WatchTowr researchers scraped 80,000+ saved entries from JSONFormatter and CodeBeautify sites, finding thousands of exposed credentials including AWS keys, Active Directory passwords, API tokens, and PII from governments, banks, MSSPs, and cybersecurity firms. Evidence suggests attackers already exploit this.   #defend   #supply-chain   #saas

Invictus IR received a suspicious BEC phishing email impersonating a pharmaceutical company, requesting a non-existent product. They investigated, tracking the threat actor's infrastructure, uncovering an AiTM phishing campaign using EvilProxy framework, targeting multiple industries through WeTransfer-delivered credential harvesting.   #attack   #saas

Socket Threat Research maps a rare inside look at OtterCookie's npm-Vercel-GitHub chain, adding 197 malicious packages and evidence of North Korean operators.   ""   #supply-chain   #attack

The new aws login command, designed to provide temporary credentials for local development, can be exploited by attackers for phishing, even bypassing phishing-resistant MFA.   ""   #attack   #aws

OpenAI is informing users about a security incident that occurred at Mixpanel, a third-party data analytics provider used for their API product's frontend interface. This breach was confined to Mixpanel's systems and did not affect OpenAI's infrastructure, nor were users of ChatGPT or other OpenAI products impacted.   #attack   #supply-chain

GitHub Actions' pull_request_target event will reference the default branch instead of PR base branch from Dec 8, 2025, preventing attackers from exploiting vulnerable workflows in unpatched branches targeting non-default branches.   #ci/cd   #supply-chain   #announcement

CVE-2025-52493 in PagerDuty Cloud Runbook exposed stored secrets (API keys, credentials) to authenticated admins through client-side DOM manipulation. Secrets were sent unmasked to browsers, protected only by password field masking, exploitable via simple HTML attribute changes.   #attack   #saas

A terminal-based AWS cost and resource dashboard which provides an overview of AWS spend by account, service-level breakdowns, budget tracking, and EC2 instance summaries.

A full-stack web application that provides a security-focused dashboard for analyzing Snyk audit logs.

LangGraph-powered forensic analysis workflow for OSQuery data processing and security investigation.

A CLI to edit GitHub Workflow and Composite action files and pin versions of Actions and Reusable Workflows.

An indirect prompt injection in an implementation blog can manipulate Antigravity to invoke a malicious browser subagent in order to steal credentials and sensitive code from a user's IDE.

Security researchers discovered CVE-2025-64755 in Claude Code by finding a sed expression parsing vulnerability that bypassed command validation regex checks, enabling arbitrary file writes and command execution through prompt injection.

MCP Apps is a proposed extension standardizing interactive UI support in Model Context Protocol. Enables servers to deliver embedded interfaces via predeclared HTML resources, uses MCP transport over postMessage, implements iframe sandboxing for security, and maintains backward compatibility.

CodeMender is an AI agent for code security that automatically validates patches through program analysis, testing, and multi-agent systems. It identifies root causes of vulnerabilities using debuggers and source code browsers.

AWS introduces network scanning guidelines for customer workloads to distinguish legitimate security scans from malicious activity.

AWS Secrets Manager introduces managed external secrets for third-party credentials like Salesforce, Snowflake, and BigID.

AWS announces VPC encryption controls, a new capability that helps organizations audit and enforce encryption in transit for all traffic within and across VPCs in a Region, simplifying compliance with regulatory frameworks like HIPAA, PCI DSS, and FedRAMP through automated monitoring and enforcement modes.

AWS introduces Attribute-Based Access Control (ABAC) for S3 general purpose buckets, enabling administrators to automatically manage permissions through tag-based policies that match tags between users, roles, and buckets—eliminating the need to constantly update IAM policies as organizations scale.