / PoC in the wild 4 sources CVE-2026-59822 CVE-2026-598211

Say it once: Introducing Bot Preference Sync

Cloudflare launched Bot Preference Sync, which automatically syncs robots.txt files with AI bot policies covering search, agent, and training crawlers.

Cloudflare's new Bot Preference Sync feature automatically aligns a site's robots.txt with its configured AI bot policies for Search, Agent, and Training bot categories. The goal is to let site owners manage which automated and AI crawlers access their content without manually maintaining static robots.txt files.

Cloudflare BlogAug 21, 23:19 UTC · 25d agoTools

τ^τ-Bench: An Environment for End-To-End, Realistic Agent Construction

New τ^τ-bench tasks coding agents with building deployable customer-service agents; best config, Claude Opus 5, passes only 23.9% of simulations.

Researchers introduce τ^τ-bench, an end-to-end benchmark where a developer agent must build a complete customer-service agent from real business records, a client with requirements, a production API, an inherited codebase, and cost/model limits, then is scored by deploying it against held-out simulated users. Across 53 tasks in four domains, the strongest configuration, Claude Opus 5 under Claude Code, passes just 23.9% of evaluation simulations versus an 82.2% expert-authored reference ceiling. Failure modes mirror those of human developers: shallow queries instead of deep record comprehension, almost no client communication, and shipping the first architecture that runs rather than experimenting.

Hugging Face daily papersSep 3, 20:00 UTC · 12d agoAI research

1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it

Cloudflare's 1.1.1.1 resolver now validates post-quantum DNSSEC signatures using ML-DSA-44, a 2,420-byte NIST algorithm, preparing DNS for post-quantum migration by 2029.

Cloudflare enabled 1.1.1.1 to validate DNSSEC signatures using ML-DSA-44 (algorithm 18), a NIST-standardized post-quantum signature with 1,312-byte public keys and 2,420-byte signatures, roughly 38x larger than ECDSA P-256. The large signatures exceed common DNS-over-UDP limits, forcing fallback to TCP and creating downgrade risks while conventional algorithms must be published alongside. Cloudflare cites the risk of a quantum computer breaking RSA/ECDSA signatures by 2030 and plans full post-quantum security by 2029.

Cloudflare BlogSep 10, 13:00 UTC · 5d agoTools1