🧰 AWS

The items that name it 131

• Binance hack: how a compromised developer laptop can lead to a $6.3 billion breach
  articleas affected products2026-10-30It is written here as AWS (session token stolen in the Bybit incident).

  session token stolen in the Bybit incident

• The Rise of Agentic Attacks: What They Look Like, and Where They're Headed
  articleas classification.technologies2026-10-29
• [tl;dr sec] #352 - Unprompted Slides, AWS AI Post-compromise Trends, Malicious LLM API Routers
  articleas classification.technologies2026-10-29
• The Rise of Agentic Attacks: What They Look Like, and Where They're Headed
  writeupas classification.technologies2026-10-29
• Introducing Route 53 Resolved IP Validation for AWS Network Firewall
  articleas classification.technologies2026-10-27
• alex lee (@alexlee20122022) on X
  threadas classification.technologies2026-10-25
• Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
  writeupas classification.technologies2026-10-25
• Tech and Security Companies Respond to PHP2Shell Vulnerabilities
  articleas classification.technologies2026-10-22
• Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
  articleas classification.technologies2026-10-22
• Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot
  articleas classification.technologies2026-10-21
• PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
  advisoryas classification.technologies2026-10-21
• Best practices for integrating IAM Roles Anywhere with your PKI
  articleas classification.technologies2026-10-21
• PHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation
  writeupas tools2026-10-21It is written here as AWS (report).

  Reported PHP2Shell exploitation attempts in the wild as early as October 17, 2026

• Datadog pathrunner: AWS IAM privilege escalation framework
  toolas classification.technologies2026-10-20
• DFIR Radar (@DFIR_Radar) on X
  threadas classification.technologies2026-10-19
• Loud, Fast, and Everywhere: Anatomy of a Real AI-Driven Cloud Attack
  writeupas classification.technologies2026-10-19
• Lessons from the SolarWinds Breach: A Discussion With CISO Tim Brown
  articleas tools2026-10-16It is written here as AWS (new host of the externalized SolarWinds build system).

  new host of the externalized SolarWinds build system

• AWS Security Agent (now part of AWS Continuum) exploited 33 of 37 new real-world CVEs
  articleas classification.technologies2026-10-15
• Ned Peterson (@NedPeterson99) on X
  threadas affected products2026-10-14It is written here as AWS (92% of the 9,967 findings; eight AWS accounts probed read-only).

  92% of the 9,967 findings; eight AWS accounts probed read-only

• Accelerating Pollard Rho with GPU Field Arithmetic on NVIDIA Blackwell
  paperas classification.technologies2026-10-14
• Part 2 – Cybersecurity journeys: What even is this job?
  articleas classification.technologies2026-10-13
• GuardDuty Extended Threat Detection has added five new indicators to surface attack sequences
  articleas classification.technologies2026-10-12
• Quantum-resistant signing on AWS, Part 2: Enforce your ML-DSA algorithm policy with SCPs and IAM
  articleas classification.technologies2026-10-12
• Quantum-resistant signing on AWS, Part 1: Build a software supply chain with ML-DSA
  articleas classification.technologies2026-10-12
• Nicholas Michael Kloster (@showxlate) on X
  threadas classification.technologies2026-10-12
• ♫Why♥Not♪ (@Python_s_) on X
  advisoryas classification.technologies2026-10-09
• GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories
  writeupas classification.technologies2026-10-09
• New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials
  writeupas affected products2026-10-09

  Cloud provider; access key IDs (AKIA/ASIA), secret access keys, and session tokens harvested from working tree and git history, with context-window capture to reconstruct complete key pairs.

• AgentCorruption: How A Single Prompt Collapsed The Entire Cloud Security Model
  writeupas classification.technologies2026-10-08
• SonicWall and Splunk Patch Critical Vulnerabilities
  articleas classification.technologies2026-10-08
• Building your AI vulnerability harness, Part 1
  articleas classification.technologies2026-10-07
• Kubernetes Agent Sandbox on AWS EKS (Step-by-Step Guide)
  writeupas classification.technologies2026-10-07
• DevopsCube (@devopscube) on X
  threadas affected products2026-10-07

  cloud provider whose console/resources can be queried for misconfigurations

• Improving SPIRE security and resiliency with AWS managed services
  articleas classification.technologies2026-10-06
• Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access
  writeupas classification.technologies2026-10-06
• AWS Continuum sets a new standard in autonomous code security
  articleas classification.technologies2026-10-05
• SubQuery Ecosystem Compromise: Hidden Credential Theft and Backdoors
  writeupas classification.technologies2026-10-05
• Top AI agent security resources — October 2026
  articleas classification.technologies2026-10-04
• Connect Orca’s ChatGPT Plugin: Cloud Risk Context in Chat and Codex
  articleas classification.technologies2026-09-30
• The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub
  writeupas affected products2026-09-29It is written here as AWS (multiple accounts).

  multiple accounts

• The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
  writeupas classification.technologies2026-09-25
• ICYMI: August 2026 @AWS Security
  articleas classification.technologies2026-09-23
• Attack Surface Explained: Types & Reduction Tips
  articleas classification.technologies2026-09-21
• Transforming Bedrock Guardrails events into OCSF with CloudWatch
  writeupas classification.technologies2026-09-21
• Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms
  writeupas classification.technologies2026-09-18
• Run open weight models on Amazon Bedrock in AWS European Sovereign Cloud
  articleas classification.technologies2026-09-17
• Exploring the new AWS Sign Up experience
  writeupas classification.technologies2026-09-17
• Architecting a secure landing zone in the AWS European Sovereign Cloud
  articleas classification.technologies2026-09-16
• AWS STS simplifies session token size limits and adds session token size monitoring
  articleas classification.technologies2026-09-15
• Architecting resilient authentication with Amazon Cognito multi-Region replication
  articleas classification.technologies2026-09-15
• AWS Security Reference Architecture: A deep dive into PCI DSS compliance
  articleas classification.technologies2026-09-14
• Machine speed, hold the AI: hand-rolled marimo CVE-2026-39987 exploit
  writeupas classification.technologies2026-09-11
• The state of AI for security: Measuring what matters most for building trust
  articleas classification.technologies2026-09-09
• Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise
  writeupas classification.technologies2026-09-09
• Incident Automation: Benefits, Tools & Best Practices
  articleas affected products2026-09-09
• [tl;dr sec] #344 - VMs won't contain Cyber-capable Agents, AWS AI Security Analyst, Decompilers vs LLMs
  articleas classification.technologies2026-09-08
• Incident response guide for AWS CloudTrail investigations – Part 2 | Amazon Web Services
  writeupas classification.technologies2026-09-03
• Incident response guide for AWS CloudTrail investigations – Part 1 | Amazon Web Services
  writeupas classification.technologies2026-09-03
• Grafana fixes critical SSRF flaw affecting Grafana MCP servers
  advisoryas classification.technologies2026-09-03
• Update on Security at METR
  writeupas classification.technologies2026-08-31
• Password spraying campaign targets AWS root user accounts across 150+ organizations
  articleas classification.technologies2026-08-31
• Dev Machine Guard Now Inventories Where Developer Credentials Live
  articleas classification.technologies2026-08-28
• XBOW: The OpenAI/Hugging Face Incident
  articleas tools2026-08-27

  Mentioned as a system the runaway agent reached into to see what was exposed, during an unsanctioned impact assessment

• vibecheck
  repoas affected products2026-08-27
• IAM Policy Autopilot
  repoas classification.technologies2026-08-25
• Submap
  toolas classification.technologies2026-08-25
• AWSHound: An Open-Source AWS OpenGraph Collector
  writeupas classification.technologies2026-08-19
• Orca Security: SOC Automation
  articleas classification.technologies2026-08-14
• How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign
  writeupas classification.technologies2026-08-13
• Prompt Injections for Defense (Schneier on Security)
  articleas classification.technologies2026-08-12
• The OpenSourceMalware Show #16
  talkas classification.technologies2026-08-08
• ARTOC by White Knight Labs - Review
  articleas tools2026-08-06

  Hosts each student's private lab, deployed from a student portal in one click, with cost tracking and budget controls; also used for redirectors

• Cloud Threat Highlights: H1 2026
  writeupas affected products2026-08-06

  Cloud platform targeted by JINX-0163; instance role credential theft and CloudTrail user-agent mismatch technique observed.

• NPM Malware Compromises keyv and cacheable with 500M+ Weekly Downloads and Spreads to Hundreds of Packages | Blog | Endor Labs
  advisoryas classification.technologies2026-08-04
• Nine AI coding agent incidents that ended with deleted data
  writeupas classification.technologies2026-08-04
• Top AI Coding Agent security resources — August 2026
  articleas classification.technologies2026-08-03
• S3 Clones in the Neoclouds
  writeupas classification.technologies2026-07-31
• Orca Security: Cloud Identity & Entitlement Management Series
  articleas affected products2026-07-31

  Cloud platform with its own IAM model, subject to entitlement sprawl

• vigneshwaran1702/Cloud-Security-Scanner
  repoas classification.technologies2026-07-31
• Orca Security: AI Threat Detection
  articleas classification.technologies2026-07-30
• Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline
  writeupas classification.technologies2026-07-30
• The risk hiding behind exposed MCP servers
  writeupas classification.technologies2026-07-28
• Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials
  writeupas classification.technologies2026-07-25
• Master Urlscan.io Dorking for Bug Bounty Hunting
  videoas technologies2026-07-23
• Find Unused, Stale, and OIDC-Replaceable GitHub Actions Secrets Across Your GitHub Organization
  articleas affected products2026-07-23

  Cloud credentials stored as GitHub Actions secrets, replaceable via OIDC

• HackingLZ/gibson
  repoas classification.technologies2026-07-22
• AWS Kiro RCE: Prompt Injection to Code Execution | Kodem
  writeupas classification.technologies2026-07-19
• jit
  repoas classification.technologies2026-07-18
• GitHub Action Canaries
  repoas classification.technologies2026-07-11
• jscrambler npm Package Compromised in Supply Chain Attack
  writeupas affected products2026-07-11

  ECS task-metadata endpoint 169.254.170.2, Secrets Manager GetSecretValue/ListSecrets, SSM Parameter Store GetParameters/DescribeParameters targeted

• Cybersecurity Startup Publishes Infostealers to NPM
  writeupas classification.technologies2026-07-09
• The Two Mitigations for the Service-Account Confused Deputy in the Cloud
  articleas classification.technologies2026-07-09
• GhostApproval: A Trust Boundary Gap in AI Coding Assistants
  writeupas classification.technologies2026-07-08
• DataDog/pathfinding-labs
  repoas affected products2026-07-04It is written here as AWS (Amazon Web Services).

  Platform for which Pathfinding Labs deploys intentionally vulnerable IAM/cloud resource configurations (playground/sandbox accounts only, never production)

• Orca Security: ITDR for the Cloud
  articleas affected products2026-07-03It is written here as AWS (Amazon Web Services).

  Amazon Web Services

• MCP Auto-Execution: From Git Clone to Cloud Compromise in Amazon Q VS Code Extension
  writeupas classification.technologies2026-06-26
• graphw00f
  repoas classification.technologies2026-06-14
• watchTowr Labs: Splunk Enterprise CVE-2026-20253 Pre-Auth RCE via PostgreSQL Sidecar
  writeupas classification.technologies2026-06-12
• Microsoft's durabletask PyPI Package Compromised in Supply Chain Attack
  writeupas classification.technologies2026-06-09
• Why EDR and proxy won’t save you from supply chain malware
  articleas affected products2026-06-02

  Credentials harvested by durabletask second-stage payload

• Nx Console VS Code Extension Compromised
  writeupas affected products2026-06-02

  IAM/Secrets Manager/SSM Parameter Store/IMDS credentials targeted

• Orca Security: Securing Shadow AI: How to Detect Unapproved LLMs in Your Cloud
  articleas affected products2026-06-01

  Cloud environment covered by Orca's AI-SPM

• Observing Privilege Escalation in Kubernetes (EKS CloudWatch Observability Add-on)
  writeupas classification.technologies2026-06-01
• State of Post Quantum Cryptography | Wiz Blog
  articleas classification.technologies2026-05-28
• Socket: OSV Withdraws 157 Malware Reports
  articleas classification.technologies2026-05-28
• From Cookies to Keys: The Threat of Session Hijacking
  articleas affected products2026-05-26

  IAM session tokens and .aws/credentials files harvested; sell for $100-$500.

• AWS MCP Server (GA)
  articleas classification.technologies2026-05-24
• XBOW: Ethical Considerations in AI-Driven Penetration Testing
  articleas affected products2026-05-23

  Cloud environment autonomous AI pentesting agents may interact with when in scope

• Episode 3: Malicious Dependencies Aren't an Accident
  videoas technologies2026-05-22
• Orca Security: GenAI Risks in Cloud Environments
  articleas classification.technologies2026-05-18
• Alice and Bob Learn Secure Coding: Chapter 2
  videoas technologies2026-05-11
• Mirage
  repoas classification.technologies2026-05-08
• Terraform Compliance Guardrails
  repoas affected products2026-05-06It is written here as AWS (via GitHub Actions OIDC CI/CD).

  via GitHub Actions OIDC CI/CD

• Marimo OSS Python Notebook RCE: From Disclosure to Exploitation in Under 10 Hours | Sysdig
  writeupas classification.technologies2026-04-09
• AWS Ransomware
  writeupas classification.technologies2024-02-21
• llm-trails: What LLMs reach for inside a breached AWS account
  repoas classification.technologies
• ETDI: Comprehensive MCP Security Framework
  writeupas classification.technologies
• The Vulnerable MCP Project — MCP vulnerability database
  repoas classification.technologies
• CVE-2026-85787 in postgres-mcp-server
  advisoryas classification.technologies
• CVE-2026-18655: Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server (awslabs
  advisoryas classification.technologies
• CVE-2026-16584: Improper handling of an initialization failure in AWS API MCP Server from 0
  advisoryas classification.technologies
• CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server
  advisoryas classification.technologies
• CVE-2026-87911 - Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server
  advisoryas classification.technologies
• Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain
  paperas classification.technologies
• AWS EKS forensics: data sources and investigation tooling (Synacktiv)
  articleas classification.technologies
• Lonkero — Rust web vulnerability scanner (v3.7, AI agent mode)
  repoas affected products

  Cloud platform fingerprinting

• AWS EKS Forensics: Data Sources and Investigation Tooling
  articleas classification.technologies
• Detecting and countering misuse of AI: September 2026
  articleas classification.technologies
• Deadbugz: Currently Active MCP Supply-Chain Campaign
  writeupas classification.technologies
• CVE-2026-18394 - Incorrect authorization in Strands Agents Tools http_request tool
  advisoryas classification.technologies
• AWSHound — AWS BloodHound OpenGraph Collector
  repoas classification.technologies

In every workspace you can read 159