Decoding the GitHub recommendations for npm maintainers securitylabs.datadoghq.com/articles/dec... by @phrawzty.com

Investigating an adversary-in-the-middle phishing campaign targeting Microsoft 365 and Okta users securitylabs.datadoghq.com/articles/inv...

CVE-2025-55182 (React2Shell): Remote code execution in React Server Components and Next.js securitylabs.datadoghq.com/articles/cve...

"Building an npm worm" (2016) contolini.com/building-an-...

A few days ago, a new piece of malware started spreading in npm, compromising and backdooring hundreds of legitimate npm packages and GitHub users. Read the analysis from our security research team: securitylabs.datadoghq.com/articles/sha...

If you're in cloud security, do have a look at this piece of research I've been working on! Feedback / thoughts welcome

The EU is advancing legislation requiring all messaging platforms to scan private messages, even in encrypted apps like Signal/WhatsApp/Telegram. 600+ security researchers oppose ChatControl for being technically flawed. Learn more about it 👉 metalhearf.fr/posts/chatco... #ChatControl #privacy

If you're into cloud security, fwd:cloudsec Europe is now live. Schedule: fwdcloudsec.org/conference/e...

I did a bit more looking into the upcoming bitnami deprecation. The images are still getting millions of pulls a week, so depending on exactly what tags vanish next week, there could be a lot of broken deploys on the 28th! raesene.github.io/blog/2025/08...

@micahflee.com thank you for the amazing and inspiring defcon talk

I arbitrarily picked a list of 50 talks I'm most excited about that are happening next week at DEF CON / Black Hat / BSides LV / The Diana Initiative. I'll also add recordings/slides to this list when they become available!

Getting ready for DEF CON next week! ✅ Slides ✅ Demos ✅ Custom shirt designed for the occasion

Looks like the maintainer of a number of highly-popular npm packages was phished through npnjs[.]com, and his access used to publish malicious versions of their packages x.com/JounQin/stat... www.linkedin.com/feed/update/... github.com/prettier/esl...

Stratus Red Team AWS attack techniques are now mapped to the Threat Technique Catalog for AWS Stratus Red Team AWS attack techniques: stratus-red-team.cloud/attack-techn... Threat Technique Catalog by AWS: aws-samples.github.io/threat-techn...

The MCP spec has been updated to include security best practices • Confused deputy • Token passthrough • Session hijacking modelcontextprotocol.io/specificatio...

Solid way to start the week

👀

If you're a cloud practitioner based in Europe, definitely submit to fwd:cloudsec Berlin happening in September! We're actively seeking submissions from first time speakers and non-security folks. In that case, you can submit by May 30th and get initial feedback on your submission!

Ticket sales for fwd:cloudsec Europe 2025 goes live on April 22nd, first batch at 9 AM CET and a second batch at 7PM CET. Tickets are sold through Swoogo, link at fwdcloudsec.org/conference/e... ..

My story breaking this news exclusively was 7K+ words and had almost all of this in it, and more: www.npr.org/2025/04/15/n...

The March edition of the Datadog Security Digest is out! securitylabs.datadoghq.com/newsletters/... • New MITRE ATT&CK coverage matrix in Stratus Red Team • Compromised GitHub actions • Malicious Maven packages • Exploitation of SSRF vulnerabilities on the rise • ... and more

Looking forward to it! ☁️🇪🇺🇩🇪

By making minor changes to command-line arguments, it is possible to bypass EDR/AV detections. My research, comprising ~70 Windows executables, found that all of them were vulnerable to this, to varying degrees. Here’s what I found and why it matters 👉 wietze.github.io/blog/bypassi...

The February edition of the Datadog Security Digest is out! securitylabs.datadoghq.com/newsletters/... featuring @sethsec.bsky.social, @mccune.org.uk, @karimscloud.bsky.social, @jcfarris.bsky.social, and more

Regular tickets sold out quickly, but Personal Supporter tickets are still available! Speakers get a ticket, so consider submitting a talk idea to the CFP. Closes April 11. Scholarship is open: fwdcloudsec.org/conference/n...

Si vous êtes sur Paris et avez de l'expérience avec la sécurité de la chaîne d'approvisionement logicielle (supply chain security), Datadog a un poste dans mon équipe qui devrait vous intéresser ! careers.datadoghq.com/detail/66012... N'hésitez pas à me DM si vous avez des questions.

@anssi-fr.bsky.social Il serait bien d'utiliser votre nom de domaine officiel comme nom d'utilisateur Bluesky (bsky.social/about/blog/4...), autrement il est impossible de savoir s'il s'agit d'un compte légitime Idem pour @cert-fr.bsky.social

L'ANSSI vient de sortir un rapport sur la menace dans les environnements cloud, en Français : www.cert.ssi.gouv.fr/uploads/CERT... Au programme : • Menaces ciblant les fournisseurs • Menaces ciblant les utilisateurs finaux • L'usage que les attaquants font du cloud @anssi-fr.bsky.social

A refreshing perspective. Anyone has good resources on Western APTs? I remember reading from a French group that's likely state-sponsored (coucou la DGSE) but that's about it citizenlab.ca/2015/03/morg...

@dirkjanm.io Do you have any Europe-based training planned in the coming months? (besides the Insomnihack one I will unfortunately be unable to attend - such a shame as I live in Lausanne)

📢 Christophe Tafani-Dereeper will present "Code to Cloud: Exploiting Modern Web Applications to Breach Cloud Environments" at Insomni’hack 2025! 📖 Check the full lineup and get your ticket: insomnihack.ch/talks/code-t... #INSO25 #Cybersecurity #EthicalHacking #Switzerland

Device code phishing strikes again www.volexity.com/blog/2025/02...

Outstanding research by my awesome colleague @sethsec.bsky.social, along with an open-source to scan for suspicious AMIs in your own AWS account securitylabs.datadoghq.com/articles/who... github.com/DataDog/whoA...

DeepSeek mania is driving the AI world crazy. Is the bubble popping? are we now slaves to Chinese AI? is Nvidia over? don't think so, no, and probably not www.404media.co/deepseek-man...

The January edition of the Datadog Security Digest newsletter is out! securitylabs.datadoghq.com/newsletters/...

Outstanding write-up from @zlz.bsky.social (as always) samcurry.net/hacking-subaru • Enumeration • Account takeover via vulnerable password reset feature • 2FA bypass as it was implemented only as an UI limitation (not server-side)

🚨 The Insomni’hack 2025 Conferences Programme is LIVE! 📅 2 days, top experts, & cutting-edge cybersecurity talks. Get your tickets now: insomnihack.ch/talks-2025/?... #INSO25 #Cybersecurity #EthicalHacking #Switzerland

"I discovered a unique 0-click deanonymization attack that allows an attacker to grab the location of any target within a 250 mile radius", including on Signal. gist.github.com/hackermondev... Follow-up reporting from @404media.co: www.404media.co/cloudflare-i...

What are some open source projects related to security that may use support/funding?

Lately, every BSides seems to have a talk on reframing security teams as a “Department of Yes” We don’t hear nearly as much about the value of a well-considered, strategically deployed “No” I've pulled together guidance on giving a better, more constructive No: ramimac.me/saying-no

2024 saw the launch of our revamped toolkit! Thanks to amazing Toolkit Maintainers and Guardians, you can find a database full of useful free-to-access tools. Complete with complexity ratings and clear descriptions, the toolkit is a one-stop shop for investigations. bellingcat.gitbook.io/toolkit

I've spent dozens of hours reading State of Cloud Security reports You know, the ones that use data from their CSPM product And I've realized the findings substantially reflect how well that tool helps customers secure their clouds I wrote up some examples, both good and bad (🔗 in 🧵)

In-depth investigation by Datadog security researchers into a threat actor dubbed MUT-1244, which targets other malicious actors as well as security practitioners and academics. securitylabs.datadoghq.com/articles/mut...

Never thought I'd read an headline like that one day

"Escalating privileges to read secrets with Azure Key Vault access policies" by @siigil.bsky.social securitylabs.datadoghq.com/articles/esc...

New research: We've been monitoring a threat actor publishing dozens of trojanized GitHub repositories targeting threat actors, leaking hundreds of thousands of credentials along the way securitylabs.datadoghq.com/articles/mut...

Threat actors spread info stealing malware through 1) GitHub-hosted PoC exploits for CVE vulns and 2) phishing emails targeteting 2,700 addresseses scraped from the arXiv research platform. The professional grade istealer stole 390,009 creds, likely from bad guys. arstechnica.com/security/202...

I'll be at BSides London tomorrow, looking forward to it! Schedule looks amazing: cfp.securitybsides.org.uk/bsides-londo... cc @bsideslondon.bsky.social

"Tales from the cloud trenches: Unwanted visitor" securitylabs.datadoghq.com/articles/tal... This post describes an attacker that we've observed in the wild, including a malicious AWS account ID used to create a backdoor IAM role.