Sensitive AI secrets are showing up in public code repositories at alarming rates. A scan from Wiz uncovered key leakage patterns and practices that must change.   #ai   #defend

To mitigate potential impacts of Docker Hub rate limits and improve supply chain security, Mercari has undertaken a project to launch an in-house Docker registry and migrate their production infrastructure over to pull from the registry.   #build   #ci/cd   #containers

Cato CTRL observed an emerging platform on Tor called Nytheon AI that combines various technologies and LLM jailbreaks to create a suite of uncensored LLMs to facilitate malicious activities.   #ai   #attack

Asana identified a bug in its Model Context Protocol (MCP) server that may have exposed data to MCP users in other Asana accounts.   #ai   #attack   #saas

What are Slack Audit Logs? Like many Software as a Service (SaaS) offerings, Slack provides audit logs to Enterprise Grid customers that record when entities take an action on the platform. For example, when a user logs in, when a user updates their profile, when an app downloads a file, etc.   #explain   #monitor

How to manage access in Amazon Redshift, focusing on best practices for security.   #aws   #defend   #iam

Version 6.0 of the Terraform AWS provider is now generally available. Along with bugfixes, the latest update brings enhanced multi-region support and other workflow improvements.   #announcement   #iac   #terraform

A GenerativeAI application designed to automate and streamline the threat modeling process for secure system design.

A Slack Export archive viewer that allows you to easily view and share your Slack team's export.

Development environments for coding agents. Enable multiple agents to work safely and independently with your preferred stack.

A Model Context Protocol (MCP) server that provides browser automation capabilities using Playwright.

GuardDuty Extended Threat Detection introduces a new critical severity finding type, which automatically correlates security signals across Amazon EKS audit logs, runtime behaviors of processes associated with EKS clusters, malware execution in EKS clusters, and AWS API activity to identify sophisticated attack patterns that might otherwise go unnoticed.

Multi-party approval for AWS Backup logically air-gapped vaults enables organizations to recover their backup data even when their AWS account is compromised, by creating approval teams of trusted individuals who can authorize vault sharing with a recovery account through a separate authentication path.

Amazon announced the preview release of the new AWS Security Hub which offers additional correlation, contextualization, and visualization capabilities.

Shield network security posture management automatically discovers and analyzes network resources across AWS accounts, prioritizes security risks based on AWS best practices, and provides actionable remediation recommendations to protect applications against threats like SQL injections and DDoS attacks.

A new capability in IAM Access Analyzer helps security teams verify which principals within their AWS organization have access to critical resources like S3 buckets, DynamoDB tables, and RDS snapshots by using automated reasoning to evaluate multiple policies and provide findings through a unified dashboard.

Key components of this strategy include model hardening, machine learning models for detecting malicious instructions, and user confirmation frameworks to ensure secure interactions.

Google developed a tool to scan open-source package and image files by default for leaked Google Cloud credentials to help protect Google Cloud customers who publish open-source artifacts.