Tagged “security”
21 posts
Cloud roundup: macOS Screen Sharing bug now under attack
A patched macOS Screen Sharing flaw is being exploited to plant crypto miners, a Windows Defender bypass has no fix yet, and EC2 gets built-in app health checks.
Cloud roundup: S3 finally names the policy that denied you
AWS S3 access-denied errors now name the exact policy ARN, Client VPN gets a scriptable CLI, and OpenAI ships authorized offensive-security models on Bedrock.
The Capital One breach: an SSRF bug into 100M records
A misconfigured WAF and an SSRF bug let an attacker reach the AWS metadata service and steal role credentials — exposing 100M+ Capital One records.
Cloud roundup: 153GB LiteLLM breach exposes cloud secrets
A leaked 153GB credential archive ties March's LiteLLM breach to 2,488 orgs including AWS and Cisco, plus new EKS control-plane and OpenSearch pricing changes.
Cloud roundup: Metabase CVSS 10 SQLi confirmed exploited
A CVSS 10 Metabase SQLi is now confirmed exploited and in CISA KEV, plus an exploited Cisco ASA/FTD DoS bug and Microsoft's Patch Tuesday zero-day.
Cloud roundup: New ransomware exploits N-central bug
Microsoft ties new StormEncryptor ransomware to an N-able N-central auth bypass, plus new AWS EC2 health checks and DRS UEFI support for Linux failovers.
Cloud roundup: LoadMaster RCE hits its KEV deadline today
A critical unauthenticated Progress LoadMaster RCE hits its federal KEV remediation deadline today, plus a CVSS 10 Metabase zero-day and AWS supply chain security news.
Scoping IAM Policies with Tag, IP, and MFA Conditions
A practical guide to IAM condition keys — aws:ResourceTag, aws:SourceIp, and MFA presence — with JSON examples and the Deny-with-exceptions gotchas that trip people up.
Service spotlight: querying years of audit history with CloudTrail Lake
How CloudTrail Lake lets you SQL-query months of API activity without standing up Athena and Glue yourself, and where its pricing model changes the calculus.
Service spotlight: wiring automatic rotation into Secrets Manager
How Secrets Manager rotation actually works end to end with the Lambda rotator pattern for RDS, and the failure modes that leave a secret half-rotated.
Service spotlight: SSH-less, bastion-less EC2 access with SSM
How Systems Manager Session Manager replaces bastion hosts and open SSH ports with IAM-authenticated, logged shell access, and where the agent still trips people up.
CVE-2026-16812: a CVSS 10 hole in your SD-WAN control plane
An unauthenticated command injection in Arista VeloCloud Orchestrator On-Prem lets attackers pivot from one exposed console to every edge device it manages.
CVE-2025-30066: The GitHub Action Tag You Trusted Lied
A compromised maintainer token let attackers rewrite tj-actions/changed-files version tags, dumping CI/CD secrets from thousands of repos into public build logs.
CVE-2025-0282: the Ivanti VPN zero-day, and its sequel
A stack-based buffer overflow in Ivanti Connect Secure let Chinese state hackers run a malware ecosystem on VPN gateways for weeks before anyone noticed.
Java deserialization after Log4Shell: CVE-2023-46604
Apache ActiveMQ's unauthenticated RCE shows Java deserialization bugs never went away after Log4Shell — only the exploitation playbook got faster.
Exposed Kubernetes API Servers Are an RBAC Time Bomb
Attackers are actively hunting internet-facing Kubernetes API servers with anonymous-auth on and default service accounts holding broad RBAC access.
Leaked credentials in public repos get used in minutes
GitGuardian logged 28.65M secrets on public GitHub in 2025, and researchers have watched leaked AWS keys get abused in under five minutes.
MOVEit and the MFT zero-day exploitation playbook
CVE-2023-34362 turned one SQL injection in MOVEit Transfer into 2,700+ breached organizations — and the same pattern keeps repeating against MFT software.
The 198M-voter S3 leak that still explains most breaches
A 2017 misconfigured S3 bucket exposed 198 million voter records, and the same public-bucket misconfiguration still causes new breaches every year.
CVE-2024-21626 and runc's shared-kernel blast radius
A leaked file descriptor in runc, and a fresh 2025 trio of procfs races, show what "container isolation" really guarantees — and what it doesn't.
Cloud roundup: unauthenticated TeamCity RCE now in KEV
A critical unauthenticated TeamCity RCE hits the CISA KEV list, plus Tomcat and Langflow exploitation and a nice AWS Lambda bandwidth bump.