Researchers discovered a critical vulnerability in FIA's driver categorization website that allowed privilege escalation to admin level. This enabled access to sensitive documents including passports, PII, and communications for F1 drivers like Max Verstappen through a simple HTTP PUT request manipulation.   #attack   #saas

The article discusses securing ECS on EC2 by blocking IMDS access. IMDSv2 with hop limit 1 only blocks access in bridge mode but not in awsvpc or host modes. Different networking modes require specific configurations to protect against privilege escalation attacks like ECScape.   #aws   #containers   #defend   #iam

Copilot Studio links look benign, but they can host content to redirect users to arbitrary URLs. In this post, Datadog documents a method by which a Copilot Studio agent's login settings can redirect a user to any URL, including an OAuth consent attack.   #attack   #azure   #ai

Threat actors behind the gift card fraud campaign Jingle Thief target retail via phishing and smishing, maintaining long-term access in cloud environments.   #attack   #saas

Cisco Talos has observed increased activity by malicious actors leveraging Direct Send as part of phishing campaigns. Here's how to strengthen your defenses.   #attack   #defend   #microsoft365   #azure

During the spring of 2025, Google engaged NCC Group to conduct the security assessment of Confidential Space, a cloud-based system designed to provide isolated execution environments for sensitive workloads.   #defend

An open source platform that centralizes log collection, enhances threat detection, and enables real-time alerting, helping small to medium-sized organizations secure their infrastructure.

A command-line utility that performs configuration checks on your Auth0 tenant. It helps ensure your tenant is securely and correctly configured by validating key settings and generating a detailed report. You can also refer to the companion blog post.

A utility for generating Mermaid diagrams from Terraform configurations.

VirusTotal Command Line Interface.

Multi-layered secret detection tool combining regex patterns, fine-tuned BERT model, and LLM verification to identify structured tokens and context-dependent passwords in documents.

This article summarizes the Amazon DynamoDB service disruption in Northern Virginia (US-EAST-1) Region on October 19-20, 2025. The incident, caused by a DNS management system defect, affected DynamoDB, EC2 instance launches, Network Load Balancer connections, and numerous dependent AWS services.

A comparison of AWS services for managing secrets and configurations: Secrets Manager for credentials requiring rotation, Parameter Store for simple key-value pairs, and AppConfig for feature flags with deployment controls. Each service has distinct pricing, security features, and use cases.

AWS Secrets Manager Agent for Amazon EKS provides a language-agnostic HTTP interface that runs locally within containers. It improves application availability by fetching secrets from local cache instead of direct API calls, and implements post-quantum cryptography protection via ML-KEM key exchange.

New capabilities in Cloud Armor offer more comprehensive security policies and granular network configuration controls.

Blog outlining some of the unique threats associated with the data storage layer, including relevant stages of the attack chain for Blob Storage to connect these risks to actionable Azure Security controls and applicable security recommendations.