Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In late November 2025, developers and API users of ChatGPT and OpenAI’s platform received a note that felt personal: an alert about a data exposure linked not to OpenAI’s own servers but to a third-party analytics vendor. That vendor was Mixpanel.

Cloud native environments built on Kubernetes, containers, and microservices operate differently from traditional infrastructure. They scale dynamically, change continuously, and distribute workloads across multiple clusters and clouds. Legacy security tools can’t keep up with these demands.

The attack landscape has been dynamic following the disclosure of the React Server Components RCE vulnerability. New information has emerged regarding the initial Proof-of-Concept exploit, as well as improved detection methods, exploitation mechanics observed in the wild, and rapidly growing attack activity. This update summarizes the changes and observations we have made across Wallarm customers.

Tokenization replaces sensitive data with non-sensitive stand-ins called tokens. The mapping between the token and the original value sits in a secure service or vault. If attackers steal a database full of tokens, the stolen data has little value. This is why tokenization is popular for payment card industry (PCI) workloads, customer PII, and healthcare records. Yet tokenization is not magic. Like any control, it has weak points and practical limits. Teams often learn about those limits the hard way.

In this article, we’ll break down the three most prevalent runtime threat vectors behind most modern cloud breaches – and why traditional cloud security tools fail to detect them. Let’s get one thing clear: the cloud itself hasn’t become more dangerous – but cloud-native architectures fundamentally changed the threat landscape. In the datacenter era, most threats targeted hosts, networks, and endpoints.

For twenty years, a stolen private key was a disaster. It meant total compromise. Every encrypted conversation, password transmitted, API call ever made was readable. Traffic was being recorded all the time, “just in case” your private key leaked out. The NSA even had a name for it: “harvest now, decrypt later.” Record all the encrypted traffic today. Steal the private keys tomorrow. Decrypt everything retroactively.

Every day, professionals and knowledge workers lose hours digging through files, reports, and systems. The information is out there, but it’s buried. Instead of shaping strategy, people get stuck chasing down data. Even with strong IT, time spent searching has only grown since 2002, now averaging 1.8 hours a day, according to a McKinsey study. Think about it: They all need clarity fast. But, what they get is fragments spread across disconnected sources and hours of searching.

ReliaQuest warns that the cybercriminal collective “Scattered Lapsus$ Hunters” appears to be using social engineering attacks to target organizations’ Zendesk instances. This group was behind a widespread campaign earlier this year that used voice phishing attacks to compromise dozens of companies’ Salesforce portals.

Earlier this year, twin brothers Muneeb and Sohaib Akhter, both government contractors, were fired from their employer. Minutes later, they began a weeklong insider attack that compromised or destroyed data belonging to more than 45 federal agencies.

A security information and event management (SIEM) solution aggregates and correlates data from across the organization’s complex, interconnected environment. Modern enterprise IT consists of decentralized users and applications that require organizations to implement technologies that provide visibility across disparate security solutions. Simultaneously, SIEMs have a reputation for being difficult and expensive to manage.