Wiz Research uncovered 500+ leaked secrets in VSCode and Open VSX extensions, exposing 150K installs to risk.   #attack   #defend   #supply-chain

The article discusses the rising trend of adversaries abusing AI command-line interface (CLI) tools for malicious activities such as credential harvesting, reconnaissance, and data destruction.   #ai   #attack

Business Email Compromise (BEC) incidents are common, and usually start with a suspicious email containing a PDF with a link to a fake Microsoft 365 login page, which tricked the victim into providing credentials and MFA details.   #monitor   #gsuite   #saas

Every SPIFFE ID, certificate, and mTLS handshake at Riptides originates in the Linux kernel and begins with a single question: can we prove who this workload really is? This post explores how process-level evidence becomes the foundation of verifiable trust across the system.   #design   #defend

Google Workspace offers strong foundational security, but subtle architectural blind spots in identity, data governance, and app ecosystems, compounded by human factors, create significant risks beyond default protections.   #gsuite   #defend   #saas

This post details a September 2025 security incident where a former RubyGems.org maintainer retained AWS root access after removal. Ruby Central discovered unauthorized access, reset credentials, and found no evidence of data compromise.   #announcement   #attack   #aws   #supply-chain

Escalating to Global Admin via active assignments.

A tool for checking if MFA is enabled on multiple Microsoft Services.

A Go library, server, and CLI providing foundational capabilities to simulate access for AWS IAM policies.

Toolkit to help you get started with Spec-Driven Development.

A simple CLI tool to retrieve S3 storage costs and storage tiers for buckets in your AWS account.

Learn how to use NitroTPM for attestation to verify the integrity of your EC2 instances.

AWS Transfer Family SFTP connectors now support VPC-based connectivity, allowing secure file transfers between Amazon S3 and remote SFTP servers through your existing VPC infrastructure without exposing endpoints to the internet.

AWS launched Amazon EBS Volume Clones, a new capability that allows users to create instant point-in-time copies of EBS volumes within the same Availability Zone with a single API call, eliminating the previous multi-step process of taking snapshots and creating volumes from them.

Password scrambling guidance to deploy passwordless and phishing-resistant authentication for organizations that use Microsoft Entra ID.