August 21, 2025 – CrowdStrike disclosed ongoing activity by MURKY PANDA, a state-aligned Chinese espionage group purpose-built for the cloud. Unlike many threat actors who adapt legacy tactics, MURKY PANDA designs operations around cloud-native infrastructure from the ground up. Their latest campaign combines a Linux malware strain, a Commvault zero-day exploit, and identity abuse in Microsoft […]

In today’s fast-paced development environments, the speed of software delivery has outpaced traditional security workflows. APIs are often published before they’re reviewed, cloud resources are deployed via automation, and new vulnerabilities emerge in runtime that never existed in dev or staging. It’s estimated that over 50% of data breaches by 2025 will originate from unprotected […]

On September 8, 2025, one of the largest npm supply chain incidents in recent history unfolded. Popular libraries like debug and chalk along with 16 other utilities were hijacked and pushed to npm with malicious code targeting cryptocurrency wallets and blockchain transactions. These packages collectively have billions of weekly downloads, making this compromise both widespread […]

A critical vulnerability was disclosed in Argo CD, a popular GitOps continuous delivery tool. This flaw allows project-level API tokens to retrieve sensitive repository credentials such as usernames and passwords, even when those tokens do not have explicit permissions to access secrets. Overview Argo CD uses project-level tokens to automate deployment workflows and manage applications.Due […]

APIs are the foundation of modern software. From mobile apps to cloud-native platforms, they allow services to communicate, scale, and deliver value quickly. In fact, more than 70% of all internet traffic flows through APIs today, which makes them both essential and high-risk. But as APIs have become more critical, they’ve also become one of […]

In the cloud, time is always against you. Every moment a critical vulnerability lingers unpatched is an opening for attackers. Security scans often surface hundreds, or even thousands, of findings at once, assigning SLAs (Service Level Agreements) based on outdated or irrelevant information. For most teams, this means hours lost triaging findings instead of closing […]

On August 26, 2025, the popular Nx build system package was compromised in a sophisticated supply-chain attack. Malicious versions of Nx and related packages were published to npm, embedding malware that scanned developer environments for sensitive credentials and exfiltrated them. This attack stands out not only because of its impact with thousands of developers who […]

Upwind now supports a significant new AI-powered capability in the Upwind platform, allowing users to create custom posture rules with LLM-based Rego, streamlining workflows and accelerating reduction of their cloud attack surface. Upwind’s runtime-backed posture engine has always surfaced high-impact misconfigurations that pose true risks to cloud environments, often missed by traditional CSPMs. With this […]

We’re excited to announce that Upwind now supports the Center for Internet Security (CIS) benchmark for Azure Kubernetes Service (AKS), helping security and compliance teams move faster with ongoing posture checks, active threat detection, and automated enforcement. With this release, customers can apply the same runtime-aware compliance capabilities already used across frameworks such as HIPAA, […]

Most cloud security platforms are built on static assumptions – scanning code, configs, and assets to guess where risk might exist. At Upwind, we took a fundamentally different approach: we built our platform on runtime. By capturing real-time signals directly from the kernel, Upwind delivers deep, continuous visibility into how workloads, APIs, identities, and data actually […]