An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure

Kaspersky Securelist reports on cloud isolation bypasses, AI security, APT activity, UEFI bootkits, critical PHP remote-code-execution vulnerabilities, ransomware abuse of Active Directory Group Policy, malware campaigns, and warehouse and endpoint security. The most significant items include BlackX, an APT41-linked UEFI bootkit exploiting Baton Drop (CVE-2022-21894); PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619; a Kubernetes/Konnectivity and overlay-network vulnerability chain enabling cross-tenant cloud compromise; Lazarus Operation FlashHole; and PAYLOAD ransomware abusing4