Blog
RSSAWS Security Agent Is GA. What It Does and Doesn't Do.
AWS launched its autonomous penetration testing agent. It finds XSS, SQLi, and application-layer vulnerabilities. It doesn't map your IAM blast radius. These are two different problems, and your environment probably has both.
AWS Credential Theft Has Been Industrialized
766 hosts compromised. 196 sets of AWS credentials stolen. One operator with a search engine for your secrets. The UAT-10608 campaign isn't an outlier. It's the new baseline for how attackers harvest cloud credentials at scale.
The Credentials That Live Outside AWS Are the Ones That Get Stolen
TeamPCP didn't attack AWS to steal AWS credentials. They compromised a CI pipeline and waited for the credentials to come to them. The campaign that hit Trivy, LiteLLM, and Checkmarx in 8 days reveals something important about where your AWS keys actually rest.
AWS Keeps Breaking Its Own Trust Boundaries
We read every AWS security bulletin from the last six months. The recurring theme isn't buffer overflows or cryptographic flaws. It's trust boundary failures that turn minor permissions into full privilege escalation.
93 HackerOne Reports Show the Same AWS Blast Radius Problem
We analyzed 1,169 AWS-related HackerOne reports. The dominant pattern: SSRF or leaked credentials become full infrastructure access because nobody measured the blast radius of the compromised identity.
AWS Finally Gave S3 Buckets Their Own Rooms
For years, predictable S3 bucket names let attackers squat resources and hijack AWS services. Account-regional namespaces, launched March 2026, eliminate the entire attack class. Here's what changed and what you need to do.
What the LexisNexis Breach Teaches Us About Blast Radius in AWS
A single ECS task role with read access to every secret in the account. The LexisNexis breach is a textbook case of why blast radius validation matters.
The Capital One Breach, Seven Years Later: The Blast Radius Problem That Won't Go Away
In 2019, a single SSRF vulnerability turned into 106 million stolen records. AWS shipped IMDSv2. Seven years later, half of EC2 instances still don't enforce it, and attackers have industrialized the technique.