Attackers used Qubole AWS credentials to raid customer clouds
From October 14 to 26 the actor assumed trusted roles, harvested secrets and downloaded S3 data from dozens of victims.
Stories per day · 30 days
2 RSS
Relatedaws4iam4qubole4credential-theft3cloud2agents1benchmark1cloud-breach1cloud-identity1cryptography1key-encapsulation1ml-kem1object-storage1post-quantum1rivet1supply-chain1yc-w231
6 stories, newest first · one card per story
Stories tagged #s3
Rivet Launches Agent Scaling and Orchestration on S3
YC W23 startup Rivet enables scaling and orchestrating AI agents using S3 storage.
Benchmarking Post-Quantum Key Encapsulation in S3-Compatible Object Storage under Client Concurrency
ML-KEM object encryption cuts S3-store throughput by about 4-5% only when client CPUs are saturated.
CVE-2026-97395: Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials
Apache Polaris before 1.8.0 lets authorized Iceberg table writers set FileIO endpoints in metadata, redirecting server-side requests to attacker-controlled servers.
CVE-2026-81862: Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs
Apache Airflow Teradata provider before 3.7.0 embeds cloud storage credentials in SQL and logs (CVE-2026-81862).
The VMs Powering Mobile Agents (Instinct, Claude Code)
A teardown reveals Claude Code runs in Firecracker microVMs with a Rust PID 1 and MITM'd egress, while Instinct rents E2B sandboxes with git-based memory.
10