On April 26, an unauthorized user exploited a vulnerability with a GitHub workflow to gain unauthorized access to tokens, all of which have now been invalidated.   #announcement   #attack   #supply-chain

Praetorian found vulnerabilities in Node.js's CI/CD pipelines, which could lead to remote code execution and potential supply chain attacks.   #attack   #defend   #supply-chain

The "Account Assessment for AWS Organizations" tool, designed to audit resource-based policies for risky cross-account access, ironically introduced cross-account privilege escalation risks due to flawed deployment instructions.   #attack   #aws   #iam

Post walking through multiple real-world scenarios, including how a malicious Hugging Face model can escalate privileges, how limited Glue access can impact other services, and how a single default role can ultimately lead to full control of an AWS account.   #attack   #aws

Many MCP environments store long-term API keys for third-party services in plaintext on the local filesystem, often with insecure, world-readable permissions.   #ai   #attack

Post highlighting the inconsistency in AWS services regarding S3 bucket permissions and encryption methods.   #aws   #defend

This post introduces a novel privilege escalation technique in Google Cloud Platform (GCP) that exploits IAM Conditions in combination with tagBindings.   #attack   #gcp   #iam

In Kubernetes v1.33 support for user namespaces is enabled by default. This means that, when the stack requirements are met, pods can opt-in to use user namespaces.   #announcement   #containers   #kubernetes

Blog dissecting the limitations of Microsoft's activity logs, walking through real-world simulations using the msInvader tool, and highlighting what gets seen and what silently slips through the cracks.   #azure   #monitor

Map visualization and firewall for AWS activity, inspired by Little Snitch for macOS.

A wrapper around GitHub's OIDC API that also inspects the sub claim formats for both the organization or the repository.

An MCP server that installs other MCP servers for you.

Know Your Enemies - Check external access on your AWS account.

A recon tool for GCP Service Account Keys that requires no permissions. You can also refer to the companion blog post.

Customers can create zero standing privileges to nodes by requiring operators to request access to nodes managed by AWS Systems Manager that are running on AWS, hybrid, and multi-cloud environments before remotely connecting using AWS Systems Manager Session Manager.

Using the new API, customers will no longer need root access to manage their account names, and they will be able to use authorized IAM principals within the account.

LLMs promise significant gains for security teams to augment human expertise in areas like threat detection, investigation, and response.