SpecterOps reverse engineered Cortex XDR with LLMs to extract YARA rules, ML models, and behavioral detections.

Uber's blog post discusses the challenge of managing large-scale changes in a monorepo environment where thousands of microservices are automatically deployed. The key issue is minimizing the impact of bad changes that affect multiple services.

This post compares three AI agent identity models: acting as the user (simple but single-player), service account tokens (common in production but insecure), and SPIFFE-based workload identity (best but costly to implement). Covers governance plumbing like Okta XAA and cloud-provider managed options.

Threat actors impersonate AI brands (ChatGPT, Claude, DeepSeek, Copilot) in phishing, malvertising, and SEO-poisoning campaigns to steal credentials, credit card data, and deliver infostealers like Vidar. Storm-3075 and Fox Tempest are attributed actors using signed malware.

AWS IAM Identity Center now lets server-side apps exchange an IdP-issued OIDC token for user-scoped AWS credentials via CreateTokenWithIAM, ListAccounts, and GetRoleCredentials. Actions are attributed to the user in CloudTrail. Key gaps: no per-app scope restrictions and no application ARN in audit trails.

Send regular account status updates to a slack workspace.

Throwaway root shells in AWS Lambda Firecracker microVMs.

A community detection engineering resource organized around invariant prerequisites.

The AWS Workload Credentials Provider now supports two new features: IAM role chaining for cross-account secret retrieval via a single provider instance, and prefetching to pre-populate the in-memory cache at startup, reducing cold-start latency for latency-sensitive workloads.

Designed for agentic workloads, new capabilities in VPC Service Controls can help establish a network-level, destination-based perimeter.