🚨 New Shai-Hulud-style npm attack hitting 25k+ repos and growing fast. Devs & CI/CD exposed via malicious preinstall. Wiz Research has detection + mitigation. Details: www.wiz.io/blog/shai-hu...

The day has come where we get to announce what we've been working on for the past year 😍 www.duckbillhq.com/blog/skyway-...

My favorite security story I've read this year 😂, a story of surprising turns by Alex Smolen: engseclabs.com/blog/raccoon...

Yuval Avrahami was ranked as the top Azure researcher by Microsoft this quarter! He has made a Kubernetes focused CTF for the Wiz Cloud Security Championship, check it out! cloudsecuritychampionship.com Also if you can find cloud zero days, check out www.zeroday.cloud with a $4.5M prize pool!

I feel like the biggest takeaway from the latest AWS outage is that there’s simply no architecting around them at this point. Even if you are 100% redundant/multi-whatever, your vendors and customers are certainly not. Order volume is dropping no matter what you do. We’re all in this together.

Jeep pushed a bad update on Friday that has been bricking 2024 Wrangle 4xe's. x.com/StephenGutow...

A company's website, API, and email were unavailable because "attackers socially engineered AWS into freezing its domain". www.theregister.com/2025/10/02/s...

Introducing ZERODAY.CLOUD🕵️‍♀️ Be the first to participate in the first-of-its-kind cloud hacking competition. 🤝 WIN HUGE PRIZES from our up to 4.5 million dollar prize pool. 💰🏆 Join us to help make the cloud a safer place. Register your exploit now >> zeroday.cloud

I really like the announcements that have been coming out of Cloudflare. In this latest one, SSO for everyone (not just enterprise). blog.cloudflare.com/enterprise-g... Another recent and interesting one is their data platform: blog.cloudflare.com/cloudflare-d...

After facing countless of limitation on #AWS #NitroEnclaves, the same feature is now available on normal EC2 instance. The coming month must be a busy month for me to try it out #ConfidentialComputing #AWSCloud aws.amazon.com/about-aws/wh...

S3 SOAP API is being deprecated in a month (Oct 31). docs.aws.amazon.com/AmazonS3/lat... h/t @quinnypig.com for pointing it out in @lastweekinaws.com

The first step toward an organization of organizations. aws.amazon.com/about-aws/wh...

Random thing I noticed which I don't think has value but I'm recording it anyway: S3 is known to have a global namespace which can be seen with the ":::" in the arn. Ex. arn:aws:s3:::amzn-s3-demo-bucket. But other global namespaces exist. 1/2

Gal Nagli has opened my eyes to a speed and scale of web hacking that would be terrifying if he wasn't using those skills to help companies. He has put together a CTF challenge to showcase some of his most effective techniques. Check it out! www.cloudsecuritychampionship.com/challenge/4

A write-up that believes this story is propaganda and might have just been for spam. cybersect.substack.com/p/that-secre...

The secret service found a setup for disrupting cell services in the NYC area. www.secretservice.gov/newsroom/rel...

GitHub's plan to better secure the npm supply chain: github.blog/security/sup...

Check out the full schedule here: fwdcloudsec.org/conference/... Not in Berlin? No worries, you can join us live on YouTube: www.youtube.com/live/-a9Ts7... It's going to be a packed day of sharp insights and real-world lessons for cloud security l33ts.

fwd:cloudsec Europe is now live from Berlin! Watch the livestream here: youtube.com/live/-a9Ts7A...

An interesting evolution in malware that occurred in roughly the past month is malware calling AI from the payload. We've seen malware and other artifacts (ex. phishing emails) as the OUTPUT of AI, but now malware is bringing the INPUT to AI. 1/2

How do you know you're compromised? Read my newest article to see how we used canary tokens to detect an attack on our infrastructure. grafana.com/blog/2025/08...

Netskope filing for their IPO. From their S-1, $707M ARR with $354M annual net loss. www.sec.gov/Archives/edg...

Old and busted: Cloud attackers making noisy List/Describe calls. New hotness: Laundering enumeration calls through an AWS service silently. Or at least, that used to work, until @datadoghq.com partnered with AWS to close this gap. Read more here: securitylabs.datadoghq.com/articles/enu...

Working on a blog post: what AWS things aren’t true anymore, but used to be? Example: I still get surprised that I don’t have to shut down an ec2 instance to change its security group.

Introducing... 🥁 Say hello to Wiz for Exposure Management! 🥳 Wiz for Exposure Management is a NEW way to unify, prioritize, and fix exposures everywhere it lives: in your cloud, code, and on-prem infrastructure. Learn more: www.wiz.io/blog/wiz-for...

It's great to see Microsoft continue to invest in a public bug bounty program for their cloud. One cloud provider does not have this. msrc.microsoft.com/blog/2025/08...

AWS growth at 17.5% is healthy but represents a slight deceleration from the 19% growth seen in Q2 2024. Margins fell 35.5% to 32.9% YoY despite charging profane rates for new things ($9 per resource per month that IAM Internal Access Analyzer watches?!)

The AWS Golang SDK has reached end of support. It is no longer being updated. You need to use v2 of the SDK. github.com/aws/aws-sdk-go

8,400+ public GCP images were scanned and no secrets found! This contrasts with the many secrets found in public AWS AMIs and Azure Public images. Interesting to consider why this is. Only marketplace vendors and approved publishers can make images public in GCP. trufflesecurity.com/blog/guest-p...

The second challenge in our monthly CTF series is out! This time focused on a container escape.

New development in the Q Developer extension backdoor: An open question was, how did the threat actor get write permissions to the repo? Turns out they stole a token via this technique. aws.amazon.com/security/sec...

I really like that Google has created OSS Rebuild. In my experience of having tried to do something similar for a single application, it's a hard problem to confirm that source code matches the release artifacts. h/t tldrsec for linking to it. security.googleblog.com/2025/07/intr...

EC2's do a graceful shutdown when you terminate them, which is usually unwanted because you pay by the second so it'd be better if they just ripped the plug out of the wall. Now you can with the skipOsShutdown parameter. github.com/boto/botocor...

New: a hacker compromised a version of Amazon's Q AI agent, added commands to 'wipe' computers, then Amazon released it. Unclear if wipe effective; hacker did it to prove point. “Ruthless corporations leave no room for vigilance among their over-worked developers.” www.404media.co/hacker-plant...

Every high performing engineering team is convinced their stuff secretly sucks. Not just relentless obsession with improvement, but actual shame and resentment about what holds their system together.

The movie "The map of tiny perfect things" is under-rated and is the best Amazon Original. There are levels to that movie.

Now that AWS fixed the free tier, I think the next biggest technical absurdity, in terms of a thing that seems like a decision made outside of technical considerations, is how you can't move an S3 bucket between accounts.

The free tier is finally free in the way most expect. "new customers can explore AWS's extensive portfolio of services without incurring costs" Finally you can try out AWS without worrying about a huge billing surprise. aws.amazon.com/about-aws/wh...

A new long lived secret for AWS has appeared: Bedrock API keys. aws.amazon.com/blogs/machin...

As threat actors pursue LLMJacking more and more (as Permiso found), I’m curious when we’ll see them abusing customer service/customer facing apps. Stealing cloud credentials and using them is hard. Why not just jailbreak LLMs used in web apps for your nefarious purposes?

Two interesting open-source tools for AWS IAM discussed at @fwdcloudsec.org . - David Kerber with iam.cloudcopilot.io www.youtube.com/watch?v=j0YT... - Nick Siow with nsiow.github.io/yams/ www.youtube.com/watch?v=nkLN...

Day 2 of fwd:cloudsec North America 2025 begins in half an hour! Catch the live-streams here: - www.youtube.com/live/si9qVVx... - www.youtube.com/live/0BTBK33... Schedule: fwdcloudsec.org/conference/n...

Folks coming to fwd:cloudsec, my face looks different: I have a beard. Come find me and let's chat about the new CTF I put together. lnkd.in/geRrC3aN

I had a lot of fun making this challenge. I wanted to do a cloud security challenge where the cloud infrastructure is secure (IMDSv2, data perimeters), but something still allows it to be hackable and you need to know some advanced AWS security tricks to abuse it. 🤫 Try it out!

A fun way in which data governance assumptions can break with AWS is local zones. Say you SCP restrict regions to us-east-1 only. Now everything is going to stay in Northern Virginia.... right? Well, Local Zones also allows usage of Mexico, Chile, Peru, and Argentina as those are all in us-east-1.

You can rename S3 objects now... but only in S3 Express One Zone. I thought One Zone was a subset of S3 functionality, but it's overlapping circles now. Also interesting that you can use this to overwrite existing objects. aws.amazon.com/about-aws/wh...

> We've set up a web endpoint so vetted ... security researchers can submit suspected exposed credentials for review > To report exposed Google Cloud credentials, please contact [email protected] cloud.google.com/blog/product... really buried the lede!

For those that have strong opinions on whether AWS should include more info in error messages, this update is relevant. You'll now know what type of policy prevented the access when the principal and S3 bucket are in the same org. aws.amazon.com/about-aws/wh...

More post-quantum crypto is now GA in AWS KMS. Both ML-KEM (key encapsulation) and ML-DSA (signature algorithm) are now available. aws.amazon.com/blogs/securi...

Google Cloud is taking a massive outage right now, globally. status.cloud.google.com Not to be outdone, so is CloudFlare. www.cloudflarestatus.com #hugops