2068
All about cloud security Contacts: @AMark0f @dvyakimov About DevSecOps: @sec_devops
🔶🤖 Building an AI-powered defense-in-depth security architecture for serverless microservices
This AWS blog demonstrates implementing a seven-layer AI-powered defense-in-depth security architecture for serverless microservices using AWS Shield, WAF, Cognito, API Gateway, VPC, Lambda, Secrets Manager, and DynamoDB, enhanced with GuardDuty and Amazon Bedrock for intelligent threat detection and automated response.
https://aws.amazon.com/ru/blogs/security/building-an-ai-powered-defense-in-depth-security-architecture-for-serverless-microservices/
(Use VPN to open from Russia)
#aws #AI
🤖 augustus
LLM security testing framework for detecting prompt injection, jailbreaks, and adversarial attacks. See also the companion blog post.
https://github.com/praetorian-inc/augustus
#AI
🤖 Manipulating AI memory for profit: The rise of AI Recommendation Poisoning
That helpful “Summarize with AI” button? It might be secretly manipulating what your AI recommends. Microsoft security researchers have discovered a growing trend of AI memory poisoning attacks used for promotional purposes, a technique they called "AI Recommendation Poisoning".
https://www.microsoft.com/en-us/security/blog/2026/02/10/ai-recommendation-poisoning/
#AI
🤖 Threat modeling agentic AI: a scenario-driven approach
A practical workflow for threat modeling agentic AI systems: use a five-zone navigation lens to trace attack paths, formalize them as attack trees, and map to OWASP's threat taxonomy and playbooks.
https://christian-schneider.net/blog/threat-modeling-agentic-ai/
#AI
👀 Building Slack’s Anomaly Event Response
This article introduces Slack's Anomaly Event Response (AER), an automated security system that detects suspicious activities and terminates user sessions in real-time, reducing detection-to-response gaps from hours to minutes.
https://slack.engineering/building-slacks-anomaly-event-response/
#monitor
🔴 Google Looker RCE vulnerabilities: Patch now
Tenable Research discovered two novel vulnerabilities in Google Looker that could allow an attacker to completely compromise a Looker instance.
https://www.tenable.com/blog/google-looker-vulnerabilities-rce-internal-access-lookout
#gcp
🤖 AI-Assisted Development at Block
Block's AI engineering approach includes: 95% of engineers using AI assistants, providing freedom to explore multiple tools, launching an AI Champions program focused on repo readiness and context engineering, implementing automated PRs, and planning team-based workshops for multi-agent workflows.
https://engineering.block.xyz/blog/ai-assisted-development-at-block
#AI
⚙ We should all be using dependency cooldowns
Dependency cooldowns delay automatic dependency updates, providing a free and effective mitigation against most open source supply chain attacks. Tools like Dependabot and Renovate support configurable cooldown periods before adopting new dependency versions.
https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns
(Use VPN to open from Russia)
#cicd
⚙️ Kubernetes Remote Code Execution Via Nodes/Proxy GET Permission
An authorization bypass in Kubernetes RBAC allows for nodes/proxy GET permissions to execute commands in any Pod in the cluster.
https://grahamhelton.com/blog/nodes-proxy-rce
(Use VPN to open from Russia)
#kubernetes
👩💻 A new era of agents, a new era of posture
Microsoft Defender introduces AI Security Posture Management for multi-cloud environments, providing visibility and contextual risk assessment across AI agent architectures. It identifies agents connected to sensitive data, susceptible to indirect prompt injection attacks, and operating as coordinators, while offering attack path analysis and actionable hardening recommendations.
https://www.microsoft.com/en-us/security/blog/2026/01/21/new-era-of-agents-new-era-of-posture/
#azure
🔶 CodeBreach: Infiltrating the AWS Console Supply Chain and Hijacking AWS GitHub Repositories via CodeBuild
Wiz Research discovered a critical supply chain vulnerability that abused a CodeBuild misconfiguration to take over key AWS GitHub repositories, including the JavaScript SDK powering the AWS Console.
https://www.wiz.io/blog/wiz-research-codebreach-vulnerability-aws-codebuild
#aws
⚙ Kubernetes v1.35: Restricting executables invoked by kubeconfigs via exec plugin allowList added to kuberc
Kubernetes v1.35 introduces beta support for restricting credential plugin executables via kuberc configuration. Users can set "credentialPluginPolicy" to AllowAll, DenyAll, or Allowlist, with an optional "credentialPluginAllowlist" to specify permitted binaries, enhancing security against supply-chain attacks.
https://kubernetes.io/blog/2026/01/09/kubernetes-v1-35-kuberc-credential-plugin-allowlist/
#kubernetes
🔶 Unauthenticated Cluster Takeover in AWS ROSA
A critical vulnerability in AWS ROSA Classic allowed unauthenticated attackers to discover clusters via Certificate Transparency logs, extract cluster UUIDs and owner emails from unauthenticated endpoints, initiate unauthorized cluster transfers, and escalate to AWS account access through ROSA's IAM roles.
https://blog.ryanjarv.sh/2026/01/05/unauth-aws-rosa-cluster-takeover.html
(Use VPN to open from Russia)
#aws
🔶 BadPods Series: Everything Allowed on AWS EKS
How to exploit misconfigured Kubernetes pods on AWS EKS using BishopFox's BadPods "everything-allowed" manifest. Shows container escape via chroot, lateral movement using nsenter, and cloud credential theft via IMDS.
https://cybersecnerds.com/badpods-series-everything-allowed-on-aws-eks/
#aws
👩💻 nOAuth Abuse Update: Potential Pivot into Microsoft 365
Vulnerable SaaS apps could enable attackers to pivot back into Microsoft 365, endangering your entire Microsoft 365 estate.
https://www.semperis.com/blog/noauth-abuse-update-pivot-into-microsoft-365/
#azure
🤖 3 Principles for Designing Agent Skills
Block Engineering discusses designing agent skills using three principles: make deterministic outputs script-based, let agents handle interpretation and conversation, and write explicit constitutional constraints. Skills codify tribal knowledge into executable documentation for AI agents across their organization.
https://engineering.block.xyz/blog/3-principles-for-designing-agent-skills
#AI
🏗 Encrypting Files with Passkeys and age
A post explaining how to encrypt files with passkeys, using the WebAuthn prf extension and the TypeScript age implementation.
https://words.filippo.io/passkey-encryption
#build
🔐 Standardizing Privileged Access Architecture for Multi-Cloud
This white paper examines the risks and attack vectors inherent in hybrid multi-cloud infrastructures, and analyzes various attack paths observed by Mandiant in real-world multi-cloud scenarios.
#iam
🤖 From Automation to Infection: How OpenClaw AI Agent Skills Are Being Weaponized
The fastest-growing personal AI agent ecosystem just became a new delivery channel for malware. Over the last few days, VirusTotal has detected hundreds of OpenClaw skills that are actively malicious.
https://blog.virustotal.com/2026/02/from-automation-to-infection-how.html
#AI
🔐 Blog: A Beginners Guide: Cross-Device Passkeys
Find out more about how passkeys can be used across devices using a mechanism called Hybrid transport.
https://bughunters.google.com/blog/passkeys
#iam
👩💻 Weaponizing Whitelists: An Azure Blob Storage Mythic C2 Profile
Mature enterprises lock down egress but often carve out broad exceptions for trusted cloud services. This post shows how reviewing deployment guides can help identify those exceptions and weaponize them with a new Mythic C2 profile called azureBlob.
https://specterops.io/blog/2026/01/30/weaponizing-whitelists-an-azure-blob-storage-mythic-c2-profile/
#azure
⚙️ Stealing Salesforce OAuth Tokens using the WAF
This post details a method for stealing Salesforce OAuth tokens by exploiting an XSS vulnerability and leveraging the Cloudflare Web Application Firewall (WAF).
https://castilho.sh/salesforce-oauth-ato
#saas
⚙️ Kube-Policies BinauthZ: Closing the Supply Chain Gap in Kubernetes
Block's BinauthZ plugin extends their OPA-based admission controller to cryptographically verify container image signatures and attestations at Kubernetes admission time, enforcing SLSA using Sigstore/cosign with AWS KMS.
https://engineering.block.xyz/blog/kube-policies-binauthz-closing-the-supply-chain-gap-in-kubernetes
#kubernetes
⚙ Running Renovate as a GitHub Action (and NO PAT!)
A post explaining how you can run Renovate as a GitHub Action without needing a GitHub Personal Access Token by using Octo STS.
https://www.chainguard.dev/unchained/running-renovate-as-a-github-action
#cicd
👩💻 Linking Privileged Accounts to Identities in Microsoft Defender: Benefits & Use Cases
Microsoft Defender for Identity now allows linking multiple accounts to a single identity, by correlating accounts from different identity providers or linking distinct user accounts, crucial for incident response and remediation.
https://www.cloud-architekt.net/linking-privileged-accounts-in-defender/
#azure
⚙️ Kubernetes v1.35: A Better Way to Pass Service Account Tokens to CSI Drivers
Kubernetes 1.35 introduces beta support for CSI drivers to receive service account tokens via the "secrets" field instead of "volume_context", preventing accidental token logging.
https://kubernetes.io/blog/2026/01/07/kubernetes-v1-35-csi-sa-tokens-secrets-field-beta/
#kubernetes
⚙ A Brief Deep-Dive into Attacking and Defending Kubernetes
This article covers Kubernetes attack and defense techniques. Explores Kubernetes components (API Server, ETCD, kubelet), attack vectors including unauthenticated API access, RBAC misconfigurations, ServiceAccount token abuse, malicious admission controllers, CoreDNS poisoning, writable volume mounts, ETCD compromise, and certificate authority exploitation.
https://heilancoos.github.io/research/2025/12/16/kubernetes.html
#kubernetes
🔶 pathfinding cloud
An AWS IAM Privilege Escalation Path Library. You can also refer to the companion blog post.
https://github.com/DataDog/pathfinding.cloud
#aws
👩💻 Azure Seamless SSO: When Cookie Theft Doesn’t Cut It
The cookie crumbled when it expired, but the attack path didn't. Learn how BloodHound graph analysis and Azure Seamless SSO enabled pivoting into the cloud.
https://specterops.io/blog/2025/12/11/azure-seamless-sso-when-cookie-theft-doesnt-cut-it/
#azure
🔶 What is EC2 Instance Attestation
EC2 Instance Attestation extends attestable scope from Nitro Enclaves' container environment to entire EC2 instances, enabling greater capabilities like GPU access. However, it requires proactive hardening versus Enclaves' secure-by-default design and more complex deployment through Attestable AMIs.
https://blog.richardfan.xyz/2025/12/18/what-is-ec2-instance-attestation.html
#aws