InfoSecBulletin Cybersecurity for mankind
The Zeroday Cloud hacking competition in London awarded $320,000 to researchers for showing serious remote code execution vulnerabilities in cloud infrastructure components. This is the first event focused on cloud systems, hosted by Wiz Research with Amazon Web Services, Microsoft, and Google Cloud.
Researchers achieved an 85% success rate in 13 hacking sessions, uncovering 11 zero-day vulnerabilities.
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
Wiz said that $200,000 was awarded on the first day for finding vulnerabilities in Redis, PostgreSQL, Grafana, and the Linux kernel.
On the second day, researchers made $120,000 by exploiting vulnerabilities in Redis, PostgreSQL, and MariaDB, which are widely used databases for storing sensitive information.
The Linux kernel was breached due to a container escape flaw, enabling attackers to bypass isolation between cloud tenants and compromising cloud security.
Researchers at cybersecurity companies Zellic and DEVCORE were awarded $40,000 for their success.
Team Xint Code won the first Zeroday Cloud competition by successfully exploiting Redis, MariaDB, and PostgreSQL, earning $90,000 for their efforts. The awarded amount is just a small part of the $4.5 million prize pool available for researchers demonstrating exploits.
The eligible categories and products that had no exploits in the competition are AI (Ollama, vLLM, Nvidia Container Toolkit), Kubernetes, Docker, web servers (nginx, Apache Tomcat, Envoy, Caddy), Apache Airflow, Jenkins, and GitLab CE.
