Learn how the Oracle breach amplifies your risk from rogue cloud tenants plus how Grip helps organizations detect exposure and respond fast to mitigate risks.
The post Best of 2025: Oracle Breach: The Impact is Bigger Than You Think | Grip appeared first on Security Boulevard.
For the last twenty years, cybersecurity has been built around the edge: the belief that threats come from the outside, and that firewalls, WAFs, and API gateways can inspect and control what enters the environment.
That model worked when applications were centralized, traffic was predictable, and most interactions followed a clear pattern: a user in a browser talking to an app inside a data center.
Agentic AI breaks that model.
Today, AI systems don’t just generate responses — they take action. Agents trigger workflows, call APIs, update records, fan out across services, and interact autonomously with internal systems and third-party SaaS. That shift moves the risk inside the API ecosystem, where perimeter-based tools have limited visibility.
The Architectural Truth: The Perimeter Model No Longer Fits Modern TrafficLegacy perimeter tools were designed for a world with simple assumptions:
Agentic AI broke those assumptions almost overnight.
APIs already made every service both a client and a server. Agentic AI amplifies this by turning every LLM, MCP server, automation tool, and SaaS ecosystem into an active participant in your environment.
A single user request can now trigger:
This is no longer “north–south vs. east–west.” In the age of agentic AI, API traffic behaves more like a scene from Everything Everywhere All at Once — chaotic, multi-directional, and hard to predict.
The API Fabric: A Multi-Directional Mesh of Constant MotionIn the API fabric, every node is both client and server:
This means the most security-critical flows now look like:
Attackers don’t care about compass directions. They care about the fastest chain of APIs that reaches sensitive data.
Why Edge Security and WAAP Tools Miss Most of the Agentic AI Attack ChainNeither WAFs nor WAAPs were designed for:
Here’s what they see vs. what they miss:
Still feel secure? You might want to rethink your posture
Point solutions give snapshot visibility. Agentic AI creates continuous, dynamic API behavior. The gap between those two is now a systemic security risk
Why Multi-Directional Visibility Is Now MandatoryTo secure APIs — and the AI agents sitting on top of them — security teams need visibility into:
Agentic AI doesn’t attack your perimeter. It attacks your blind spots inside the API fabric.
Why Salt Security Is Built for the API Fabric (and for Agentic AI)Salt is purpose-built for this new world — designed around the API fabric itself, not a perimeter model.
Salt provides the multi-directional visibility and runtime intelligence required to secure agentic AI environments:
1) Observe API traffic where it actually runsAcross cloud environments, gateways, service meshes, MCP servers, and SaaS-driven workflows — including east/west and agent-created “off-axis” paths.
2) Reconstruct the real API fabricSalt rebuilds the operational truth: what APIs exist, who is calling them (including agents and SaaS tools), how data moves, and where risk accumulates.
3) Detect and stop what edge tools can’tSalt identifies high-risk behavior that perimeter tools miss, including misconfigured or over-permissioned agents, abnormal API chaining, new exposure from MCP integrations, and data exfil paths that look like “normal” workflows until you see the full chain.
Recent Salt capabilities reinforce this approach, including:
Agentic AI has shifted risk away from the perimeter and deep into the API fabric. Firewalls, WAFs, and gateways were never designed to observe or understand the behavior of LLMs, MCP servers, or autonomous agents moving across internal and SaaS-connected systems.
Security teams need to see every actor, every call, and every chain — not just what crosses the edge.
The edge is no longer where your risk lives. Your APIs are. And now, so are your agents.
If you want to learn more about Salt and how we can help you, please contact us, schedule a demo, or visit our website. You can also get a free API Attack Surface Assessment from Salt Security's research team and learn what attackers already know.
The post Edge Security Is Not Enough: Why Agentic AI Moves the Risk Inside Your APIs appeared first on Security Boulevard.
Zero-day vulnerabilities often attract attention and concern because of their unpredictability. They are, by definition, weaknesses that are unknown to software vendors and therefore have no official fix at the point of discovery. When discovered and exploited by malicious actors, they allow attackers to bypass controls before organisations even realise there is a problem. The…
The post Zero-day vulnerabilities: what they are and how to respond appeared first on Sentrium Security.
The post Zero-day vulnerabilities: what they are and how to respond appeared first on Security Boulevard.
how tenant isolation works in multi-tenant systems, with a deep technical focus on authentication, SSO, tokens, and infrastructure security.
The post Tenant Isolation in Multi-Tenant Systems: Architecture, Identity, and Security appeared first on Security Boulevard.
Introduction As the world is more and more switched to the availability of the internet, web browsers act as portals to numerous services and data. However, such conveniences mean the existence of certain risks. However, there is an emerging threat that is becoming worrying among cybersecurity professionals today, and these are ransom over browsers, whichRead More
The post Web Browsing’s Dark Side: Understanding Ransomware over Modern Web Browsers appeared first on EncryptedFence by Certera - Web & Cyber Security Blog.
The post Web Browsing’s Dark Side: Understanding Ransomware over Modern Web Browsers appeared first on Security Boulevard.
The State of Cybersecurity in the U.S. Healthcare (2024-2025) The U.S. healthcare sector is facing an unprecedented cybersecurity siege. Healthcare data, particularly Protected Health Information (PHI), remains one of the most valuable commodities on the dark web, often worth 10 to 50 times more than credit card data due to its permanence and usefulness in
The post Report: The U.S. Healthcare Cybersecurity Crisis and the Seceon Unified Platform Solution appeared first on Seceon Inc.
The post Report: The U.S. Healthcare Cybersecurity Crisis and the Seceon Unified Platform Solution appeared first on Security Boulevard.
Cyberattack continued to climb worldwide in 2025. Organizations saw an average of roughly 1,900 – 2,000 attacks per week. Compared to 2024, it’s a mid-single-digit percentage increase. Certain regions experienced especially sharp growth. For example, Europe’s attack volume jumped ~22% year-over-year. Critical infrastructure remained a focal point; approximately 70% of all incidents involved organizations in […]
The post Top Sectors Under Cyberattack in 2025 appeared first on Kratikal Blogs.
The post Top Sectors Under Cyberattack in 2025 appeared first on Security Boulevard.
Explore post-quantum cryptography in federated learning for Model Context Protocol training. Learn about quantum vulnerabilities, security measures, and real-world applications.
The post Post-Quantum Secure Federated Learning for decentralized MCP training. appeared first on Security Boulevard.
How Do Non-Human Identities Shape Enterprise Security? What role do Non-Human Identities (NHIs) play in safeguarding enterprise security? With digital evolve, understanding and managing NHIs becomes imperative for organizations seeking robust security measures, especially those operating in cloud environments. NHIs refer to machine identities, encompassing encrypted passwords, tokens, or keys that function as unique identifiers, […]
The post How scalable is Secrets Management for large enterprises appeared first on Entro.
The post How scalable is Secrets Management for large enterprises appeared first on Security Boulevard.
Can Non-Human Identities Enhance Security in High-Risk Environments? One intriguing question is whether Non-Human Identities (NHIs) can effectively reinforce security measures in environments considered high-risk. NHIs, often understood as machine identities, encompass secrets like encrypted passwords, tokens, and keys that provide unique identifiers. They function analogously to a passport with permissions akin to a visa, […]
The post What measures protect NHIs in high risk environments appeared first on Entro.
The post What measures protect NHIs in high risk environments appeared first on Security Boulevard.
Why Are Non-Human Identities Crucial for Cloud Security? How do organizations ensure robust security when integrating complex technologies like Agentic AI into their infrastructure? This is a pivotal question, especially when considering cloud security and the management of Non-Human Identities (NHIs). NHIs, representing machine identities combined with their respective secrets and permissions, stand at the […]
The post How secure are Agentic AI systems in handling sensitive data appeared first on Entro.
The post How secure are Agentic AI systems in handling sensitive data appeared first on Security Boulevard.
How Does Machine Identity Security Foster Confidence in Cybersecurity? Is your organization truly equipped to handle the complexities of machine identity security? While we navigate a rich with digital transformations, the importance of securing non-human identities (NHIs) cannot be overstated. NHIs, often referred to as machine identities, carry the same critical role in cybersecurity as […]
The post Can I feel confident in the security of machine identities appeared first on Entro.
The post Can I feel confident in the security of machine identities appeared first on Security Boulevard.
Session 7C: Secure Protocols
Authors, Creators & Presenters: Xuanji Meng (Tsinghua University), Xiao Sui (Shandong University), Zhaoxin Yang (Tsinghua University), Kang Rong (Blockchain Platform Division，Ant Group), Wenbo Xu (Blockchain Platform Division，Ant Group), Shenglong Chen (Blockchain Platform Division，Ant Group), Ying Yan (Blockchain Platform Division，Ant Group), Sisi Duan (Tsinghua University)
PAPER
Rondo: Scalable and Reconfiguration-Friendly Randomness Beacon
We present Rondo, a scalable and reconfiguration-friendly distributed randomness beacon (DRB) protocol in the partially synchronous model. Rondo is the first DRB protocol that is built from batched asynchronous verifiable secret sharing (bAVSS) and meanwhile avoids the high O(n^3) message cost, where n is the number of nodes. Our key contribution lies in the introduction of a new variant of bAVSS called batched asynchronous verifiable secret sharing with partial output (bAVSS-PO). bAVSS-PO is a weaker primitive than bAVSS but allows us to build a secure and more scalable DRB protocol. We propose a bAVSS-PO protocol Breeze. Breeze achieves the optimal O(n) messages for the sharing stage and allows Rondo to offer better scalability than prior DRB protocols. Additionally, to support the reconfiguration, we introduce Rondo-BFT, a dynamic and partially synchronous Byzantine fault-tolerant protocol inspired by Dyno (S&P 2022). Unlike Dyno, Rondo-BFT provides a communication pattern that generates randomness beacon output periodically, making it well-suited for DRB applications. We implement our protocols and evaluate the performance on Amazon EC2 using up to 91 instances. Our evaluation results show that Rondo achieves higher throughput than existing works and meanwhile offers better scalability, where the performance does not degrade as significantly as n grows.
ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.
Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.
The post NDSS 2025 – Rondo: Scalable And Reconfiguration-Friendly Randomness Beacon appeared first on Security Boulevard.
A high-severity flaw in MongoDB instances could allow unauthenticated remote bad actors to leak sensitive data from MongoDB servers. Dubbed "MongoBleed," the security flaw is being exploited in the wild after a PoC exploit and technical details were published. MongoDB has released patches to protect against exploitation.
The post Threat Actors Exploiting Critical ‘MongoBleed’ MongoDB Flaw appeared first on Security Boulevard.
via the comic artistry and dry wit of Randall Munroe, creator of XKCD
The post Randall Munroe’s XKCD ‘Website Task Flowchart’ appeared first on Security Boulevard.
A recently disclosed vulnerability affecting MongoDB instances has been reportedly exploited in the wild. Exploit code has been released for this flaw dubbed MongoBleed.
Key takeaways:On December 19, MongoDB issued a security advisory to address a vulnerability affecting the zlib implementation of MongoDB.
CVE Description CVSSv3 VPR CVE-2025-14847 MongoDB Uninitialized Memory Leak Vulnerability (“MongoBleed”) 7.5 8.0*Please note: Tenable’s Vulnerability Priority Rating (VPR) scores are calculated nightly. This blog post was published on December 29 and reflects VPR at that time.
AnalysisCVE-2025-14847 is a memory leak vulnerability affecting MongoDB instances in which zlib compression is enabled. A flaw in how MongoDB implements zlib decompression could allow unauthenticated attackers to leak uninitialized memory, which can contain sensitive data including credentials, session tokens and API keys. This flaw was dubbed “MongoBleed” by Elastic Security researcher Joe Desimone, who published a proof-of-concept demonstrating the vulnerability. While exploitation does require zlib compression to be enabled and a vulnerable MongoDB version to be internet exposed, reports of in the wild exploitation have already begun.
According to Censys, there are over 87,000 potentially vulnerable instances of MongoDB that have been identified, with the largest concentration being found in the United States.
Source: Censys
Proof of conceptOn December 25, a public proof-of-concept (PoC) was released on GitHub. This PoC demonstrates how data can be leaked from uninitialized memory. According to the PoC details, the following data could be leaked:
MongoDB has released patches to address this vulnerability as outlined in the table below:
Affected Version Fixed Version MongoDB Server v3.6 (All Versions) Upgrade to MongoDB 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, 4.4.30 or later MongoDB Server v4.0 (All Versions) Upgrade to MongoDB 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, 4.4.30 or later MongoDB Server v4.2 (All Versions) Upgrade to MongoDB 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, 4.4.30 or later MongoDB 4.4.0 through 4.4.29 Upgrade to MongoDB 4.4.30 or later MongoDB 5.0.0 through 5.0.31 Upgrade to MongoDB 5.0.32 or later MongoDB 6.0.0 through 6.0.26 Upgrade to MongoDB 6.0.27 or later MongoDB 7.0.0 through 7.0.26 Upgrade to MongoDB 7.0.28 or later MongoDB 8.0.0 through 8.0.16 Upgrade to MongoDB 8.0.17 or later MongoDB 8.2.0 through 8.2.2 Upgrade to MongoDB 8.2.3 or laterAccording to the MongoDB security advisory, if immediate patching is not able to be performed, the workaround suggestion is to disable zlib compression. In addition, we recommend that you limit network access to MongoDB instances to trusted IP addresses only. While this step was not outlined in the advisory, it has been recommended as a security best practice by MongoDB.
Identifying affected systemsA list of Tenable plugins for this vulnerability can be found on the individual CVE page for CVE-2025-14847 as they’re released. This link will display all available plugins for this vulnerability, including upcoming plugins in our Plugins Pipeline.
Tenable Attack Surface Management customers are able to identify assets running MongoDB services by using the filter 'Services contains mongod' as shown in the screenshot below:
Get more informationJoin Tenable's Research Special Operations (RSO) Team on Tenable Connect and engage with us in the Threat Roundtable group for further discussions on the latest cyber threats.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.
The post CVE-2025-14847 (MongoBleed): MongoDB Memory Leak Vulnerability Exploited in the Wild appeared first on Security Boulevard.
NDSS 2025 - The Road To Trust: Building Enclaves Within Confidential VMs
Session 7B: Trusted Hardware and Execution
Authors, Creators & Presenters: Wenhao Wang (Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, CAS), Linke Song (Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, CAS), Benshan Mei (Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, CAS), Shuang Liu (Ant Group), Shijun Zhao (Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, CAS), Shoumeng Yan (Ant Group), XiaoFeng Wang (Indiana University Bloomington), Dan Meng (Institute of Information Engineering, CAS), Rui Hou (Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, CAS)
PAPER
The Road to Trust: Building Enclaves within Confidential VMs
Integrity is critical for maintaining system security, as it ensures that only genuine software is loaded onto a machine. Although confidential virtual machines (CVMs) function within isolated environments separate from the host, it is important to recognize that users still encounter challenges in maintaining control over the integrity of the code running within the trusted execution environments (TEEs). The presence of a sophisticated operating system (OS) raises the possibility of dynamically creating and executing any code, making user applications within TEEs vulnerable to interference or tampering if the guest OS is compromised. To address this issue, this paper introduces NestedSGX, a framework which leverages virtual machine privilege level (VMPL), a recent hardware feature available on AMD SEV-SNP to enable the creation of hardware enclaves within the guest VM. Similar to Intel SGX, NestedSGX considers the guest OS untrusted for loading potentially malicious code. It ensures that only trusted and measured code executed within the enclave can be remotely attested. To seamlessly protect existing applications, NestedSGX aims for compatibility with Intel SGX by simulating SGX leaf functions. We have also ported the SGX SDK and the Occlum library OS to NestedSGX, enabling the use of existing SGX toolchains and applications in the system. Performance evaluations show that context switches in NestedSGX take about 32,000 -- 34,000 cycles, approximately 1.9 times -- 2.1 times higher than that of Intel SGX. NestedSGX incurs minimal overhead in most real-world applications, with an average overhead below 2% for computation and memory intensive workloads and below 15.68% for I/O intensive workloads.
ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.
Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.
The post NDSS 2025 – The Road To Trust: Building Enclaves Within Confidential VMs appeared first on Security Boulevard.
Frequently asked questions about five vulnerabilities in the Ingress NGINX Controller for Kubernetes, collectively known as IngressNightmare.
BackgroundThe Tenable Security Response Team (SRT) has compiled this blog to answer Frequently Asked Questions (FAQ) regarding IngressNightmare.
FAQWhat is IngressNightmare?
IngressNightmare is the name given to a series of vulnerabilities in the Ingress NGINX Controller for Kubernetes, an open source controller used for managing network traffic in Kubernetes clusters using NGINX as a reverse proxy and load balancer.
What are the vulnerabilities associated with IngressNightmare?
The following CVEs are associated with IngressNightmare:
CVE Description CVSSv3 CVE-2025-1097 Ingress NGINX Controller Configuration Injection via Unsanitized auth-tls-match-cn annotation 8.8 CVE-2025-1098 Ingress NGINX Controller Configuration Injection via Unsanitized Mirror Annotations 8.8 CVE-2025-1974 Ingress NGINX Admission Controller Remote Code Execution 9.8 CVE-2025-24513 Ingress NGINX Controller Auth Secret File Path Traversal Vulnerability 4.8 CVE-2025-24514 Ingress NGINX Controller Via Unsanitized Auth-URL Annotation 8.8When was IngressNightmare first disclosed?
Public disclosure of IngressNightmare happened on March 24 when news outlets, such as The Hacker News, began reporting on these vulnerabilities. At the time those articles were published, no patches were yet available from the Kubernetes team nor had a blog been published by the researchers who discovered these flaws.
How critical are the IngressNightmare vulnerabilities?
Based on the CVSS scores for these vulnerabilities, three are categorized as high severity, one is categorized as medium severity and one is categorized as critical severity.
The most severe flaw, CVE-2025-1974, requires an unauthenticated remote attacker to be able to access the admission controller, a component in the Ingress NGINX Controller that has more privileged access within a Kubernetes cluster.
Are the IngressNightmare vulnerabilities part of a toxic combination?
Yes, the five vulnerabilities that make up IngressNightmare can be chained together as part of a toxic combination (or exploit chain). Successful exploitation of these flaws would grant an attacker the ability to access cluster secrets, which could result in a cluster takeover.
Was this exploited as a zero-day?
No, these vulnerabilities were reported to Kubernetes through coordinated disclosure.
Is there a proof-of-concept (PoC) available for these vulnerabilities?
As of March 24, there are no public proof-of-concept exploits for any of the five CVEs associated with IngressNightmare.
Are patches or mitigations available for IngressNightmare?
Yes, on the evening of March 24, the Kubernetes team published two fixed versions of Ingress NGINX Controller:
Affected product Affected versions Fixed version Ingress NGINX Controller 1.12.0 1.12.1 Ingress NGINX Controller 1.11.4 and below 1.11.5Additionally, customers can use the following command to determine if clusters are using ingress-nginx:
kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginxFor more specific information about mitigation steps, please refer to the Kubernetes blog.
Does this also affect the NGINX Ingress Controller?
No, while the names may sound similar, IngressNightmare does not affect the NGINX Ingress Controller from F5.
Has Tenable released any product coverage for these vulnerabilities?
A list of Tenable plugins for these vulnerabilities will be available on the individual CVE pages as they’re released:
Our Plugins Pipeline displays all available plugins for these vulnerabilities, including upcoming plugins, as they are added.
Additional coverage is being investigated by Tenable Research and this blog post will be updated accordingly.
Get more informationJoin Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.
The post Best of 2025: CVE-2025-1097, CVE-2025-1098, CVE-2025-1974, CVE-2025-24513, CVE-2025-24514: Frequently Asked Questions About IngressNightmare appeared first on Security Boulevard.
In 2026, the question isn’t whether Kubernetes wins – it already has. And yet, many organizations are running mission-critical workloads on a platform they still treat as plumbing, not the operating layer that controls speed, security, and efficiency. Recent Cloud Native Computing Foundation (CNCF) surveys of cloud‑native artificial intelligence (AI) adoption and broader cloud‑native trends , along with Google Cloud’s 2026 cybersecurity forecast , make that gap hard to ignore.
The post 2026 Kubernetes Playbook: AI at Scale, Self‑Healing Clusters, & Growth appeared first on Security Boulevard.
Bangalore is the beating heart of India’s technology landscape, a global hub where innovation, data, and enterprise operations converge at unprecedented scale. But a new report highlights a stark reality: as digital acceleration skyrockets, so do the cyber risks facing the multinational organizations (MNCs) operating here. With the DPDP Act 2023 reshaping compliance expectations and
The post Bangalore MNCs Under Cyber Siege: Why India’s Silicon Valley Faces a New Era of Risk and How Unified Security Platforms Are Becoming Essential appeared first on Seceon Inc.
The post Bangalore MNCs Under Cyber Siege: Why India’s Silicon Valley Faces a New Era of Risk and How Unified Security Platforms Are Becoming Essential appeared first on Security Boulevard.
