AWS described the secure defaults in its new getting-started experience. What AWS said, and the CLI and policy checks we suggest so older accounts match the same baseline.
Amazon Threat Intelligence observed ARTEX AI agents harvesting AI model credentials at scale. What Amazon reported, and the AWS CLI checks we suggest for exposed LLM gateways, secrets, metadata access and spend.
A critical race condition in Apache httpd mod_http2 (2.4.55 to 2.4.70) can lead to remote code execution. Fixed in 2.4.71. How to inventory exposed hosts and images with AWS tooling, plus the HTTP/1.1 workaround. Azure and GCP are covered only as pointers.
AWS just expanded GuardDuty customization with wildcard suppression, Custom Detection Rules and entity lists. A hardening guide for tuning noise without hiding real attacker activity, with CLI examples.
Wiz reports a threat actor used IAM credentials from a Qubole-associated AWS account to assume customer integration roles between October 14 and 26, 2026. What was observed, how to hunt in CloudTrail, and how to tighten vendor trust policies.
Organization Policy constraints stop risky GCP resources from being created at all. Which constraints are enforced by default, which are not, and the gcloud commands to audit and set them.
A wildcard or missing sub condition in a GitHub OIDC trust policy lets the wrong repository or branch assume your AWS role. Safe policy examples, an AWS CLI audit script and CloudTrail checks.
Which pods can assume which AWS roles is decided by a trust policy most teams never re-read. A practical audit and hardening guide for EKS IRSA and Pod Identity, with CLI commands and policy snippets.
A CVSS 10 missing-authentication flaw in Azure Kubernetes Service is circulating as if it were new. Microsoft says it is already mitigated server-side. Here is what the records say and a short audit to run regardless.