A practitioner's guide to log visibility, incident readiness, and threat hunting across the major version control services.

A guide to evidence sources, logging, and retention across ChatGPT Workspace, the API Platform, and agentic workloads.

Microsoft Threat Intelligence examines attacks on exposed AI workloads, including LiteLLM gateway exploitation, credential harvesting, persistence, and cryptomining activity.

Aurora ransomware (active since April 2026) deploys a Linux/ESXi encryptor using ChaCha20+RSA-4096, kills VMs via esxcli before encrypting VMDK files, and abuses Cursor Agent (Claude Sonnet) to conduct hands-on exploitation across ten victim organizations. Russian-language operator instructions prohibited DCSync, account lockouts, and adding domain computer objects.

A multi-stage indirect prompt injection attack against Claude Code Opus 5 in Auto Mode achieved 60-80% RCE success via HTTP 415 trickery, ZIP-delivered Python module shadowing (struct.py), and C2 callbacks.

A prompt injection flaw in Amazon Kiro IDE v0.7.45 allowing attacker-controlled repository content to exfiltrate sensitive data via the powersRecommendationUrl setting and Kiro Powers, exploitable in both trusted and untrusted workspaces.

Datadog Security Research observed a password spraying campaign targeting AWS root user accounts across 150+ organizations, attempting unauthorized authentication against these high-privilege accounts.

Two Vertex AI privilege escalation paths let holders of aiplatform.customJobs.create or aiplatform.reasoningEngines.create steal highly privileged Google-managed service agent tokens, reaching project-editor-equivalent access. Google's response: add documentation warnings instead of patching.

Nix-powered agentic reverse engineering environment.

A modular, stack-agnostic toolkit of security review skills for AI coding agents to autonomously find, reproduce, and patch vulnerabilities.

AI/ML and Generative AI Security Assessment Framework for AWS. Automatically audit Amazon Bedrock and SageMaker & AgentCore workloads for security best practices.

AWS Management Console Private Access is now GA, routing all console traffic (auth, static assets, service APIs) through AWS PrivateLink VPC endpoints with no internet path required. VPC endpoint policies and Sign-In RCPs enforce identity, resource, and network perimeter controls on interactive console sessions.

A walkthrough deploying two AWS CDK stacks for IAM Identity Center governance: a reporting stack (EventBridge, Step Functions, Lambda, DynamoDB, API Gateway, S3) for automated daily discovery and CSV export, and a remediation stack for real-time event-driven enforcement and SNS notifications on non-compliant application assignments.