Supply Chain Security Risk: GitHub Action tj-actions/changed-files Compromised

Aqua Cloud Native Blog

Expert insight, best practices and advice on cloud native security, trends, threat intelligence and compliance.

CVE-2025-30066

On March 14th, 2025, security researchers discovered a critical software supply chain vulnerability in the widely-used GitHub Action tj-actions/changed-files (CVE-2025-30066). This vulnerability allows remote attackers to expose CI/CD secrets via the action’s build logs. The issue affects users who rely on the tj-actions/changed-files action in GitHub workflows to track changed files within a pull request. …

Security Threat

perfctl: A Stealthy Malware Targeting Millions of Linux Servers thumbnail

Bucket Monopoly: Breaching AWS Accounts Through Shadow Resources

Security Threat

A Brief History of Containers: From the 1970s Till Now

Employee Personal GitHub Repos Expose Internal Azure and Red Hat Secrets

Security Threat

Top 22 Docker Security Best Practices: Ultimate Guide

SECURITY RESEARCH

Stopping Sobolan Malware with Aqua Runtime Protection

Aqua Nautilus researchers have discovered a new attack campaign targeting interactive computing environments such as Jupyter Notebooks. The attack consists of multiple stages, beginning with the download of a compressed file from a remote server. Once executed, the attacker deploys several malicious tools to exploit the server and establish persistence. This campaign poses a significant …

CLOUD SECURITY

Debunking Six Myths of Cloud Native Security

The promise of cloud native applications lies in their ability to provide enhanced agility, scalability, and resilience, perfectly aligning with the digital transformation needs of today’s enterprises. However, as we navigate this transformation, cloud native application security is often surrounded by myths and misconceptions. Understanding these myths and how they are being addressed is crucial …

Subscribe to Aqua Blog

CONTAINER SECURITY

Secure Your Containers from Perfctl with Aqua Runtime Protection

Protecting against advanced malware like perfctl requires a multi-layered approach. While signature-based detection effectively identifies known variants, perfctl can evolve and evade these methods. To stay protected from future strains, combine signature-based and behavioral-based monitoring to detect suspicious and malicious unknown activity. With flexible runtime policies, you have the control to automatically stop threats like …

CLOUD ATTACKS

Top Cloud Native Threats and Vulnerabilities of 2024

The complexity of cloud environments means that there is a virtually infinite list of potential security risks and vulnerabilities that could arise within cloud infrastructure or workloads. That said, some cloud security threats are more prevalent than others – and knowing which risks and vulnerabilities are trending is key to knowing what to prioritize when …

CONTAINER SECURITY

GigaOm Radar: Aqua Leads in Container Security

Securing containerized applications demands a multi-layered strategy that spans the entire lifecycle from development to production, a challenge Aqua has spent nearly a decade mastering. Aqua’s Container Security solution provides full lifecycle protection by identifying vulnerabilities early in the build phase, integrating acceptance gates in the CI/CD pipeline to minimize risks, and offering real-time runtime …

CLOUD SECURITY

Malware Forensic Analysis: Capturing What Attackers Leave Behind

Every attack leaves a trail, but in containerized environments, this trail can evaporate before you even realize you have been attacked. These environments bring new challenges for security teams, including an expanding attack surface. Containers, while incredibly powerful, are short-lived, and attackers exploit this by moving quickly and covering their tracks. They often download and …

CONTAINER SECURITY

Securing Container Workloads on Azure Container Apps (ACA)

Azure Container Apps (ACA) is a serverless platform for scalable containerized applications, while abstracting the underlying infrastructure. Since it runs without providing access to its underlying operating system, it has inherent security benefits, but it also presents a challenge for security and compliance tools that were not purpose-built to support such an environment. Aqua is …

CONTAINER SECURITY

Secure Your Containers from DreamBus Botnet with Aqua Runtime Protection

Aqua’s robust container security solution provides multiple ways to protect against the DreamBus Botnet, with the simplest being Drift Prevention. We understand every environment is unique, Aqua’s Drift Prevention policy is flexible and allows you to set to Audit mode for detection only or to Enforce mode for automatic blocking. Step-by-Step Guide 1. Enable …

SECURITY RESEARCH

OPA Gatekeeper Bypass Reveals Risks in Kubernetes Policy Engines

Security Threat

Implementing Kubernetes securely can be a daunting task. Fortunately, there are tools in the K8s toolshed that provide out-of-the-box solutions using a single click. One such tools is OPA Gatekeeper. It is a great out-of-the-box security checkpoint to enforce security policies on Kubernetes. But are users using it correctly? Do they understand its limitations? Our …

CONTAINER SECURITY

Cloud Security Trends: Predictions and Strategies for Resilience

In 2025, cloud native security is set to undergo transformative progress. As Chief Information Security Officer at Aqua, I’ve seen how rapidly evolving threats and operational demands are driving organizations to redefine their approach to security. The focus is no longer just on adapting to challenges—it’s about deeply embedding security into every facet of development …

SECURITY RESEARCH

300,000+ Prometheus Servers and Exporters Exposed to DoS Attacks

Security Threat

In this research, we uncovered several vulnerabilities and security flaws within the Prometheus ecosystem. These findings span across three major areas: information disclosure, denial-of-service (DoS), and code execution. We found that exposed Prometheus servers or exporters, often lacking proper authentication, allowed attackers to easily gather sensitive information, such as credentials and API keys.

Page 1 of 3612 3 4 5 Next ›

Need to secure enterprise workloads?

Aqua Cloud Native Application Protection Platform (CNAPP)

Go cloud native with the experts!

Get Demo

Aqua Security

Aqua Security is the pioneer in securing containerized cloud native applications from development to production. Aqua's full lifecycle solution prevents attacks by enforcing pre-deployment hygiene and mitigates attacks in real time in production, reducing mean time to repair and overall business risk. The Aqua Platform, a Cloud Native Application Protection Platform (CNAPP), integrates security from Code to Cloud, combining the power of agent and agentless technology into a single solution. With enterprise scale that doesn’t slow development pipelines, Aqua secures your future in the cloud. Founded in 2015, Aqua is headquartered in Boston, MA and Ramat Gan, IL protecting over 500 of the world’s largest enterprises.

Use Cases

Environments

Partners

Products

Get Started