How Palantir protects source code, from zero-trust development to commit signing.   #ci/cd   #defend   #process   #strategy   #supply-chain

Slides for a ShmooCon 2025 talk challenging what we think we know about securing Kubernetes.   #defend   #kubernetes

A publicly accessible database belonging to DeepSeek allowed full control over database operations, including the ability to access internal data. The exposure includes over a million lines of log streams with highly sensitive information.   #attack   #saas

A sophisticated phishing attack targeting Google accounts, made possible by exploiting Google's official URL shortcut.   #attack   #gsuite

This post covers best practices for using KDFs, including specialized scenarios that require careful treatment of key derivation to achieve the desired security properties.   #defend   #strategy

This post explores the following AWS EKS technologies, and applies them to the context of a real scenario: aws-auth (2018), IRSA (IAM Roles for Service Accounts) (2019), EKS Pod Identities (2023), and EKS Cluster Access Management (2023).   #aws   #iam   #kubernetes

This post introduces detection engineering and Sigma rules. It covers Sigma's purpose, syntax, and benefits for threat detection across diverse log sources and SIEM platforms.   #explain   #monitor

A bug in GitHub Desktop allows a malicious repository to leak the user's credentials.   #attack   #ci/cd

Leveraging AiTM and the OAuth 2.0 authorization code flow to steal access and refresh tokens.   #attack   #saas

Infrastructure-as-code for a serverless knowledge base using Amazon Bedrock, Aurora PostgreSQL, Lambda, and S3.

Check end-of-life, support schedule, and release timelines for more than 200 products at one place.

A web honeypot library to create vulnerable-looking endpoints to detect and mislead attackers.

An open-source, extensible AI agent that goes beyond code suggestions - install, execute, edit, and test with any LLM.

Garak checks if an LLM can be made to fail in a way we don't want.

AWS identified CVE-2025-0693 in the AWS Identity and Access Management (AWS IAM) Sign-in login flow. This issue could allow an actor to enumerate AWS IAM usernames by measuring server response times during login attempts.

To help improve the resiliency and performance of applications, AWS is making changes to the STS global endpoint, with no action required from customers. These changes will be released in the coming weeks.

Deep dive into an open source tool for testing GuardDuty findings.

Post talking about the benefits of retrofitting and how you can use this feature to allow Firewall Manager to manage existing web ACLs.

With new Workload Manager custom rules, you can validate your Google Cloud deployments against best practices to help ensure they are compliant.

Seth Vargo, distinguished software engineer responsible for Google's use of the public cloud, shares a peek under the hood at how Google uses and secures its own cloud environments.

Google updated Confidential Computing so it's available on even more machine types than before.

You can now verify the integrity of Google Kubernetes Engine components with SLSA, the Supply-chain Levels for Software Artifacts framework.

The guide explains how to use Temporary Access Pass (TAP) with internal guest users in Microsoft Entra ID. TAP is a time-limited passcode designed for single use or multiple sign-ins, enhancing security by enabling passwordless authentication.