{"id":56676,"date":"2026-11-11T02:04:49","date_gmt":"2026-11-11T02:04:49","guid":{"rendered":"https:\/\/www.intelligentcio.com\/apac\/?p=56676"},"modified":"2026-11-11T02:04:50","modified_gmt":"2026-11-11T02:04:50","slug":"serious-vulnerabilities-in-cloud-workloads-increase-4x-in-just-nine-months","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/apac\/2026\/11\/11\/serious-vulnerabilities-in-cloud-workloads-increase-4x-in-just-nine-months\/","title":{"rendered":"Serious vulnerabilities in cloud workloads increase 4x in just nine months"},"content":{"rendered":"\n<p>Datadog\u2019s new <em>State of Cloud Security 2026<\/em> report has revealed that the median number of high or critical vulnerabilities in cloud services rose fourfold, from four in February 2026 to around 16 in November.<\/p>\n\n\n\n<p>The findings show that cloud applications are carrying more serious known flaws, reinforcing the need for cloud security foundations that limit an attacker\u2019s reach if an application is compromised.&nbsp;<\/p>\n\n\n\n<p><strong>Long-lived AI keys extend an attacker\u2019s access<\/strong><\/p>\n\n\n\n<p>Limiting the impact of a compromised application also means protecting the keys it uses to reach other services. More than one in five organisations analysed by Datadog uses cloud AI services. To make these services easier to adopt, cloud providers offer long-lived API keys that can remain valid until revoked, giving an attacker more time to use them if stolen.&nbsp;<\/p>\n\n\n\n<p>Datadog found that nearly half of organisations using Google Gemini use long-lived Gemini API keys, while 17% of those using Amazon Bedrock use long-lived Bedrock API keys.<\/p>\n\n\n\n<p>\u201cAttackers don\u2019t need to use their own AI model if they can steal the key used to access yours,\u201d said Andrew Krug, Head of Security Advocacy at Datadog. \u201cTeams should use temporary access wherever possible as they build AI applications, rather than leave behind keys that can keep working for years.\u201d<\/p>\n\n\n\n<p>Attackers are already testing stolen cloud credentials for AI access. Datadog Security Labs recently uncovered tools designed to test whether stolen AWS credentials can access Amazon Bedrock. Researchers also observed similar probing in 12 organisations\u2019 cloud environments over a 30-day period.<\/p>\n\n\n\n<p><strong>Supply chain attacks provide another route to cloud credentials<\/strong><\/p>\n\n\n\n<p>The report reveals that cloud workloads depend on 149 software packages on average, more than half of which are indirect dependencies brought in through other packages. In addition, 60% of organisations run cloud applications using a package version released less than 24 hours earlier. Across all cloud applications analysed, 21% use a version this new.<\/p>\n\n\n\n<p>While new packages are not inherently unsafe, the figures show how quickly a compromised version could reach cloud applications. The Shai-Hulud 2.0 malware shows the potential consequences: the malware searched infected systems for cloud credentials.<\/p>\n\n\n\n<p>The report did, however, find signs of progress in limiting what an attacker can reach, even with a valid credential: 55% of organisations using AWS have adopted data perimeters, up from 40% in 2025.&nbsp;<\/p>\n\n\n\n<p>\u201cAs serious flaws multiply, the question is how far an attacker can get through one compromised application,\u201d said Emilio Escobar, Datadog CISO. \u201cTeams need to fix those flaws and limit the damage if an application is compromised. Temporary credentials and data perimeters can restrict an attacker\u2019s access, while a shared view of applications, identities and infrastructure helps Security and Engineering contain an attack before it spreads. In the AI era, security becomes an observability problem: you can\u2019t stop a system-wide attack without seeing the whole system.\u201d&nbsp;<\/p>\n\n\n\n<p>\u201cThe report broadly reflects what Datadog sees across Australia and New Zealand,\u201d said Yadi Narayana, Field CTO APJ at Datadog. \u201cMany organisations understand the risk, but long-lived credentials often remain hidden in older applications and integrations because teams fear disrupting critical services. Boards should treat software supply chain risk as a business resilience issue, not simply a technical problem. The priority is to identify every credential, understand what it can access, replace static keys where possible and monitor unusual activity across the full environment.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Datadog\u2019s new State of Cloud Security 2026 report has revealed that the median number of high or critical vulnerabilities in cloud services rose fourfold, from four in February 2026 to around 16 in November. The findings show that cloud applications are carrying more serious known flaws, reinforcing the need for cloud security foundations that limit [&hellip;]<\/p>\n","protected":false},"author":21,"featured_media":56677,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[7027,12204,9935,3559,12198,18,38,11939,7998,44],"tags":[1108,1090,174,8216,1841,1625],"class_list":["post-56676","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-intelligent-technologies-ai","category-ai","category-cloud-computing","category-intelligent-technologies-cybersecurity","category-innovation-cybersecurity","category-enterprise-security","category-analysis-research","category-research","category-security","category-top-stories","tag-ai","tag-cloud-security","tag-cybersecurity","tag-datadog","tag-report","tag-research"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/posts\/56676","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/comments?post=56676"}],"version-history":[{"count":1,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/posts\/56676\/revisions"}],"predecessor-version":[{"id":56678,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/posts\/56676\/revisions\/56678"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/media\/56677"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/media?parent=56676"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/categories?post=56676"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/tags?post=56676"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}