ALL POSTS

Key Findings * Researchers discovered a vulnerability in AWS Bedrock AgentCore Code Interpreter * DNS queries can be exploited to leak sensitive data from supposedly isolated AI systems * Vulnerability received a high-risk severity score of 7.5/10 * AWS responded by updating documentation instead of creating a full patch * Potential risks include data breaches and infrastructure compromise Background AWS Bedrock is a platform for building AI applications, with the AgentCore C

Key Findings * UNC6426 breached a victim's cloud environment within 72 hours * Supply chain attack compromised nx npm package in August 2025 * Stolen GitHub token used to gain unauthorized cloud access * Threat actor created new AWS administrator role * Exfiltrated data from S3 buckets and destroyed production environments * AI-assisted attack leveraged LLM tools for credential theft Background The incident originated from a supply chain vulnerability in the nx npm package di

Key Findings Nearly 3,000 Google API keys (identified by the prefix "AIza") were found embedded in client-side code, providing access to sensitive Gemini endpoints and private data. The problem occurs when users enable the Gemini API on a Google Cloud project, causing the existing API keys in that project to gain access to Gemini endpoints without any warning or notice. Creating a new API key in Google Cloud defaults to "Unrestricted," meaning it's applicable for every enable

Key Findings Blast Security, a cybersecurity startup, has launched from stealth with a $10 million seed round co-led by 10D and MizMaa Ventures. The company is founded by industry veterans from Solebit (acquired by Mimecast) and elite IDF units. Blast is introducing a new operating model for cloud security with its first-of-its-kind Preemptive Cloud Defense Platform. The platform replaces reactive response with continuous prevention, turning native cloud control into a preven