InfoSecBulletin Cybersecurity for mankind
The Zeroday Cloud hacking competition in London awarded $320,000 to researchers for showing serious remote code execution vulnerabilities in cloud infrastructure components. This is the first event focused on cloud systems, hosted by Wiz Research with Amazon Web Services, Microsoft, and Google Cloud.
Researchers achieved an 85% success rate in 13 hacking sessions, uncovering 11 zero-day vulnerabilities.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
Wiz said that $200,000 was awarded on the first day for finding vulnerabilities in Redis, PostgreSQL, Grafana, and the Linux kernel.
On the second day, researchers made $120,000 by exploiting vulnerabilities in Redis, PostgreSQL, and MariaDB, which are widely used databases for storing sensitive information.
The Linux kernel was breached due to a container escape flaw, enabling attackers to bypass isolation between cloud tenants and compromising cloud security.
Researchers at cybersecurity companies Zellic and DEVCORE were awarded $40,000 for their success.
Team Xint Code won the first Zeroday Cloud competition by successfully exploiting Redis, MariaDB, and PostgreSQL, earning $90,000 for their efforts. The awarded amount is just a small part of the $4.5 million prize pool available for researchers demonstrating exploits.
The eligible categories and products that had no exploits in the competition are AI (Ollama, vLLM, Nvidia Container Toolkit), Kubernetes, Docker, web servers (nginx, Apache Tomcat, Envoy, Caddy), Apache Airflow, Jenkins, and GitLab CE.
