AI Just Breached AWS in 72 Hours ☁️ — and a 15-Year-Old Linux Bug Is Back 🐧

Two stories from today's security headlines show how quickly the threat landscape is shifting: attackers are now weaponizing AI to break into cloud accounts at machine speed, and a flaw that sat quietly inside Linux for 15 years just resurfaced with the power to hand hackers the keys to the kingdom.

🤖 One Attacker + AI = A Full AWS Breach in 72 Hours

A single financially motivated hacker managed to compromise a company's entire Amazon Web Services (AWS) cloud environment in just three days — and they did it by letting AI do the heavy lifting. After grabbing one leaked AWS access key from a vulnerable internet-facing app, the attacker ran automated, AI-assisted scripts to hunt down more passwords, plant hidden backdoors, steal data, and hijack the company's deployment pipelines.

Here's the part that should worry every business: instead of simply destroying things, the attacker used reversible moves — like quietly cutting off access to files and slowing down services — to prove they were in control and pressure the victim into paying up. The takeaway is simple but urgent: a single exposed key is no longer a small mistake. With AI, one person can now do the damage that used to take a whole team, so locking down credentials and monitoring your cloud is more important than ever.

Read more →

🐧 "GhostLock": A 15-Year-Old Linux Flaw Gives Hackers the Keys

Researchers uncovered a serious vulnerability nicknamed GhostLock (CVE-2026-43499) that has been hiding in the Linux kernel — the software at the heart of most of the world's servers, cloud systems, and even Android phones — for roughly 15 years. The bug lets an attacker with no special permissions gain full "root" control of a machine and even break out of the isolated containers many companies rely on to keep apps separated.

What makes this one especially alarming is how reliable it is: security testers got it to work about 97% of the time, and it earned over $92,000 in Google's bug-hunting program. Because it needs no elevated access to start, any business running Linux servers or containers should treat this as an urgent "patch now" situation and apply the fix immediately rather than waiting.

Read more →

Stay ahead of threats with GOCO Security at gocosecurity.com.