Cloud Security

Argo CD repo-server flaw enables unauthenticated code execution if reachable on the internal network, risking cluster compromise. There is no patch or CVE yet; mitigate with network segregation.

Threat actors redirect audit logs and telemetry to attacker storage; tighten bucket controls.

VS Code extension flaws enable arbitrary code execution and cloud credential theft via malicious repos.

OAuth token theft in Klue supply chain enables access to Salesforce data; investigation ongoing.

OAuth abuse via Klue integration enables CRM data exfiltration; review third-party app grants and tokens.

Microsoft released a broad May 2026 Patch Tuesday covering 120 vulnerabilities across Windows, Azure, and Office, including 29 critical RCE flaws. Patch management is essential to reduce exposure.