It pains me when I hear people say "I thought about submitting a talk to the fwd:cloudsec, but didn't because..." and the reasons are often things I actually want to see presentations on! Some talk ideas I personally want to watch (the other reviewers and I will fight ⚔️):

Tickets for fwd:cloudsec North America go on sale today, in about 4 hours, at 10am PST. fwdcloudsec.org/conference/n...

Tickets go on sale next week on Monday, Feb 9, at 10:00 a.m. PST for our North American conference happening near Seattle on June 1 and 2. An additional small batch will go on sale that evening at 11:00 p.m. PST. Tickets will be available for purchase here: www.eventbrite.com/e/fwdcloudse...

@fwdcloudsec.org is an awesome conference. Looking forward to seeing lots of cool submissions into the CFP!

Did you know Claude models have a "magic string" to test when a model refuses to respond? If that string enters prompt context, it can be abused to break LLM workflows until context is reset. It's the EICAR test string of the AI age. Details: hackingthe.cloud/ai-llm/explo...

We've locked in dates and venues for the North American (NA) and European (EU) fwd:cloudsec conferences this year! fwd:cloudsec NA will be in the Seattle, Washington area at the Meydenbauer Center in Bellevue on June 1 and 2. 🧵

What are we calling normal AWS now? Normal, standard, classic, commercial, global, american? How do you say out loud the acronym for AWS European Sovereign Cloud? I'm calling it "oosk", because the region is eusc-de-east-1, which sounds like a riff on the techno onomatopoeia "boots and cats".

The most surprising thing about AWS ESC is there aren't any cookie acceptance popup windows in the console. Is this really European?

Very cool research on a CodeBuild misconfiguration which could have had significant consequences. I’m a bit disappointed that there wasn’t more done to secure the supply chain after the Q Developer incident. www.wiz.io/blog/wiz-res...

The AWS European Sovereign Cloud (ESC) has launched! aws-news.com/article/2026...

This seems bad. www.wiz.io/blog/wiz-res...

December is generally a good time for gifts, and I have a special one for you. We are glad to announce fwd:cloudsec Europe 2026: September 7th and 8th - London, UK 🇬🇧 More info to come early 2026. Stay tuned, folks.

This is the best write-up on threat actor tradecraft I've seen from AWS. aws.amazon.com/blogs/securi...

My top picks from re:Invent security announcements: www.wiz.io/blog/top-aws...

This is excellent. Also available in video. allan.reyes.sh/posts/keepin... h/t tldrsec

It’s time to bust some malware! 🦠 Challenge #6 “Malware Busters” is LIVE. Built by Gili Tikochinski for the reverse‑engineering pros - dive into assembly and uncover what’s hidden inside. Think you can crack it? cloudsecuritychampionship.com/challenge/6

🚨 New Shai-Hulud-style npm attack hitting 25k+ repos and growing fast. Devs & CI/CD exposed via malicious preinstall. Wiz Research has detection + mitigation. Details: www.wiz.io/blog/shai-hu...

The day has come where we get to announce what we've been working on for the past year 😍 www.duckbillhq.com/blog/skyway-...

My favorite security story I've read this year 😂, a story of surprising turns by Alex Smolen: engseclabs.com/blog/raccoon...

Yuval Avrahami was ranked as the top Azure researcher by Microsoft this quarter! He has made a Kubernetes focused CTF for the Wiz Cloud Security Championship, check it out! cloudsecuritychampionship.com Also if you can find cloud zero days, check out www.zeroday.cloud with a $4.5M prize pool!

I feel like the biggest takeaway from the latest AWS outage is that there’s simply no architecting around them at this point. Even if you are 100% redundant/multi-whatever, your vendors and customers are certainly not. Order volume is dropping no matter what you do. We’re all in this together.

Jeep pushed a bad update on Friday that has been bricking 2024 Wrangle 4xe's. x.com/StephenGutow...

A company's website, API, and email were unavailable because "attackers socially engineered AWS into freezing its domain". www.theregister.com/2025/10/02/s...

Introducing ZERODAY.CLOUD🕵️‍♀️ Be the first to participate in the first-of-its-kind cloud hacking competition. 🤝 WIN HUGE PRIZES from our up to 4.5 million dollar prize pool. 💰🏆 Join us to help make the cloud a safer place. Register your exploit now >> zeroday.cloud

I really like the announcements that have been coming out of Cloudflare. In this latest one, SSO for everyone (not just enterprise). blog.cloudflare.com/enterprise-g... Another recent and interesting one is their data platform: blog.cloudflare.com/cloudflare-d...

After facing countless of limitation on #AWS #NitroEnclaves, the same feature is now available on normal EC2 instance. The coming month must be a busy month for me to try it out #ConfidentialComputing #AWSCloud aws.amazon.com/about-aws/wh...

S3 SOAP API is being deprecated in a month (Oct 31). docs.aws.amazon.com/AmazonS3/lat... h/t @quinnypig.com for pointing it out in @lastweekinaws.com

The first step toward an organization of organizations. aws.amazon.com/about-aws/wh...

Random thing I noticed which I don't think has value but I'm recording it anyway: S3 is known to have a global namespace which can be seen with the ":::" in the arn. Ex. arn:aws:s3:::amzn-s3-demo-bucket. But other global namespaces exist. 1/2

Gal Nagli has opened my eyes to a speed and scale of web hacking that would be terrifying if he wasn't using those skills to help companies. He has put together a CTF challenge to showcase some of his most effective techniques. Check it out! www.cloudsecuritychampionship.com/challenge/4

A write-up that believes this story is propaganda and might have just been for spam. cybersect.substack.com/p/that-secre...

The secret service found a setup for disrupting cell services in the NYC area. www.secretservice.gov/newsroom/rel...

GitHub's plan to better secure the npm supply chain: github.blog/security/sup...

Check out the full schedule here: fwdcloudsec.org/conference/... Not in Berlin? No worries, you can join us live on YouTube: www.youtube.com/live/-a9Ts7... It's going to be a packed day of sharp insights and real-world lessons for cloud security l33ts.

fwd:cloudsec Europe is now live from Berlin! Watch the livestream here: youtube.com/live/-a9Ts7A...

An interesting evolution in malware that occurred in roughly the past month is malware calling AI from the payload. We've seen malware and other artifacts (ex. phishing emails) as the OUTPUT of AI, but now malware is bringing the INPUT to AI. 1/2

How do you know you're compromised? Read my newest article to see how we used canary tokens to detect an attack on our infrastructure. grafana.com/blog/2025/08...

Netskope filing for their IPO. From their S-1, $707M ARR with $354M annual net loss. www.sec.gov/Archives/edg...

Old and busted: Cloud attackers making noisy List/Describe calls. New hotness: Laundering enumeration calls through an AWS service silently. Or at least, that used to work, until @datadoghq.com partnered with AWS to close this gap. Read more here: securitylabs.datadoghq.com/articles/enu...

Working on a blog post: what AWS things aren’t true anymore, but used to be? Example: I still get surprised that I don’t have to shut down an ec2 instance to change its security group.

Introducing... 🥁 Say hello to Wiz for Exposure Management! 🥳 Wiz for Exposure Management is a NEW way to unify, prioritize, and fix exposures everywhere it lives: in your cloud, code, and on-prem infrastructure. Learn more: www.wiz.io/blog/wiz-for...

It's great to see Microsoft continue to invest in a public bug bounty program for their cloud. One cloud provider does not have this. msrc.microsoft.com/blog/2025/08...

AWS growth at 17.5% is healthy but represents a slight deceleration from the 19% growth seen in Q2 2024. Margins fell 35.5% to 32.9% YoY despite charging profane rates for new things ($9 per resource per month that IAM Internal Access Analyzer watches?!)

The AWS Golang SDK has reached end of support. It is no longer being updated. You need to use v2 of the SDK. github.com/aws/aws-sdk-go

8,400+ public GCP images were scanned and no secrets found! This contrasts with the many secrets found in public AWS AMIs and Azure Public images. Interesting to consider why this is. Only marketplace vendors and approved publishers can make images public in GCP. trufflesecurity.com/blog/guest-p...

The second challenge in our monthly CTF series is out! This time focused on a container escape.

New development in the Q Developer extension backdoor: An open question was, how did the threat actor get write permissions to the repo? Turns out they stole a token via this technique. aws.amazon.com/security/sec...

I really like that Google has created OSS Rebuild. In my experience of having tried to do something similar for a single application, it's a hard problem to confirm that source code matches the release artifacts. h/t tldrsec for linking to it. security.googleblog.com/2025/07/intr...

EC2's do a graceful shutdown when you terminate them, which is usually unwanted because you pay by the second so it'd be better if they just ripped the plug out of the wall. Now you can with the skipOsShutdown parameter. github.com/boto/botocor...

New: a hacker compromised a version of Amazon's Q AI agent, added commands to 'wipe' computers, then Amazon released it. Unclear if wipe effective; hacker did it to prove point. “Ruthless corporations leave no room for vigilance among their over-worked developers.” www.404media.co/hacker-plant...