Tag: kubernetes
-
k0s Enters CNCF Sandbox: A New Lightweight Kubernetes Option
How k0s, a lightweight Kubernetes distribution, joins the CNCF Sandbox, enhancing cloud-native computing. Explore its features today! First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/05/k0s-enters-cncf-sandbox-a-new-lightweight-kubernetes-option/
-
Critical Argo CD Flaw Exposes Kubernetes Clusters to Full Resource Manipulation
A critical cross-site scripting (XSS) vulnerability, officially tracked as CVE-2025-47933 and GHSA-2hj5-g64g-fp6p, has been identified in Argo CD, a widely used open-source GitOps tool for Kubernetes. This flaw affects the repository URL handling mechanism in the Argo CD user interface, specifically due to improper validation of URL protocols in the ui/src/app/shared/components/urls.ts file. Attackers can exploit…
-
Woodpecker: Red Teaming Tool Targets AI, Kubernetes, and API Vulnerabilities
Operant AI has announced the release of Woodpecker, an open-source automated red teaming engine designed to make advanced security testing accessible to organizations of all sizes. Traditionally, red teaming”, simulated cyberattacks conducted by ethical hackers to uncover vulnerabilities”, has been a privilege reserved for large enterprises with significant security budgets. With Woodpecker, Operant AI aims…
-
Woodpecker: Open-source red teaming for AI, Kubernetes, APIs
Woodpecker is an open-source tool that automates red teaming, making advanced security testing easier and more accessible. It helps teams find and fix security weaknesses in … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/05/28/woodpecker-open-source-red-teaming/
-
Tigera Introduces Calico Cloud Free Tier to Boost Kubernetes Observability and Security
First seen on scworld.com Jump to article: www.scworld.com/news/tigera-introduces-calico-cloud-free-tier-to-boost-kubernetes-observability-and-security
-
Threat intelligence platform buyer’s guide: Top vendors, selection advice
Tags: ai, attack, automation, breach, cloud, computing, credentials, crowdstrike, cyber, cybersecurity, dark-web, data, data-breach, deep-fake, detection, dns, edr, email, endpoint, exploit, finance, firewall, fraud, gartner, google, group, guide, identity, incident response, infrastructure, intelligence, kubernetes, law, malicious, malware, microsoft, mitigation, monitoring, network, open-source, phishing, privacy, risk, service, siem, soar, soc, sophos, sql, supply-chain, technology, threat, tool, vpn, vulnerability, zero-dayThe Cybersecurity and Infrastructure Security Agency (CISA) found that since 2023 the majority of exploits were zero days, meaning exploiting heretofore unknown methods. And according to the latest Verizon Data Breach Investigations report (DBIR), the percentage of AI-assisted malicious emails doubled to 10% of the totals they observed over the past two years, making staying…
-
Nutanix Sharpens Focus on Modern Workloads with Pure Storage Partnership, Kubernetes Expansion, and Agentic AI Advancements
First seen on scworld.com Jump to article: www.scworld.com/news/nutanix-sharpens-focus-on-modern-workloads-with-pure-storage-partnership-kubernetes-expansion-and-agentic-ai-advancements
-
Nutanix escapes the datacentre with Cloud Native AOS
Hyper-converged infrastructure provider offers its operating system independently of a hypervisor to allow containerised apps to run at the edge or on Kubernetes runtimes in the Amazon cloud First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366623721/Nutanix-escapes-the-datacentre-with-Cloud-Native-AOS
-
Helm Charts Flaw Could Let Hackers Access Kubernetes Clusters, Microsoft Finds
Default Helm charts for Kubernetes may expose clusters to attacks, Microsoft warns. Misconfigurations risk data leaks, code execution, and takeovers. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/news/microsoft-helm-charts-kubernetes-clusters/
-
Microsoft Alerts That Default Helm Charts May Expose Kubernetes Apps to Data Leaks
Microsoft’s cybersecurity research team has issued a stark warning about the risks of using default Helm charts and Kubernetes deployment templates, revealing that popular cloud-native applications like Apache Pinot, Meshery, and Selenium Grid are being deployed with critical security gaps. These misconfigurations-often prioritizing convenience over protection-allow attackers to hijack databases, execute arbitrary code, and gain…
-
Microsoft Warns Default Helm Charts Could Leave Kubernetes Apps Exposed to Data Leaks
Microsoft has warned that using pre-made templates, such as out-of-the-box Helm charts, during Kubernetes deployments could open the door to misconfigurations and leak valuable data.”While these ‘plug-and-play’ options greatly simplify the setup process, they often prioritize ease of use over security,” Michael Katchinskiy and Yossi Weizman from the Microsoft Defender for Cloud Research team First…
-
Redefining Application Security: Imperva’s Vision for the Future
It’s no secret that web applications have undergone a significant transformation over the past few years. The widespread adoption of containerization, serverless computing, low-code development, APIs, and microservices has redefined how applications are built, deployed, and scaled. According to Statista, over 60% of organizations now use Kubernetes to manage their containerized workloads. Meanwhile, security remains……
-
Microsoft finds default Kubernetes Helm charts can expose data
Microsoft warns about the security risks posed by default configurations in Kubernetes deployments, particularly those using out-of-the-box Helm charts, which could publicly expose sensitive data. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/microsoft-finds-default-kubernetes-helm-charts-can-expose-data/
-
CNAPP-Kaufratgeber
Tags: access, ai, application-security, attack, authentication, cloud, container, detection, edr, encryption, framework, group, ibm, infrastructure, intelligence, kubernetes, linux, ml, monitoring, network, open-source, risk-management, saas, soar, software, supply-chain, threat, tool, vmware -
Radware and SUSE Partner to Advance Secure Kubernetes Deployments for Enterprises and Service Providers
First seen on scworld.com Jump to article: www.scworld.com/news/radware-and-suse-partner-to-advance-secure-kubernetes-deployments-for-enterprises-and-service-providers
-
Threat Actors Exploiting Unsecured Kubernetes Clusters for Crypto Mining
In a startling revelation from Microsoft Threat Intelligence, threat actors are increasingly targeting unsecured Kubernetes clusters to conduct illicit activities such as cryptomining. The dynamic and complex nature of containerized environments poses significant challenges for security teams in detecting runtime anomalies or identifying the source of breaches. Rising Threats in Containerized Environments According to Microsoft’s…
-
Google launches unified enterprise security platform, announces AI security agents
Cloud security enhancements: The Google Cloud Platform (GCP) Security Command Center will gain new capabilities for protecting cloud workloads, especially those related to AI model use.Model Armor, a feature that’s part of GCP’s existing AI Protection service, will allow customers to apply content safety and security controls to prompts that are sent to self-hosted AI…
-
CNCF survey reveals widespread Kubernetes adoption, growing reliance on cloud-native technologies
First seen on scworld.com Jump to article: www.scworld.com/brief/cncf-survey-reveals-widespread-kubernetes-adoption-growing-reliance-on-cloud-native-technologies
-
LoftLabs unveils vNode for secure node-level isolation in shared Kubernetes environments
Tags: kubernetesFirst seen on scworld.com Jump to article: www.scworld.com/brief/loftlabs-unveils-vnode-for-secure-node-level-isolation-in-shared-kubernetes-environments
-
An Improved Detection Signature for the Kubernetes IngressNightmare Vulnerability
Wiz recently published a detailed analysis of a critical vulnerability in the NGINX Ingress admission controller”, what they’ve dubbed IngressNightmare (CVE-2025-1097, CVE-2025-1098, CVE-2025-1974, CVE-2025-24514). The vulnerability stems from insufficient input validation during configuration file processing, allowing an attacker to inject arbitrary code into the NGINX process. Wiz’s writeup is excellent and covers the technical nuances…
-
MSSP Market Update: NGINX Flaw Could Expose Kubernetes Secrets
First seen on scworld.com Jump to article: www.scworld.com/news/mssp-market-update-nginx-flaw-could-expose-kubernetes-secrets
-
Kubernetes Ingress-nginx Remote Code Execution Vulnerability (CVE-2025-1974)
Overview Recently, NSFOCUS CERT detected that Kubernetes issued a security announcement and fixed the Kubernetes Ingress-nginx remote code execution vulnerability (CVE-2025-1974). The Ingress controller deployed in Kubernetes Pod can be accessed through the network without authentication. When the Admission webhook is open, an unauthenticated attacker can remotely inject any nginx configuration by sending a special…The…
-
PoC Exploit Released for Ingress-NGINX RCE Vulnerabilities
A recently disclosed vulnerability in Ingress-NGINX, tracked as CVE-2025-1974, has raised concerns about the security of Kubernetes environments. This vulnerability allows for Remote Code Execution (RCE) through the validating webhook server integrated into Ingress-NGINX. A Proof of Concept (PoC) exploit has been released, demonstrating how attackers could exploit this flaw. CVE-2025-1974 affects versions of Ingress-NGINX…
-
String of defects in popular Kubernetes component puts 40% of cloud environments at risk
Researchers aren’t aware of active exploitation in the wild, but they warn the risk for publicly exposed and unpatched Ingress Nginx controllers is extremely high. First seen on cyberscoop.com Jump to article: cyberscoop.com/kubernetes-nginx-controller-defects-wiz/