Logs aren't just for defenders. This research explores how attackers exploit cloud audit logs for enumeration and reconnaissance across AWS, Azure, and GCP, and how to detect and defend.   #attack   #aws   #azure   #gcp   #monitor

The article describes exploiting multi-layered architecture discrepancies in Gemini to bypass Markdown sanitization. The researcher achieved image injection through linkification quirks and context bridges (Gemini-to-Colab), enabling workspace data exfiltration via indirect prompt injection despite existing protections.   #ai   #attack   #saas   #gcp

This article examines GitHub Actions security risks including secrets management failures, overprivileged tokens, dependency pinning issues, supply chain attacks via compromised actions, script injection, workflow injection through pull requests, artifact poisoning, and self-hosted runner compromise.   #ci/cd   #attack   #supply-chain

A curated list of annual cyber security reports.   None

How to manage AWS SSM Parameters with Terraform using the lifecycle "ignore_changes" meta-argument, allowing external processes to update parameter values without Terraform reverting them on subsequent applies.   #aws   #terraform   #iac   #build

A post which critiques security vendor research practices, identifying four common pitfalls: using fear-based marketing tactics, falsely claiming novelty while ignoring prior work, making unsupported statistical correlations, and compromising editorial integrity for marketing purposes.   #process   #strategy

GitHub announces security changes to pull_request_target event and environment protection rules, effective December 8, 2025, to reduce vulnerabilities and make Actions more secure by default.   #announcement   #ci/cd   #defend

NCC Group conducted a 100 person-day security review of Google's Private AI Compute system across two phases, evaluating architecture, cryptography, attestation, IP-blinding relay, T-Log system, and frontend components to ensure cloud-based AI processing maintains local-only privacy guarantees.   #ai   #gcp   #attack   #defend

Steal cookies for Microsoft Teams.

A ready to use, minimal, customizable docker image designed to provide a lightweight and secure environment for browsing the web via VNC.

MacOS (& ios) Artifact Parsing Tool.

Static code analysis engine to find security issues in code.

Customers are no longer required to manually update accounts or re-register OUs when migrating accounts or making changes to their OU structure. When an account is moved to a new OU, AWS Control Tower automatically enrolls the account, applying the baseline configurations and controls from the new OU and removing those from the original OU.

AWS Backup now supports Amazon EKS, providing a fully managed, centralized solution to back up and restore Kubernetes clusters and application data without requiring custom scripts or third-party tools.

With this new capability, you can create an elliptic curve asymmetric KMS key or data key pairs to sign and verify EdDSA signatures using the Edwards25519 curve (Ed25519).

Google introduces Private AI Compute, a cloud AI processing platform combining Gemini models with on-device-level privacy protections. It uses hardware-secured enclaves, remote attestation, and encryption to ensure personal data remains inaccessible to anyone, including Google, while enabling faster, more capable AI experiences.