Security News

The role of Kubernetes in modern app management
2023-11-06 04:00

Kubernetes, often abbreviated as K8s, is an open-source container orchestration platform that has redefined the way modern applications are developed, deployed, and managed. Born out of Google's internal container orchestration system, Kubernetes has become the de facto standard for containerized application management, offering a powerful and flexible platform for automating containerized applications' deployment, scaling, and management.

Unpatched NGINX ingress controller bugs can be abused to steal Kubernetes cluster secrets
2023-10-30 20:00

Three unpatched high-severity bugs in the NGINX ingress controller can be abused by miscreants to steal credentials and other secrets from Kubernetes clusters. The Register did not immediately receive a response to questions, including if the bugs have been found and exploited and when a patch will be issued.

Urgent: New Security Flaws Discovered in NGINX Ingress Controller for Kubernetes
2023-10-30 06:46

Three unpatched high-severity security flaws have been disclosed in the NGINX Ingress controller for Kubernetes that could be weaponized by a threat actor to steal secret credentials from the...

Kubernetes attacks in 2023: What it means for the future
2023-09-28 04:00

In 2023, a wave of new attacks targeting Kubernetes has been reported, from Dero and Monero crypto mining to Scarleteel and RBAC-Buster. In this Help Net Security video, Jimmy Mesta, CTO at KSOC, explores what it would take to protect against Kubernetes attacks in the real world.

Fresh Wave of Malicious npm Packages Threaten Kubernetes Configs and SSH Keys
2023-09-20 10:13

Cybersecurity researchers have discovered a fresh batch of malicious packages in the npm package registry that are designed to exfiltrate Kubernetes configurations and SSH keys from compromised...

Kubernetes vulnerability allows RCE on Windows endpoints (CVE-2023-3676)
2023-09-18 11:31

Three high-severity Kubernetes vulnerabilities could allow attackers to execute code remotely and gain control over all Windows nodes in the Kubernetes cluster. "The Kubernetes framework uses YAML files for basically everything - from configuring the Container Network Interface to pod management and even secret handling," Peled explained.

Alert: New Kubernetes Vulnerabilities Enable Remote Attacks on Windows Endpoints
2023-09-13 14:05

Three interrelated high-severity security flaws discovered in Kubernetes could be exploited to achieve remote code execution with elevated privileges on Windows endpoints within a cluster. The issues, tracked as CVE-2023-3676, CVE-2023-3893, and CVE-2023-3955, carry CVSS scores of 8.8 and impact all Kubernetes environments with Windows nodes.

Kubernetes clusters face widespread attacks across numerous organizations
2023-08-17 04:00

In this Help Net Security video, Assaf Morag, Lead Threat Intelligence Analyst at Aqua Security, discusses research that discovered openly accessible and unprotected Kubernetes clusters belonging to more than 350 organizations, open-source projects, and individuals. At least 60% of these clusters were breached and had an active campaign with deployed malware and backdoors.

Malicious Campaigns Exploit Weak Kubernetes Clusters for Crypto Mining
2023-08-09 09:05

Exposed Kubernetes clusters are being exploited by malicious actors to deploy cryptocurrency miners and other backdoors. Cloud security firm Aqua, in a report shared with The Hacker News, said a majority of the clusters belonged to small to medium-sized organizations, with a smaller subset tied to bigger companies, spanning financial, aerospace, automotive, industrial, and security sectors.

Kubernetes Bill of Materials (KBOM) open-source tool enhances cloud security response to CVEs
2023-05-10 06:16

Kubernetes Security Operations Center released the first-ever Kubernetes Bill of Materials standard. While the Software Bill of Materials has moved forward to the point of being a formal part of the NIST requirements required by the USA federal government in federal purchases, this requirement falls short of the deployment stage in the application development lifecycle, where Kubernetes into play.