Analysing "ConsentFix", a new browser-native attack technique detected in the wild, combining OAuth consent phishing with a ClickFix-style user prompt.   #attack   #saas

LinkedIn has modernized its Static Application Security Testing (SAST) capabilities to enhance security for its members by analyzing source code for vulnerabilities early in the development lifecycle. They rebuilt their SAST pipeline natively on GitHub Actions, integrating CodeQL and Semgrep scanners, and they also deviated from the default "paved path" approach.   #build   #ci/cd   #strategy

A deep dive into a GitHub security flaw where forked commits let attackers spoof dependencies. Understand the commit SHA issue and why package managers need API-level protection.   #attack   #supply-chain   #ci/cd

Docker made their Docker Hardened Images (DHI), a secure, minimal, production-ready set of images, freely available and open source to everyone who builds software.   #containers   #supply-chain   #build   #announcement

This article explores OIDC and OAuth flows, examines common related attacks, and discusses practical hardening strategies.   #iam   #attack   #defend   #explain

The cookie crumbled when it expired, but the attack path didn't. Learn how BloodHound graph analysis and Azure Seamless SSO enabled pivoting into the cloud.   #azure   #attack   #iam

How to exploit misconfigured Kubernetes pods on AWS EKS using BishopFox's BadPods "everything-allowed" manifest. Shows container escape via chroot, lateral movement using nsenter, and cloud credential theft via IMDS.   #aws   #kubernetes   #containers   #attack

Documenting your Threat Models with HCL.

An AWS IAM Privilege Escalation Path Library. You can also refer to the companion blog post.

FireCrackManager is a MicroVM management daemon for Firecracker.

A researcher found four issues in Eurostar's public AI chatbot including guardrail bypass, unchecked conversation and message IDs, prompt injection leaking system prompts, and HTML injection causing self XSS.

Check this post to find out what a Task Injection attack is, how this type of attack differs from Prompt Injection, and how it is particularly relevant to AI agents designed for a wide range of actions and tasks.

Aikido Security discovered "PromptPwnd," a novel vulnerability class affecting GitHub Actions and GitLab CI/CD pipelines integrated with AI agents. Attackers inject malicious prompts through untrusted input (issues, PRs) to manipulate AI agents with privileged access, leaking secrets or compromising workflows. At least five Fortune 500 companies impacted.

Starting on April 6, 2026, AWS will be changing how server-side encryption with customer-provided keys (SSE-C) is enabled for Amazon S3 buckets. With this change, SSE-C will be disabled by default on all new S3 general purpose buckets.

"Don't trust, verify" guides how Google secures their entire software supply chain. Here's how they use Binary Authorization to ensure that every component meets security best practices and standards.