#cloud-security

A week marked by widespread cloud disruption, active exploitation of critical server flaws, and an escalation in developer supply‑chain threats.

AWS experienced a DNS and load‑balancer outage that disrupted major consumer and developer services and spurred opportunistic phishing campaigns.

CISA added multiple actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalogue, including a Windows SMB privilege escalation and Adobe/Oracle issues.

A critical WSUS deserialisation flaw (CVE‑2025‑59287) was patched after proof‑of‑concept exploits and active attacks were reported.

Developer supply‑chain risks intensified as GlassWorm self‑propagating malware and TARmageddon tar‑parser flaws targeted extension ecosystems and libraries.

State‑linked espionage and ransomware activity continued, with new toolkits and resurgent RaaS operations observed across multiple campaigns.

Researchers revealed how malicious Outlook add-ins can quietly siphon email data without triggering audit logs, evading standard Microsoft 365 monitoring.

Source: Varonis Threat Labs

A covert malware-signing service abusing Microsoft’s own signing infrastructure has been dismantled after it secretly issued thousands of fraudulent certificates to ransomware operators worldwide.

Source: Microsoft Threat Intelligence

A flaw in certificate validation let attackers slip past Cloudflare protections and reach origin servers through a trusted maintenance path.

Source: FearsOff

From mass exploitation of Citrix NetScaler to ransomware crippling healthcare and utilities, 2025 exposed how perimeter devices, SaaS platforms, open-source supply chains, and even AI systems became repeat entry points for large-scale compromise.

January 2026 showed how quickly vulnerability exploitation and supply-chain abuse now translate into real-world impact across enterprise, cloud, and developer ecosystems.

The month was defined by several high-impact developments:

Widespread exploitation of enterprise zero-days, targeting Ivanti, Microsoft Office, Cisco, VMware, and Fortinet platforms.

Escalating supply chain compromises via malicious npm packages, compromised update infrastructure, and developer account takeovers.

Intensified state-sponsored espionage prioritising access to government systems, defence organisations, and critical infrastructure networks.

Continued evolution of ransomware, highlighted by cross-platform operations such as LockBit 5.0 using in-memory execution and enhanced encryption techniques.

Sustained pressure from cloud and container-focused threats, including advanced Linux malware frameworks and vulnerabilities affecting AI software ecosystems.

Muddled Libra and Silk Typhoon were tracked using MITRE ATT&CK-mapped alert patterns, revealing consistent operational tactics across multiple cloud environments.

Source: Palo Alto Networks Unit 42