Attack Paths Into VMs in the Cloud
Summary: Unit 42 Palo Alto Networks reviewed attack paths into cloud VMs across AWS, Azure and GCP, finding that 11% of internet-exposed cloud hosts carry Critical or High severity vulnerabilities. The research catalogs techniques including startup script manipulation, SSH key push, direct code execution and serial console access, noting these are intended features with legitimate uses rather than vulnerabilities, and that most paths rely on control plane APIs.
What you should know: A compromised VM hands attackers not just the data inside it but every cloud permission granted to that workload identity - and since VMs are ephemeral, that identity is arguably the bigger prize. The techniques require permissions attackers obtain through credential leaks or phishing, so the exposure sits in who holds rights like ec2:ModifyInstanceAttribute or compute.instances.setMetadata.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026