Three things from cyber sec that should worry you this week if you’re in cloud or AI security. #CloudSecurity #AISecurity #InfoSec #CyberSecurity #subtletechie

Day 24/31 of Cloud + AI Security. Sometimes you do not need to attack the AI directly. You attack the information it trusts. If an attacker can manipulate training data, a RAG knowledge base, documents or another trusted data source, they may be able to influence what the AI produces. That is why data integrity matters so much in AI Security. Who can modify the data? Where did it come from? Can we detect changes? Are trusted and untrusted sources separated? Can high-impact outputs be validated? If you can corrupt what the AI trusts, you can influence what the AI produces. #datapoisoning #aisecurity #cybersecurityawarenessmonth

PHP runs close to 70% of the websites on the internet. And this week, we found out there were two critical holes in PHP itself that could potentially let an attacker get into the server without a login or password. Just the right request. That’s PHP2Shell CVE-2026-109618 and CVE-2026-109619 both rated 9.2 critical. These bugs were originally discovered back in August with the help of AI models and were being kept under coordinated disclosure while a fix was being prepared. But Amazon says it saw an exploitation attempt on October 17. That’s FOUR DAYS before the vulnerabilities were publicly disclosed. And once the details became public, exploitation attempts started showing up very quickly. That’s why the message from defenders right now is simple: PATCH. If you’re running PHP, update to: 8.5.12 8.4.27 8.3.36 8.2.35 And if you’re on PHP 8.1 or older, the PHP project is no longer releasing official updates for those branches. Some vendors may backport fixes, but honestly, that should also be your sign that it’s time to move to a supported version. If you or your organization haven’t taken care of this PHP vulnerability yet… you need to PATCH UP. #Cybersecurity #PHP #InfoSec #Vulnerability #PHP2Shell #CloudSecurity #WebSecurity #AI #TechTok #Subtletechie

Day 23/31 of Cloud + AI Security. A company can think it knows where AI is being used while employees are quietly using tools nobody approved. That is Shadow AI. Maybe someone is using a free AI assistant to summarize internal documents. Someone else is using an AI coding tool. Another person connects an AI service to company files. Now security has less visibility, company data may be moving into unknown systems, third-party integrations are increasing, and nobody may know what those tools can access or retain. The answer is not simply “ban AI.” The better approach is approved tools, clear policies, visibility, data controls and education. You cannot secure AI usage you do not even know exists. #ShadowAI #AISecurity #DataSecurity #CybersecurityAwarenessMonth

NIST. ISO. OWASP. MITRE. If you are getting into AI Security, it can feel like you are supposed to learn all of them at once. You are not. The easier way is to understand what each one helps you do. NIST AI RMF helps structure AI risk management. ISO/IEC 42001 helps organizations build and manage an AI management system. OWASP GenAI Security gets much closer to the technical risks practitioners need to understand. Do not ask which one is “best.” Ask what problem you are trying to solve. Frameworks become useful when you know where they fit. Day 22/31 of Cloud + AI Security. #AISecurity #iso42001 #owasp #cybersecurityawarenessmonth

Connecting AI to private company data can make it far more useful - but it also gives us more to secure. With RAG, the AI can retrieve information from internal documents, policies, customer data or knowledge bases and use that information to answer questions. Now the security questions start immediately. Can one user retrieve another user’s information? Who decides what the AI can access? Could sensitive data leak through the response? Can malicious instructions be hidden inside retrieved content? What happens if the knowledge base is poisoned? And are we logging what the system actually retrieves? Every new source of information you connect to AI increases its usefulness - and increases the importance of access control, data protection and monitoring. Day 19/31 of Cloud + AI Security. #aisecurity #datasecurity #cybersecurityawarenessmonth

POST CAPTION You hear this a lot when people talk about AI Security: “Just put guardrails around it.” Guardrails are useful, but they are not the whole security strategy. They can help control what an AI system is allowed to accept, generate or do - things like filtering risky inputs, blocking sensitive outputs, restricting certain behaviors, or adding approval steps around higher-risk actions. But guardrails do not replace IAM, least privilege, secure APIs, data protection, network controls, logging or human oversight. Think of a highway guardrail. It can stop a car from leaving the road, but you would never remove the brakes, seatbelt and traffic rules just because the guardrail exists. A strong AI security strategy uses guardrails as one layer inside a bigger defense-in-depth approach. So the question should not only be: “Does this AI have guardrails?” It should be: “What happens if the guardrail fails?” Day 17/31 of Cloud + AI Security. #AISecurity #AIGuardrails #DefenseInDepth #GenAI #CybersecurityAwarenessMonth

AI can help you build an application much faster. That still does not mean the code it generated is secure. Working code and secure code are two different things. If you are vibe coding or using AI heavily in development, review what gets generated. Scan it. Check dependencies. Test authentication and authorization. Keep secrets out of the code. And do not approve changes you do not understand just because the application runs. AI can speed up development. It does not remove your responsibility to secure what gets deployed. Day 13/31 of Cloud + AI Security. #aisecurity #vibecoding #cybersecurityawarenessmonth

API keys, passwords, tokens and database credentials are basically digital keys. So putting them directly inside your code is the digital version of leaving your house key taped to the front door. Use a proper secrets manager or vault. Control who and what can retrieve those secrets. Rotate them when needed. Log access. And where possible, use managed identities so you do not need long-lived credentials in the first place. The application may need the secret. That does not mean the secret belongs in the code. Day 12/31 of Cloud + AI Security. #CloudSecurity #SecretsManagement #AzureKeyVault #AWSSecretsManager #CybersecurityAwarenessMonth

Don’t miss out. tiktok.com/t/ZP9DoebrMMvVj-C… We are live on tik tok