AWS
Security incidents tagged AWS. Newest first.
- Incidents
- 3
- Live
- 0
- Patched
- 3
- Days without an incident
- 205
- Longest quiet run: 499 days (Oct 11–Feb 20)
Show 3 older incidents3 older incidents
February 2026 1
HighLexisNexis breach (FulcrumSec claims React2Shell path)Patched
LexisNexis Legal & Professional (legacy systems / React frontend claim) Patched
In March 2026 LexisNexis confirmed a breach of legacy servers exposing customer business contact and related data. Threat actor FulcrumSec claimed access via an unpatched React frontend “React2Shell” (CVE-2025-55182) into AWS infrastructure. LexisNexis said the matter was contained and mostly deprecated pre-2020 data.
Open incident →CVE-2025-55182
February 2025 1
- CriticalNo fix needed
Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea)
North Korean TraderTraitor/Lazarus hackers compromised a Safe{Wallet} developer's Mac, took over AWS session tokens and injected JavaScript into Safe's S3-hosted frontend. Bybit's signers approved what looked like a routine transfer but was a malicious transaction. It is the largest crypto theft on record; the FBI attributed it to North Korea.
Bybit cold wallet / Safe{Wallet} web UIClosed Mar 6, 2025
August 2023 1
- HighPatched
HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)
Attackers abused HTTP/2 stream cancellation (open a request, reset it right away, repeat) to make servers do work at enormous rates. Peaks hit 398M req/s at Google, 201M at Cloudflare and 155M at AWS. Almost every HTTP/2 server and proxy needed a fix, including Node.js, Go, Java servers, .NET/IIS and nginx.
HTTP/2 protocol implementations (servers, proxies, CDNs)Closed Oct 10, 2023
