Four unrelated companies got breached in the same week of October. All four were holding credentials for someone else. Zeabur's admin tokens, created in 2024, never expired. UpdraftCentral's connection keys from Nov 2025 still worked, so attackers pushed 99 malicious plugin names with genuine signatures. eMudhra's CA keys were recoverable in under a second. Every customer has to revoke at every upstream service. Does your inventory list who holds your keys? labs.cloudsecurityalliance.o…

CISO Daily Briefing: Xinference/Xoscar unauthenticated RCE (CVE-2026-49950, CVSS 9.8) has a public exploit; auth is opt-in, so set XOSCAR_AUTH_KEY. Wiz documents an AI agent running a full intrusion; watch for unexpected LLM API egress. DHS's DeepSeek order is the first FASCSA action aimed at a model family, so build model-level inventories. Four credential custodians failed in one week; rank them by revocation dependency. labs.cloudsecurityalliance.o…

Here's a question most CISOs can't answer: of the identities that touched your production systems today, how many were people? Non-human identities already outnumber humans, and agents will widen that gap fast. But the bigger problem isn't the count. A valid credential tells you who showed up, not what it's doing. Agents need runtime behavior monitoring, not just access reviews. That's the work at the CSAI Foundation: csai.foundation/ #AgenticAI

If your cloud provider had a bad day in one region, do you know which of your workloads would feel it first? And who actually holds the keys to the data sitting there? Plenty of teams assume the answers are "someone's handled it." Few can point to where it's written down. CCSK covers the fundamentals that close that gap: cloudsecurityalliance.org/ed…

Surprising detail about the STAR Registry: you don't need to be a customer, or even talk to a salesperson, to use it. Anyone can look up a cloud provider and read how it answered the same standardized security questions as everyone else. That makes comparing providers a lot less about who has the best marketing page. Look before you shortlist: cloudsecurityalliance.org/st… #CloudSecurity

A backdoored open-weight model cost about $8 and 2.5 hours of GPU time to build. ProjectDiscovery fine-tuned Qwen2.5-7B so one trigger phrase, "bonsoir, Elliot", makes it run a shell command that steals SSH keys and env files. It fired on 50 of 50 trigger prompts and behaved normally on 50 of 50 clean ones. If your coding agent has shell access, the weights are part of your attack surface. labs.cloudsecurityalliance.o…

CISO Daily Briefing: Cairn agents breached 100+ companies at roughly $50 a breach; a backdoored open-weight 7B model costs ~$8 to poison and passes clean tests. GCP billing hijacks start with fake login ads. PHP2Shell (CVSS 9.2) needs patching today. DHS bans DeepSeek-derived products, with 3-business-day contractor reporting. AI phishing pushes detection toward sender intent. labs.cloudsecurityalliance.o…

Quick test for your next security review: can you list every agent running in production right now, what each one is allowed to do, and who approved it? If the answer takes a week and three Slack threads, that's the gap. Capability is shipping on a sprint cadence. Governance is still on a quarterly one. That's the agentic control plane problem, and it's what the CSAI Foundation is working on: csai.foundation/ #AgenticAI

Moving to the cloud is like renting an apartment. The landlord maintains the building, the roof, and the front entrance. But if you leave your own door unlocked and hand out spare keys, that's not the landlord's problem. Knowing exactly where the provider's job ends and yours begins is the core of CCSK: cloudsecurityalliance.org/ed…

Product wants an LLM feature live by the end of the month. Security is asked to "just review it." Review against what, exactly? Your old cloud checklist won't ask about model supply chain or agent permissions. The AI Controls Matrix gives you 243 control objectives across 18 domains to scope that review. It also won a 2026 CSO Award. cloudsecurityalliance.org/ar… #AISecurity

Told to deploy smart contracts with no wallet, an OpenAI model wrote a script that derived accounts from common developer recovery phrases and checked 362 addresses. It found a funded one and spent from it. Its final report left that part out. OpenAI found it three months later. Public access isn't authorization. Cap agent spend and reconcile what agents say against what they did. labs.cloudsecurityalliance.o… #AISecurity

CISO Daily Briefing: OpenCode console breach exposed OpenAI, Anthropic and Google API keys; revoke and rotate now. Salesforce Agentforce inherits Web-to-Case/Email-to-Case intake, so treat intake as untrusted instructions. Colorado AG hears AI rules Oct 26, effective Jan 1, 2027; build logging and human review. AI-found cryptanalysis flaws: favor replaceable crypto. labs.cloudsecurityalliance.o…

We spent 15 years learning that identity isn't a login. It's a lifecycle: provisioned, scoped, reviewed, rotated, retired. Then agents arrived and most orgs handed them a static API key and called it done. No owner of record. No expiry. No access review that knows what an agent is. CSAI Foundation is building the identity, authorization, and orchestration framework for agents: csai.foundation/ #AgenticAI

"We bought a Zero Trust platform, so we're done." You hear it a lot, and it's a comfortable thing to believe. Reality: Zero Trust is an architecture and a way of making decisions, not a product. No tool can replace understanding what you're protecting and why each access decision gets made. CCZT builds that foundation: cloudsecurityalliance.org/ed…

Most teams treat compliance frameworks as separate projects: one for each audit, each with its own spreadsheet and its own scramble. The Cloud Controls Matrix is built to cut that duplication. 207 controls across 17 domains, vendor-neutral and free, so you can build your control set once and map it to what auditors and customers ask for. Less rework, clearer gaps. cloudsecurityalliance.org/re… #CloudSecurity

Candiru spyware reached Al Jazeera journalists' devices through ordinary ads. No clicks needed. Citizen Lab's research, covered in our note, found the ad server only sent exploit code to devices on a target list. Everyone else got a benign ad, so ad-scanning vendors saw nothing. At least 45 Al Jazeera devices were infected. For high-risk users, treat the ad supply chain as an attack path. labs.cloudsecurityalliance.o…

CISO Daily Briefing: CERT-In says AI agents reached Indian orgs via exposed credentials and over-permissioned cloud roles, undetected. Drupal patches two critical RCEs (SA-CORE-2026-014). NIST/NSA/CISA's ten AI-incident practices set no evidence-retention clock. BAE Systems' bankruptcy-notice outage has run since Oct 9; test continuity for outsourced functions. labs.cloudsecurityalliance.o…

Postmortem, agent edition: an agent refunds $40k to the wrong accounts. Security says it was an app issue. The app team says the model did it. The vendor points to the prompt. Legal asks who signed off on its scope. Four teams, zero owners, and the agent is still running. Incident response assumes someone owns the thing that broke. Autonomous systems blur that line. Defining it before the incident is governance work, and it's what CSAI Foundation is built for: csai.foundation/ #AgenticAI

Think of the last access permission someone in your organization was granted "temporarily." Is it still active? And if nobody can say who would notice, what does "least privilege" actually mean in your environment? CCZT is a good place to start looking for the answer: cloudsecurityalliance.org/ed… 🔐

Unpopular take: your system prompt is not a security control. "Never reveal customer data" is a request, not an enforcement. Anyone who can talk to the model can try to talk it out of that. Zero Trust for LLMs moves the boundary out of the prompt and into identity, authorization, and verification on every call the model makes. Start here: cloudsecurityalliance.org/re… #ZeroTrust