Skip to content
Threat Feed

Vendor

AWS

3 briefs RSS
critical advisory

CVE-2026-31431 'Copy Fail' Linux Kernel Privilege Escalation

The 'Copy Fail' vulnerability (CVE-2026-31431) in the Linux kernel allows a local attacker to escalate privileges to root, potentially leading to container breakout and lateral movement in cloud environments.

Amazon Linux 2023 +3 privilege-escalation linux kernel
2r 1t 1c
low advisory

Rapid Enumeration of AWS S3 Buckets

An AWS principal rapidly enumerates S3 bucket posture using read-only APIs, indicative of reconnaissance, scanning, or post-compromise activity.

AWS S3 +1 aws s3 cloudtrail discovery enumeration reconnaissance
2r 4t
low advisory

AWS Discovery API Calls via CLI from a Single Resource

This rule detects when a single AWS identity executes more than five unique discovery-related API calls (Describe*, List*, Get*, or Generate*) within a 10-second window using the AWS CLI, potentially indicating reconnaissance activity following credential compromise or compromised EC2 instance access.

cloud aws cloudtrail discovery
2r 2t