Cloud Security Architect: 2026-09-25

1. Storm-3168: Agentic-driven cloud attacks using compromised service principals

   Microsoft Security, 2026-09-25. Read, 13 min.

   Microsoft reports that Storm-3168, its name for the actor Sysdig discovered as JADEPUFFER, used two compromised service principals in one Azure tenant for discovery and then attempted more than 150 destructive or credential collection operations in 35 minutes, deleting most of the targeted storage accounts along with a Key Vault, a Function App, and an App Service plan. Microsoft says it is unclear how the service principal was first compromised and that its secret had earlier been exposed in a public GitHub issue's edit history, though it could not confirm that secret was used.

   Why it matters for this role: Treat any workload credential that ever appeared in a public issue or commit as live until rotated, since editing the post did not remove this secret from the issue's history.

2. How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers

   Cloudflare, 2026-09-24. Read, 9 min.

   Cloudflare says a researcher from Accomplish reported on September 4 that a customer with a Workers Paid account could recover residual disk blocks previously used by Containers on the same multi-tenant host, though the technique could not target a particular customer and residual data was not guaranteed to be present. Cloudflare applied a fix across the Containers fleet with no customer configuration changes required, and says it found no evidence of malicious exploitation within the historical telemetry available to it.

   Why it matters for this role: Your provider due diligence for container platforms should now include how freed disk blocks are cleaned, the step Cloudflare's storage pools skipped before this fix.

Cloud Security Architect