66 articles — misconfigurations, breach analyses, hardening guides, and CVE deep-dives.
AWS Route 53 Resolver is often misconfigured to allow unrestricted inbound and outbound query forwarding across VPCs and accounts. This creates attack paths for DNS-based data exfiltration, C2 tunnelling, and cross-account reconnaissance that bypass security group controls. Covers misconfiguration patterns, attack chains, CLI detection, and hardening.
Azure AI services — OpenAI, AI Search, AI Studio, and AI Foundry — introduce a new class of misconfiguration risk. This guide covers the most common exposure patterns, including key-based authentication, overly permissive RBAC, public endpoints, and the SSRF vector that earned a CVSS 9.9 in July 2026.
Azure Logic Apps is a common source of privilege escalation paths in Azure environments. Managed identities with excessive roles, insecure HTTP triggers with no authentication, and secrets embedded in workflow definitions create attack paths from workflow compromise to full subscription control.
Google Cloud Functions is one of the most common sources of cloud security misconfigurations: HTTP trigger functions deployed without authentication, overprivileged service accounts attached at the project level, and secrets exposed in environment variables. This guide covers each risk with gcloud CLI detection and remediation.
Unit 42 documented a technique where attackers register bucket names identical to those expected by multi-cloud pipelines but in a different cloud provider account, silently intercepting data streams without touching the victim's own cloud environment.
Google Cloud Secret Manager is the preferred secrets storage solution for GCP workloads, but IAM misconfigurations regularly expose secrets to over-privileged workload identities, compromised service accounts, and lateral movement paths. This guide covers the attack surface, documented exfiltration techniques, and hardening controls.
Google Cloud Build pipelines routinely leak secrets, run with overprivileged service accounts, and produce unsigned artifacts. This guide covers the five most common Cloud Build security failures — plaintext secrets, over-scoped service accounts, build log exfiltration, unsigned artifacts, and missing audit configuration — with gcloud remediation for each.
CloudTrail logs every API call against your AWS account — but knowing which events signal an active attack versus routine operations is the hard part. This guide covers the CloudTrail event patterns that matter most for detecting credential theft, privilege escalation, persistence, and lateral movement.
Azure Key Vault is the most common secrets store in Azure environments, and it sits at the centre of several high-impact attack paths. Misconfigured access policies, overprivileged managed identities, and legacy vault access models create routes from a compromised workload to full secrets exfiltration.
The 2024–2025 Snowflake credential theft campaign compromised accounts at over 160 organisations by exploiting the absence of MFA on Snowflake logins. This guide covers the attack patterns, mandatory hardening controls, and how to audit your Snowflake environment for the most common misconfigurations.
Azure Function Apps with system-assigned managed identities are a common privilege escalation path in cloud penetration tests and real-world breaches. An over-permissive managed identity on a vulnerable function can hand an attacker Subscription Owner. Here's how the path works and how to close it.
LLM API keys are a new class of cloud credential with distinct theft and abuse patterns. Unlike traditional API keys, a stolen AI key burns compute budget in real time and can be used to exfiltrate data through model interactions. Here's how to harden AWS Bedrock, Azure OpenAI, and GCP Vertex AI deployments.
Istio is widely adopted for zero-trust Kubernetes networking, but misconfigured PeerAuthentication and AuthorizationPolicy resources silently collapse mTLS guarantees. This guide covers the most dangerous misconfigurations, how attackers exploit them, and hardened configurations with policy snippets.
Azure ML workspaces grant Jupyter notebooks, compute clusters, and pipelines access to storage, secrets, and sometimes subscription-level IAM. This guide covers the most dangerous misconfiguration patterns and how to lock them down.
Threat actors who compromise Azure tenants routinely add credentials to existing service principals or create malicious app registrations with broad API permissions to maintain persistent, stealthy access. This guide covers the attack path, Microsoft Graph API abuse patterns, and the controls that detect and prevent app-based persistence.
CVE-2026-34040 in the Docker daemon allows creation of a privileged container with root-level host access, exposing AWS credentials, SSH keys, and Kubernetes configs stored on the host. AI coding agents have been demonstrated as a novel exploitation vector via prompt injection. Here's how to assess exposure and remediate.
SageMaker environments are routinely misconfigured in ways that expose sensitive training data, model artefacts, and high-privilege AWS credentials. This guide covers the most dangerous attack paths — from notebook instance escape to training job credential theft — with CLI-level remediation steps.
A local privilege escalation in the Linux kernel's AF_ALG socket subsystem lets any unprivileged container process gain root on the node. IBM Cloud Kubernetes Service clusters running 1.32 through 1.35 are affected. Here's what to patch and how to harden before you can.
GitLab CI/CD pipelines are an increasingly exploited attack surface. CI_JOB_TOKEN abuse, unprotected pipeline triggers, insecure remote includes, and OIDC misconfigurations can expose cloud credentials, registry tokens, and signing keys. This guide covers the attack paths and how to close them.
Research published in mid-2026 documented systematic exploitation of exposed LiteLLM deployments and unauthenticated Ollama endpoints for compute theft, credential exfiltration, and autonomous attack operations. This guide covers how these services get exposed in cloud environments, the specific cloud misconfigurations that enable it, and the hardening steps to close the exposure.
A race condition in the Hybrid Instance Metadata Service port binding on Azure Arc-connected servers allows any local user to escalate to SYSTEM, then retrieve managed identity tokens from HIMDS and abuse Azure RBAC. Patched in Arc Agent v1.61, released March 2026.
CVE-2026-12957 allows attackers to plant a malicious .amazonq/mcp.json configuration in a repository or project directory. When a developer opens the project in Amazon Q Developer, the MCP server defined in the config file executes automatically, exfiltrating AWS credentials and environment variables.
Wiz Research's CodeBreach disclosure showed how two missing characters in a CodeBuild webhook regex filter allowed unauthenticated attackers to access privileged GitHub PATs and push code to AWS's own repositories. Here's the attack path, the broader misconfiguration pattern, and how to harden your CodeBuild pipelines.
GuardDuty is a solid baseline for AWS threat detection, but it has documented blind spots that sophisticated attackers exploit. This guide covers what GuardDuty misses, the evasion techniques threat actors use against it, and the complementary controls that close the gaps.
A path traversal vulnerability in Azure Kubernetes Service allows a low-privileged attacker running in a hostNetwork pod to escape the container boundary and gain control of the underlying worker node. Patched in June 2026 Patch Tuesday. Here's what it means and how to harden.
VPC Service Controls are Google Cloud's mechanism for creating security perimeters around GCP services and preventing data exfiltration. They are widely misunderstood, frequently misconfigured, and often deployed in ways that provide false confidence. This guide covers how they work, the common gaps, and how to verify your perimeters are actually doing what you think.
Terraform state files contain the full attribute values of every managed resource, including secrets, credentials, and connection strings written in plaintext. Misconfigured remote state backends are an underappreciated source of cloud credential exposure.
AWS IAM Identity Center controls access to every account in an AWS Organization from a single plane. Over-provisioned permission sets, external IdP trust abuse, and stale assignments create unique privilege escalation paths — here's how to find and close them.
Unit 42 identified six AWS IAM permissions that together give an attacker the ability to silently alter the instructions, tools, and guardrails governing a deployed Bedrock Agent — without touching the application code. Here's how the attack works, what it exposes, and how to lock it down.
Azure service principals with client secrets or certificates are a persistent lateral movement vector in Entra ID environments. This guide covers how attackers obtain and abuse service principal credentials, the role assignments that make them dangerous, and the controls that limit the blast radius.
Azure Container Apps abstracts Kubernetes complexity but introduces its own security pitfalls: publicly reachable ingress by default, Dapr secrets accessible to any component in the environment, and managed identities scoped too broadly. This guide covers each pattern with az CLI remediation.
Ransomware actors have adapted their playbook to cloud storage — using compromised IAM credentials to enable S3 Object Encryption and delete snapshots, holding data hostage without deploying a single binary. This guide covers the attack chain, detection signals, and the hardening controls that break it.
Cloud Run makes container deployment fast and simple, but the defaults create several exploitable conditions: publicly reachable services with no authentication, overprivileged compute service accounts, secrets in environment variables, and container images that bypass vulnerability scanning. This guide covers each pattern with gcloud remediation.
ArgoCD is the most widely deployed GitOps tool in Kubernetes environments — and a misconfigured instance can hand an attacker cluster-admin access in minutes. This guide covers the attack surface, real misconfiguration patterns, and the hardening steps that close the critical gaps.
Cognito Identity Pools with unauthenticated access enabled hand temporary AWS credentials to anyone who asks — no account required. This hardening guide covers how the misconfig works, how attackers exploit it, detection via CloudTrail, and remediation steps.
Legacy authentication protocols in Azure/Entra ID silently bypass Conditional Access MFA requirements. This guide covers what legacy auth is, why it persists, how attackers exploit it with password spraying and credential stuffing, and the policy changes that eliminate the gap.
Every EKS worker node runs with an IAM role attached to its EC2 instance. If a container breaks out — or an attacker gains code execution in a pod without proper IRSA restrictions — that node role becomes the pivot point to AWS account-level access. This guide covers the attack path, detection, and the three controls that stop it.
Service account keys are GCP's most persistent credential risk — long-lived, broadly distributed, and rarely rotated. This guide covers how sprawl develops, how to detect it with gcloud and Security Command Center, and how to eliminate keys in favour of workload identity.
Admission controllers are Kubernetes's last line of defence before a workload reaches the cluster. This guide covers how OPA Gatekeeper and Kyverno work, the policies every production cluster needs, and how to audit for gaps.
On June 5, 2026, ServiceNow patched an authentication bypass in a REST endpoint that had been actively exploited, allowing unauthenticated attackers to query customer instance tables. Here's what happened, who was affected, and what to check now.
By default, every pod in a Kubernetes cluster can reach every other pod. NetworkPolicy resources change that — but only if your CNI plugin enforces them. Here's how to design and deploy NetworkPolicies that actually enforce zero-trust lateral movement controls.
AWS Systems Manager Run Command lets administrators execute scripts across EC2 fleets without SSH — but the same capability makes it a reliable post-compromise lateral movement technique. This guide covers the attack path, detection gaps, and hardening controls.
OAuth app consent phishing abuses Microsoft's delegated permission model to grant attacker-controlled applications persistent access to Microsoft 365 data — without ever stealing a password or needing to bypass MFA. One click from a victim grants read access to email, files, and Teams. Here's how it works, how to detect it, and how to lock it down.
GCP Artifact Registry is increasingly a source of supply chain risk in Google Cloud environments — through publicly accessible repositories, overpermissive service account bindings, and secrets baked into Docker image layers. This guide covers the three primary misconfiguration classes, audit commands, and the remediation steps that eliminate the exposure.
AWS's cross-account role assumption mechanism -- essential for multi-account architectures -- is also a primary lateral movement path when attackers compromise a single account. This guide covers the attack chain from initial compromise to cross-account escalation, CloudTrail detection queries, and the SCP controls that contain the blast radius.
IMDSv1 has no authentication — any SSRF vulnerability in an EC2-hosted application can expose IAM role credentials to external attackers. This guide covers the exploitation chain, how to detect IMDSv1 abuse via CloudTrail, and how to enforce IMDSv2 at scale using AWS Organizations SCPs.
How anonymous public access to Azure Blob Storage gets enabled, how attackers enumerate exposed containers, and a complete hardening guide including Azure Policy enforcement and remediation CLI commands.
Workload Identity Federation replaces GCP service account key files with keyless, short-lived tokens. But misconfigured pool trust rules — particularly those federating with GitHub Actions or multi-tenant identity providers — create privilege escalation paths that attackers are actively exploiting. Here is what the attacks look like and how to audit your federation configuration.
Azure Privileged Identity Management is designed to enforce just-in-time access for high-privilege roles. Misconfigured PIM policies create attack paths that allow persistent privilege escalation — often without triggering alerts.
Azure Storage Shared Access Signatures are one of the most commonly misused access control mechanisms in Azure. This guide covers the attack surface, how SAS tokens are abused in the wild, and how to audit and harden your storage account access.
AWS ECS tasks expose temporary IAM credentials through a metadata endpoint accessible at 169.254.170.2 — a less-documented but equally dangerous analogue to EC2 IMDS abuse. This guide covers the attack path, SSRF exploitation scenarios, and hardening controls.
Missing ExternalId conditions on cross-account IAM roles leave AWS environments vulnerable to confused deputy attacks, where a third party tricks a trusted service into assuming a role it shouldn't. Here's how the attack works and how to audit and fix your trust policies.
Serverless functions expand your attack surface in ways traditional scanner tools miss. Lambda's IAM roles, event source inputs, Layers, and runtime environment all present exploitation opportunities that compound quickly when misconfigured.
Azure DevOps pipelines are a rich credential store -- service connections, variable groups, and federated identity tokens all present exfiltration opportunities if pipeline YAML controls are weak. Here's how attackers get in and how to lock it down.
Service Control Policies (SCPs) are the most powerful preventive control in AWS Organizations -- they cap what any principal can do in a member account, including root. This guide covers the essential deny policies every multi-account environment should have.
A breach analysis of the May 2026 Laravel-Lang supply chain attack, where attackers compromised a maintainer account to backdoor 700 Composer package versions and exfiltrate CI/CD secrets from thousands of pipelines.
Multiple GitHub Actions supply chain attacks in 2025–2026 have exposed CI/CD secrets at scale. This guide covers the attack patterns -- tag hijacking, pull_request_target misuse, cache poisoning -- and the hardening steps that actually stop them.
Disabling or manipulating AWS CloudTrail is a standard post-access step for attackers operating in AWS environments. This guide covers every tampering technique, GuardDuty detections, defensive SCPs, and monitoring configurations that ensure CloudTrail can't be silenced.
63% of cloud incidents trace back to misconfiguration -- and most are catchable in code. This guide covers Terraform security scanning with Checkov and Trivy, state file hardening, and CI/CD integration patterns.
Microsoft Entra ID (formerly Azure AD) is the identity backbone of most enterprise cloud deployments. This analysis maps the most exploited privilege escalation paths -- from consent phishing to app role abuse -- and the detective controls to catch them.
A deep-dive into two of the most dangerous AWS IAM misconfigurations -- iam:PassRole abuse and iam:CreatePolicyVersion -- with exploitation chains, detection opportunities, and remediation guidance.
How attackers steal Azure Managed Identity access tokens from the Instance Metadata Service endpoint, pivot to Azure resources, and what defenders can do to detect and limit the blast radius.
A forensic breakdown of how S3 buckets end up publicly accessible -- the interplay between ACLs, bucket policies, and Public Access Block settings -- illustrated with real breach patterns and detection techniques.
A hardening guide covering the risks of GCP service account key files, how they get leaked, and how to migrate to Workload Identity Federation for keyless authentication across AWS, GitHub Actions, and on-prem workloads.
A technical deep-dive into Server-Side Request Forgery attacks targeting cloud metadata services -- how IMDSv1 enables credential theft with a single HTTP request, what IMDSv2 actually protects against, and documented real-world exploitation chains.
A hardening guide to the most dangerous Kubernetes RBAC misconfigurations -- wildcard rules, overbroad cluster-admin bindings, automounted service account tokens -- with detection queries and least-privilege policy templates.