Wiz Research discovered a critical supply chain vulnerability that abused a CodeBuild misconfiguration to take over key AWS GitHub repositories, including the JavaScript SDK powering the AWS Console.   #aws   #ci/cd   #attack

GitHub removed outdated emergency mitigations that incorrectly blocked legitimate users, highlighting the need for better observability and lifecycle management of defense systems.   #defend   #monitor   #process

A post explaining OAuth2 through a simplified flow.It covers authorization requests, redirect URIs, scopes, state parameters, and security considerations.   #explain   #iam   #saas

Microsoft Defender for Identity now allows linking multiple accounts to a single identity, by correlating accounts from different identity providers or linking distinct user accounts, crucial for incident response and remediation.   #azure   #iam   #monitor

A post explaining how you can run Renovate as a GitHub Action without needing a GitHub Personal Access Token by using Octo STS.   #ci/cd   #build

The Claude Agent Skill for Terraform and OpenTofu - testing, modules, CI/CD, and production patterns.

Open-source offensive security platform for conducting phishing campaigns that weaponizes iCalendar automatic event processing. - ineesdv/Tangled.

A lightweight orchestrator for running multiple Claude Code agents on GitHub repositories.

A Swiss army knife for your daily Linux network plumbing.

A GitHub App that acts like a Security Token Service (STS) for the Github API.

This post documents requirements for logging the "CopilotInteraction" event, as well as some caveats of when it isn't logged. This event is key for Copilot audit trails. An App Insights alternative for logging interactions in Copilot Studio is also provided.

OpenCode, a popular open-source AI coding agent, suffered a severe CVE allowing arbitrary remote code execution (RCE). The vulnerability is significantly more dangerous and easier to exploit than typical RCE attacks, requiring less sophistication to compromise systems.

A critical vulnerability was discovered in an AI-assisted chat application, not through prompt injection, but via a misconfigured parameter in its integration with the AI backend.

Microsoft Defender introduces AI Security Posture Management for multi-cloud environments, providing visibility and contextual risk assessment across AI agent architectures. It identifies agents connected to sensitive data, susceptible to indirect prompt injection attacks, and operating as coordinators, while offering attack path analysis and actionable hardening recommendations.