cloud
6 articles with this tag
What is shadow AI? The risks of AI use your company can't see, and what organizations and individuals should do
Shadow AI is employees using AI tools the company hasn't approved or doesn't manage (chatbots, AI browser extensions, coding assistants, meeting-note AI, AI agents connected to work accounts) for work. It's the AI form of shadow IT. The main risks: confidential or personal data entered may be stored by the provider and, depending on plan and settings, used for training (consumer and business terms differ); OAuth grants and API keys hand third-party tools access to mail and drives; output errors and licensing problems; and privacy-law and audit obligations. A ban alone pushes usage out of sight, so provide an approved tool on business terms that don't train on inputs, a short rule on what data may be entered, SSO and admin controls, regular review of OAuth grants and extensions, and an ask-first channel.
Aesto Health Data Breach (9.5 Million): Why a Company You Never Heard of Sent the Notice, and What to Do
US healthcare data migration and archiving vendor Aesto, LLC (Aesto Health) says that from on or about December 2 to December 18, 2025, protected health information belonging to patients of its healthcare provider clients, stored in part of its cloud environment, may have been accessed and/or acquired by an unauthorized actor. The HHS Office for Civil Rights breach portal lists 9,540,683 people affected. The information includes names, dates of birth, medical information, driver's license numbers, financial account numbers, health insurance information, and government ID numbers such as ITINs; Social Security numbers were potentially involved for a limited number of people. You don't recognize the sender because your provider handed old records to an archiving vendor. First confirm whether your provider is on the list. Then protect SSNs and ITINs with a credit freeze and an IRS IP PIN, and medical information by reading your benefit statements. Providers need an inventory of every vendor holding patient data and an end date for archived records.
Vercel Security Incident (April 2026): What Developers Should Do About Exposed Environment Variables
On April 19, 2026, Vercel disclosed unauthorized access to certain internal systems. According to Vercel, a compromised third-party AI tool used by an employee let the attacker take over that employee's Google Workspace account, reach their Vercel account and a Vercel environment, and enumerate and decrypt environment variables of a limited subset of customers that were not marked sensitive. Vercel contacted affected customers directly and confirmed its published npm packages were not compromised. This site's take: whether a variable leaked depended on its label, readable (its value can be displayed again after saving) or write-only (it can be overwritten but never displayed). Store every secret you never need to read back as write-only (a Secret in today's Vercel), and inventory the AI tools employees connect to company accounts through OAuth (which lets outside apps access company accounts) the same way you inventory dependencies.
Subdomain takeover (dangling DNS): how a leftover DNS record lets attackers use your domain
Delete a cloud resource without deleting the DNS record and you have a dangling entry: anyone can claim that subdomain by provisioning a resource with the same FQDN. Your servers stay untouched while a legitimate subdomain serves an attacker's content. The damage is not cosmetic — apps commonly expose session cookies to wildcard subdomains, so the hijacked one can read them. And the documentation explicitly rejects the belief that a certificate protects you. The fix is to build the deletion order into your procedures and tooling instead of relying on memory.
What is SSRF (Server-Side Request Forgery)
SSRF abuses external-input URLs to make a server access internal resources (internal IPs, cloud metadata). If you fetch URLs, you need an allowlist of destinations, internal-target blocking, and protection against redirect/DNS-rebinding bypasses. It was the cause of the Capital One breach.
Capital One breach (2019) — how SSRF leaked 100M+ records, and how to defend
A single SSRF reached the metadata endpoint → over-privileged IAM temporary credentials → bulk S3 copy, leaking ~106M records. Every step could have stopped it. In your environment: IMDSv2, IAM least privilege, and an allowlist for outbound fetches.