Loading story…
Google warned that publicly accessible serverless applications, particularly Google Cloud Run services and functions, can expose organizations to remote code execution, secret theft, and deeper cloud compromise when custom code, third-party packages, or runtime components are vulnerable. The report highlighted two representative attack paths: a Python/Flask-style local file inclusion flaw and a command injection issue that can let an attacker execute arbitrary commands in an exposed function.
After gaining execution, attackers may query the Google Cloud metadata service to retrieve service account bearer tokens, enabling lateral movement and broader access inside the cloud environment. Google said defensive measures should focus on hardening internet-facing functions and applying Cloud Armor protections, noting that WAF signatures such as lfi-v33-stable and rce-v33-stable blocked the demonstrated exploit requests with HTTP 403 responses.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Google published guidance describing how publicly exposed Cloud Run services and functions can be exploited through issues such as local file inclusion and command injection, potentially allowing code execution, secret extraction, and metadata-service token theft. The post also demonstrated that Cloud Armor WAF rules including lfi-v33-stable and rce-v33-stable can block the example exploit requests with HTTP 403 responses.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceitpro.com
Open sourcecloud.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google’s *H1 2026 Cloud Threat Horizons* reporting described a sophisticated intrusion attributed with **moderate confidence** to North Korea-linked **UNC4899** (aka **Jade Sleet**, **PUKCHONG**, **Slow Pisces**, **TraderTraitor**) that targeted a cryptocurrency organization in 2025 and resulted in the theft of millions in cryptocurrency. The attack began with social engineering against a developer, who downloaded a malicious archive under the guise of open-source collaboration and then transferred it from a personal device to a corporate workstation via **AirDrop**; interaction with the archive led to execution of malicious Python that launched a backdoor binary masquerading as the Kubernetes CLI (`kubectl`). From the compromised endpoint, the actor pivoted into the cloud environment and used **living-off-the-cloud (LOTC)** techniques, abusing legitimate **DevOps workflows** to harvest credentials, escape container boundaries, and tamper with **Cloud SQL** databases to alter financial logic and enable theft. Separately, Google’s broader cloud incident trend analysis found attackers are increasingly using **newly disclosed third-party vulnerabilities**—not just weak credentials or misconfigurations—for initial access into cloud environments, with exploit “time-to-weaponization” shrinking from weeks to **days** (including cryptominer deployment within ~48 hours of disclosure). In Google’s reviewed intrusions, vulnerability exploitation was the leading initial access vector (44.5%) versus credentials (27%), with **RCE** flaws most frequently abused; examples cited include **React2Shell** (`CVE-2025-55182`) and an **XWiki** vulnerability (`CVE-2025-24893`) used in **RondoDox** botnet activity. The report also noted continued use of compromised identities via phishing/vishing (often help desk impersonation) and that many cloud intrusions prioritized **quiet, high-volume data exfiltration** and persistence over immediate extortion.
Jun 29, 2026
A demonstrated AWS laboratory attack chain showed that an unauthenticated API Gateway endpoint could invoke a Lambda function that passed a user-controlled query parameter to Python's `eval()`. The resulting code injection let an unauthenticated caller read temporary AWS credentials from the Lambda runtime environment; the credentials were associated with the `vuln-lab-lambda-execution-role` and could access a `database-master` secret in AWS Secrets Manager. The demonstration highlights how an application-layer flaw can become a cloud credential compromise when Lambda execution roles are overprivileged. Permissions such as `iam:PassRole` combined with Lambda management rights could support account-level privilege escalation, while `lambda:UpdateFunctionCode` could permit persistence. Organizations should require API authentication, remove dynamic execution of untrusted input, restrict Lambda roles to least privilege, and monitor API Gateway and CloudWatch logs, CloudTrail, and GuardDuty for suspicious activity.
Sep 21, 2026
Two critical vulnerabilities in the Spring ecosystem exposed Java applications to remote code execution: **CVE-2022-22965** in the Spring Framework, widely known as **Spring4Shell**, and **CVE-2022-22963** in **Spring Cloud Function**. Spring4Shell abuses the framework’s data-binding mechanism under specific conditions—including **JDK 9+**, **Apache Tomcat**, vulnerable Spring Framework versions, and **WAR** deployment—to let attackers overwrite Tomcat logging configuration and drop a **JSP web shell** on the server. The Spring Cloud Function issue, **CVE-2022-22963**, allows code injection through a crafted `spring.cloud.function.routing-expression` HTTP header that exploits **Spring Expression Language (SpEL)** to achieve remote code execution. Vendor and security reporting identified affected versions, published fixes and mitigations, and highlighted detection opportunities including exploit-related file hashes and generic security verdicts for spotting attempted compromise.
Sep 3, 2026