BeyondTrust Phantom Labs recently identified a critical command injection vulnerability in OpenAI Codex that allowed for the theft of GitHub User Access Tokens.

Post which discusses how to leverage Claude Code to produce digestible output that helps up better understand analyzed code base while surfacing secure and insecure coding patterns.

Unit 42 researchers found that GCP Vertex AI Agent Engine's default P4SA service account has excessive permissions, enabling credential theft via the metadata service. This allows privilege escalation to read all consumer GCS buckets, access restricted Google-internal Artifact Registry container images, and expose internal source code.

How TeamPCP are leveraging stolen secrets from the recent supply chain attacks to compromise cloud environments.

A compromised axios maintainer account published malicious [email protected] and [email protected] to npm on March 31, 2026. Both injected a phantom dependency ([email protected]) that executes a postinstall RAT dropper targeting macOS, Windows, and Linux, contacting C2 at sfrclak.com:8000, then self-destructs to evade forensic detection.

EvilTokens is a Microsoft device code PhaaS (active since Feb 2026) that harvests OAuth access/refresh tokens, auto-converts them to PRTs, and supports full BEC post-exploitation (Outlook, Graph, SharePoint, Azure). Over 1,000 domains identified; campaigns globally targeting finance, HR, and logistics sectors.

Mercari migrated a legacy image pipeline to Cloudflare Images, preserving existing URLs. Key challenges addressed: S3 HTTPS access via host-header-style routing, image quality/egress cost validation (adjusting quality settings), and zero-downtime rollout using regex-based deterministic traffic ramping with cache rebuild monitoring.

Learn how to enforce AI governance across AWS organizations using Bedrock guardrails, MCP server controls, model availability rules, and API restrictions to reduce risk and improve security.

Audit content (pdfs, media files, images) sensitivity on urls.

Collection of npm package manager Security Best Practices.

API security testing framework for REST, GraphQL, and gRPC that validates authorization logic using role-based testing and YAML-driven templates. You can also check out the companion blog post.

Check your AWS CLI commands for security risks before you run them.

How to use session policies to dynamically scope down IAM permissions for your Kubernetes pods without creating additional IAM roles.

AWS Security Agent on-demand penetration testing is now GA, offering autonomous 24/7 multi-cloud pen testing combining SAST, DAST, and context-aware agentic AI.

Google Drive's ransomware detection and file restoration are now GA (March 30, 2026). The updated AI model detects 14x more infections than beta. Drive for desktop pauses sync on detection; users can bulk-restore files. Available across Business Standard+, Enterprise, and Education tiers.