Attacks against cloud identity and productivity platforms — Microsoft 365, Google Workspace, Azure, AWS — including OAuth consent phishing, device-code abuse, token theft, and the "identity-first" intrusion patterns that treat the tenant, not the endpoint, as the ground floor. Combined article + CVE feed for the Cloud beat.https://0daynews.com/en-ushttps://0daynews.com/articles/2026-08-17-fortune-500-azure-data-theft-campaign/https://0daynews.com/articles/2026-08-17-fortune-500-azure-data-theft-campaign/Threat actor claims mass exfiltration from McDonald's, TCS, Vodafone, and other Fortune 500 firms via Azure. Named companies have not confirmed. Story developing.Mon, 17 Aug 2026 07:30:00 GMTCloudarticlehttps://0daynews.com/articles/2026-08-14-beacon-crm-breach-charities-aws-key/https://0daynews.com/articles/2026-08-14-beacon-crm-breach-charities-aws-key/Over 1,000 UK charities had supporter data exposed after attackers used an AWS access key found in Beacon's public JavaScript build artifacts.Fri, 14 Aug 2026 10:00:00 GMTCloudarticlehttps://0daynews.com/articles/2026-07-30-azure-cosmos-db-cosmosescape-cross-tenant/https://0daynews.com/articles/2026-07-30-azure-cosmos-db-cosmosescape-cross-tenant/Wiz's CosmosEscape attack chain escaped Azure Cosmos DB's Gremlin sandbox, gained platform code execution, and extracted a key granting cross-tenant read/write access. Now patched.Thu, 30 Jul 2026 20:00:00 GMTCloudarticlehttps://0daynews.com/articles/2026-07-24-nodebb-eight-ai-found-flaws-admin-access/https://0daynews.com/articles/2026-07-24-nodebb-eight-ai-found-flaws-admin-access/Eight high-severity NodeBB flaws expose admin access and private chats in all pre-4.14.0 versions. Aikido Security's AI pentest found them in six hours. Patch to 4.14.2.Fri, 24 Jul 2026 11:30:00 GMTCloudarticlehttps://0daynews.com/articles/2026-07-24-kimi-k3-redis-zero-days-rce-patches/https://0daynews.com/articles/2026-07-24-kimi-k3-redis-zero-days-rce-patches/Kimi K3 AI agents found authenticated RCE flaws in four Redis versions. Redis shipped seven security releases on July 23 — update your deployments.Fri, 24 Jul 2026 10:00:00 GMTCloudarticlehttps://0daynews.com/articles/2026-07-23-fedramp-20x-rev5-transition-continuous-monitoring-loop/https://0daynews.com/articles/2026-07-23-fedramp-20x-rev5-transition-continuous-monitoring-loop/FedRAMP 20x moves federal cloud authorization from periodic 3PAO assessments to continuous, machine-readable control evidence — what that shift requires from cloud operators.Thu, 23 Jul 2026 15:00:00 GMTCloudarticlehttps://0daynews.com/articles/2026-07-18-nadmesh-go-botnet-shodan-comfyui-ollama-3811-aws-keys/https://0daynews.com/articles/2026-07-18-nadmesh-go-botnet-shodan-comfyui-ollama-3811-aws-keys/A Go botnet called NadMesh, active since early July, feeds a Shodan queue into ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio. Operator dashboard claims 3,811 AWS keys.Sat, 18 Jul 2026 16:15:00 GMTCloudarticlehttps://0daynews.com/articles/2026-07-15-rapid7-blazek-aws-persistence-iam-lambda-federated-hunt-runbook/https://0daynews.com/articles/2026-07-15-rapid7-blazek-aws-persistence-iam-lambda-federated-hunt-runbook/Rapid7's Jan Blažek maps four AWS persistence classes — new IAM users, assume-role edits, Lambda backdoors, federated tokens — with the CloudTrail signals to hunt for each.Wed, 15 Jul 2026 19:15:00 GMTCloudarticlehttps://0daynews.com/articles/2026-07-14-rabbitmq-miggo-oauth-secret-cross-tenant-cve-2026-57219/https://0daynews.com/articles/2026-07-14-rabbitmq-miggo-oauth-secret-cross-tenant-cve-2026-57219/Miggo disclosed two RabbitMQ flaws today: an obsolete /api/auth endpoint exposed the broker's OAuth client secret, and a bug bypassed vhost boundaries.Tue, 14 Jul 2026 16:20:00 GMTCloudarticlehttps://0daynews.com/articles/2026-07-13-cisa-github-leak-postmortem-nine-alerts-six-months/https://0daynews.com/articles/2026-07-13-cisa-github-leak-postmortem-nine-alerts-six-months/CISA's postmortem on its own six-month GitHub credential leak faults slow key rotation and nine ignored GitGuardian alerts — signal without intake.Mon, 13 Jul 2026 16:15:00 GMTCloudarticlehttps://0daynews.com/articles/2026-07-08-writeout-writer-ai-cross-tenant-session-sand-security/https://0daynews.com/articles/2026-07-08-writeout-writer-ai-cross-tenant-session-sand-security/SAND Security's WriteOut let a Writer AI agent preview link steal a signed-in user's session cookie across tenants. Writer has patched — the pattern hasn't.Wed, 08 Jul 2026 22:45:00 GMTCloudarticlehttps://0daynews.com/articles/2026-07-08-gitlost-github-agentic-workflows-noma-security-private-repos/https://0daynews.com/articles/2026-07-08-gitlost-github-agentic-workflows-noma-security-private-repos/Noma Security's GitLost shows how a public GitHub issue can trick Agentic Workflows into leaking private repos. Not patchable — scope your agent tokens today.Wed, 08 Jul 2026 11:15:00 GMTCloudarticlehttps://0daynews.com/articles/2026-07-08-dialogflow-cx-rogue-agent-shared-exec-varonis/https://0daynews.com/articles/2026-07-08-dialogflow-cx-rogue-agent-shared-exec-varonis/Varonis' Rogue Agent finding in Google Dialogflow CX is a shared-runtime exec() escape — a bug class old enough to have graduated shared hosting.Wed, 08 Jul 2026 08:15:00 GMTCloudarticlehttps://0daynews.com/articles/2026-07-04-toddycat-umbrij-oauth-gmail-kaspersky/https://0daynews.com/articles/2026-07-04-toddycat-umbrij-oauth-gmail-kaspersky/Kaspersky Securelist detailed Umbrij, a ToddyCat post-compromise tool that self-grants Google Workspace OAuth tokens by driving a logged-in Chromium session. Nothing to patch. Plenty to audit.Sat, 04 Jul 2026 07:20:00 GMTCloudarticlehttps://0daynews.com/articles/2026-07-04-artoken-eviltokens-m365-device-code-phishing-talos/https://0daynews.com/articles/2026-07-04-artoken-eviltokens-m365-device-code-phishing-talos/Cisco Talos exposed ARToken, a React-panel phishing-as-a-service tied to EvilTokens. Device code flow is the mechanic. Conditional Access is the fix, and most tenants still haven't turned it on.Sat, 04 Jul 2026 06:20:00 GMTCloudarticlehttps://0daynews.com/articles/2026-07-04-consentfix-clickfix-m365-oauth-consent-phishing/https://0daynews.com/articles/2026-07-04-consentfix-clickfix-m365-oauth-consent-phishing/BleepingComputer covered two M365 hijack patterns and Opera's Paste Protect defense this week. The clipboard lane can be closed. The OAuth grant substrate underneath is unchanged.Sat, 04 Jul 2026 04:15:00 GMTCloudarticlehttps://0daynews.com/articles/2026-07-03-argo-cd-repo-server-unauth-rce-unpatched/https://0daynews.com/articles/2026-07-03-argo-cd-repo-server-unauth-rce-unpatched/Synacktiv disclosed an unpatched code-execution flaw in Argo CD's repo-server component. No fix, no CVE. Reachability of the internal port is the whole game.Fri, 03 Jul 2026 18:15:00 GMTCloudarticle