Tagged “security”
42 posts
Storm-0558: When a Stolen Signing Key Forges Any Token
A single stolen token-signing key let attackers mint valid cloud identities and read email in about 25 organizations. Root cause, blast radius, and what to do about your own keys.
CircleCI Breach: Stolen Session Cookies and Your CI Secrets
One infected engineer laptop, one stolen SSO session, and every customer secret in CircleCI was in play. What failed, the blast radius, and how to make CI secrets cheap to rotate.
The chalk/debug npm Compromise: Anatomy of a Package Hijack
One phished maintainer turned 18 ubiquitous npm packages into a crypto-stealing payload in about two hours. Here is how it worked and the build-pipeline controls that blunt it.
Snowflake Customer Breaches: Why Passwords Without MFA Still Lose
The 2024 Snowflake customer data thefts needed no exploit, just stolen credentials and no MFA. Root cause, blast radius, and a phishing-resistant MFA rollout plan.
Browser Extension Supply Chain Attacks: Trusted Update, Hostile Code
The Cyberhaven extension compromise showed how one phished developer account turns a trusted browser extension into a session-token thief — and how to defend against it.
CVE-2026-21580: Confluence XSS That Skips Straight to Admin
An unauthenticated stored XSS in Confluence Data Center and Server chains into privilege escalation, turning your internal wiki into a path to full instance takeover.
CVE-2026-72898: Metabase Bug Nobody Escalated Hit 1M Users
An unauthenticated SQL injection in Metabase's password-reset endpoint gave attackers admin access — and an unread advisory turned it into a million-record breach.
Malicious Docker Hub Images Are Hiding in Plain Sight
Typosquatted and trojanized public container images have quietly served cryptominers and backdoors for years — why registry pulls need the same scrutiny as package installs.
DNS Hijacking Doesn't Need a Zero-Day, Just Your Registrar Login
A hijacked registrar or Route 53 account lets an attacker redirect your whole domain silently — how it happens, why TLS makes it worse, and how to detect and recover fast.
The IAM Permissions That Quietly Grant Admin, One Hop at a Time
A handful of ordinary-looking AWS IAM permissions combine into full account takeover — the policy chains attackers look for first, and how to close them.
Shai-Hulud Turns Your Own Laptop Into a GitHub Actions Runner
The Shai-Hulud npm worm backdoors developer machines by registering them as self-hosted GitHub Actions runners, then uses GitHub Discussions as its command channel.
Delete a Bucket, Steal the Data: Cross-Cloud Namespace Risk
Bucket names are globally unique but ownership is not permanent — new research shows deleting and re-registering one silently hijacks AWS, GCP, and Azure data pipelines.
MLflow SSRF (CVE-2026-64849): a validate-then-fetch bug
An unauthenticated SSRF in MLflow's webhook tester bypasses its own IP allowlist via redirects and DNS rebinding, reaching cloud metadata for live credentials.
SharePoint's JWT bug let anyone forge an admin, no password needed
CVE-2026-55040 chained four separate JWT validation failures into unauthenticated admin impersonation on any on-prem SharePoint farm — here's the root cause and what to check now.
The Azure SRE Agent bug that let attackers borrow its identity
CVE-2026-62830 broke the on-behalf-of flow in Microsoft's autonomous ops agent, letting a low-privileged attacker inherit every permission the agent had across your Azure estate.
CVE-2026-59310: a syslog bug that became vCenter RCE
A directory-traversal flaw in vCenter's Syslog server let unauthenticated attackers drop a reverse-SSH backdoor, compromising 361 hosts in 47 countries within days of disclosure.
The Okta breach that hit BeyondTrust, 1Password, and Cloudflare
A stolen support-system session cookie let attackers pull HAR files full of live session tokens from Okta, turning a single compromise into breaches at at least four downstream customers.
CVE-2024-21762: FortiOS RCE that needed no login at all
A heap out-of-bounds write in FortiOS SSL-VPN let unauthenticated attackers run code as root — and 150,000 devices were still exposed when it went public.
ESXiArgs: a 2-year-old ESXi bug, then a global ransomware wave
CVE-2021-21974 sat patched and ignored for two years until ESXiArgs used it to ransom thousands of internet-exposed VMware ESXi hosts at once.
Citrix Bleed: how a memory leak beat MFA outright
CVE-2023-4966 let attackers steal live NetScaler session tokens and walk straight past authentication and MFA — no credentials needed at all.
Cloud roundup: macOS Screen Sharing bug now under attack
A patched macOS Screen Sharing flaw is being exploited to plant crypto miners, a Windows Defender bypass has no fix yet, and EC2 gets built-in app health checks.
SCARLETEEL and the case against trusting Terraform state
A cloud intrusion pivoted through a plaintext AWS key sitting in an exposed terraform.tfstate file — why state was never designed to be a secret store.
Cloud roundup: S3 finally names the policy that denied you
AWS S3 access-denied errors now name the exact policy ARN, Client VPN gets a scriptable CLI, and OpenAI ships authorized offensive-security models on Bedrock.
The Capital One breach: an SSRF bug into 100M records
A misconfigured WAF and an SSRF bug let an attacker reach the AWS metadata service and steal role credentials — exposing 100M+ Capital One records.
Cloud roundup: 153GB LiteLLM breach exposes cloud secrets
A leaked 153GB credential archive ties March's LiteLLM breach to 2,488 orgs including AWS and Cisco, plus new EKS control-plane and OpenSearch pricing changes.
Cloud roundup: Metabase CVSS 10 SQLi confirmed exploited
A CVSS 10 Metabase SQLi is now confirmed exploited and in CISA KEV, plus an exploited Cisco ASA/FTD DoS bug and Microsoft's Patch Tuesday zero-day.
Cloud roundup: New ransomware exploits N-central bug
Microsoft ties new StormEncryptor ransomware to an N-able N-central auth bypass, plus new AWS EC2 health checks and DRS UEFI support for Linux failovers.
Cloud roundup: LoadMaster RCE hits its KEV deadline today
A critical unauthenticated Progress LoadMaster RCE hits its federal KEV remediation deadline today, plus a CVSS 10 Metabase zero-day and AWS supply chain security news.
Scoping IAM Policies with Tag, IP, and MFA Conditions
A practical guide to IAM condition keys — aws:ResourceTag, aws:SourceIp, and MFA presence — with JSON examples and the Deny-with-exceptions gotchas that trip people up.
Service spotlight: querying years of audit history with CloudTrail Lake
How CloudTrail Lake lets you SQL-query months of API activity without standing up Athena and Glue yourself, and where its pricing model changes the calculus.
Service spotlight: wiring automatic rotation into Secrets Manager
How Secrets Manager rotation actually works end to end with the Lambda rotator pattern for RDS, and the failure modes that leave a secret half-rotated.
Service spotlight: SSH-less, bastion-less EC2 access with SSM
How Systems Manager Session Manager replaces bastion hosts and open SSH ports with IAM-authenticated, logged shell access, and where the agent still trips people up.
CVE-2026-16812: a CVSS 10 hole in your SD-WAN control plane
An unauthenticated command injection in Arista VeloCloud Orchestrator On-Prem lets attackers pivot from one exposed console to every edge device it manages.
CVE-2025-30066: The GitHub Action Tag You Trusted Lied
A compromised maintainer token let attackers rewrite tj-actions/changed-files version tags, dumping CI/CD secrets from thousands of repos into public build logs.
CVE-2025-0282: the Ivanti VPN zero-day, and its sequel
A stack-based buffer overflow in Ivanti Connect Secure let Chinese state hackers run a malware ecosystem on VPN gateways for weeks before anyone noticed.
Java deserialization after Log4Shell: CVE-2023-46604
Apache ActiveMQ's unauthenticated RCE shows Java deserialization bugs never went away after Log4Shell — only the exploitation playbook got faster.
Exposed Kubernetes API Servers Are an RBAC Time Bomb
Attackers are actively hunting internet-facing Kubernetes API servers with anonymous-auth on and default service accounts holding broad RBAC access.
Leaked credentials in public repos get used in minutes
GitGuardian logged 28.65M secrets on public GitHub in 2025, and researchers have watched leaked AWS keys get abused in under five minutes.
MOVEit and the MFT zero-day exploitation playbook
CVE-2023-34362 turned one SQL injection in MOVEit Transfer into 2,700+ breached organizations — and the same pattern keeps repeating against MFT software.
The 198M-voter S3 leak that still explains most breaches
A 2017 misconfigured S3 bucket exposed 198 million voter records, and the same public-bucket misconfiguration still causes new breaches every year.
CVE-2024-21626 and runc's shared-kernel blast radius
A leaked file descriptor in runc, and a fresh 2025 trio of procfs races, show what "container isolation" really guarantees — and what it doesn't.
Cloud roundup: unauthenticated TeamCity RCE now in KEV
A critical unauthenticated TeamCity RCE hits the CISA KEV list, plus Tomcat and Langflow exploitation and a nice AWS Lambda bandwidth bump.