#awssecurity — Public Fediverse posts

AgentCore Harness Exposes Credential Risks

A default-enabled shell in AgentCore Harness can be exploited through prompt injection, allowing attackers to execute commands and extract plaintext credentials from the harness process memory, putting sensitive data at risk. This simple yet consequential chain highlights a critical vulnerability in credential security.

https://osintsights.com/agentcore-harness-exposes-credential-risks?utm_source=mastodon&utm_medium=social

#CredentialExfiltration #AgentcoreHarness #AwsSecurity #IdentityTheft #SupplyChainRisks

Aesto Health disclosed a breach of its AWS infrastructure exposing PII and PHI of 9.54 million individuals, disclosed June 2026. The scale and sensitivity of health data significantly increase risk of identity fraud and secondary exploitation. Healthcare cloud environments require continuous hardening and monitoring. #DataBreach #HealthcareSecurity #AwsSecurity

https://cyberworldops.eu/en/aesto-health-data-breach-exposes-health-and-personal-information-of

Aesto Health disclosed a breach of its AWS infrastructure exposing PII and PHI of 9.54 million individuals, disclosed June 2026. The scale and sensitivity of health data significantly increase risk of identity fraud and secondary exploitation. Healthcare cloud environments require continuous hardening and monitoring. #DataBreach #HealthcareSecurity #AwsSecurity

https://cyberworldops.eu/en/aesto-health-data-breach-exposes-health-and-personal-information-of

🚨 CRITICAL: CVE-2026-12530 impacts AWS Bedrock AgentCore Python SDK (v1.1.3 – 1.6.1). Incomplete input sanitization in install_packages() lets attackers abuse pip flags. Update now! https://radar.offseq.com/threat/cve-2026-12530-improper-neutralization-of-argument-917f42dfcc3cfd56 #OffSeq #AWSSecurity #Python #CVE2026_12530

🚨 CRITICAL: CVE-2026-12530 impacts AWS Bedrock AgentCore Python SDK (v1.1.3 – 1.6.1). Incomplete input sanitization in install_packages() lets attackers abuse pip flags. Update now! https://radar.offseq.com/threat/cve-2026-12530-improper-neutralization-of-argument-917f42dfcc3cfd56 #OffSeq #AWSSecurity #Python #CVE2026_12530

🚨 CRITICAL: CVE-2026-12530 impacts AWS Bedrock AgentCore Python SDK (v1.1.3 – 1.6.1). Incomplete input sanitization in install_packages() lets attackers abuse pip flags. Update now! https://radar.offseq.com/threat/cve-2026-12530-improper-neutralization-of-argument-917f42dfcc3cfd56 #OffSeq #AWSSecurity #Python #CVE2026_12530

🚨 CRITICAL: CVE-2026-12530 impacts AWS Bedrock AgentCore Python SDK (v1.1.3 – 1.6.1). Incomplete input sanitization in install_packages() lets attackers abuse pip flags. Update now! https://radar.offseq.com/threat/cve-2026-12530-improper-neutralization-of-argument-917f42dfcc3cfd56 #OffSeq #AWSSecurity #Python #CVE2026_12530

🥳🎉 Congratulations, digital locksmith! You've managed to trick AWS with a trailing slash, earning a whopping $12,000 for adding punctuation like a grammar vigilante. 🧐 Apparently, security now hangs by a thread, or rather, a single character—truly groundbreaking stuff in the world of #fintech babysitting. 🔓💰
https://theguptalog.blogspot.com/2026/04/i-bypassed-aws-api-gateway-auth-with.html #digitallocksmith #AWSsecurity #cybersecurity #punctuationhack #HackerNews #ngated

🥳🎉 Congratulations, digital locksmith! You've managed to trick AWS with a trailing slash, earning a whopping $12,000 for adding punctuation like a grammar vigilante. 🧐 Apparently, security now hangs by a thread, or rather, a single character—truly groundbreaking stuff in the world of #fintech babysitting. 🔓💰
https://theguptalog.blogspot.com/2026/04/i-bypassed-aws-api-gateway-auth-with.html #digitallocksmith #AWSsecurity #cybersecurity #punctuationhack #HackerNews #ngated

🥳🎉 Congratulations, digital locksmith! You've managed to trick AWS with a trailing slash, earning a whopping $12,000 for adding punctuation like a grammar vigilante. 🧐 Apparently, security now hangs by a thread, or rather, a single character—truly groundbreaking stuff in the world of #fintech babysitting. 🔓💰
https://theguptalog.blogspot.com/2026/04/i-bypassed-aws-api-gateway-auth-with.html #digitallocksmith #AWSsecurity #cybersecurity #punctuationhack #HackerNews #ngated

🥳🎉 Congratulations, digital locksmith! You've managed to trick AWS with a trailing slash, earning a whopping $12,000 for adding punctuation like a grammar vigilante. 🧐 Apparently, security now hangs by a thread, or rather, a single character—truly groundbreaking stuff in the world of #fintech babysitting. 🔓💰
https://theguptalog.blogspot.com/2026/04/i-bypassed-aws-api-gateway-auth-with.html #digitallocksmith #AWSsecurity #cybersecurity #punctuationhack #HackerNews #ngated

Now on Crucial Exams: AWS Certified Security Specialty (SCS-C03) - 250 practice questions and 220 flashcards to help you pass. Start studying: https://crucialexams.com/s/hjqNttCN #AWSSecurity

Now on Crucial Exams: AWS Certified Security Specialty (SCS-C03) - 250 practice questions and 220 flashcards to help you pass. Start studying: https://crucialexams.com/s/hjqNttCN #AWSSecurity

Crimson Collective is using clever tricks on AWS—from sniffing out exposed keys to full-blown privilege escalation. Think your cloud’s safe? Discover how these tactics could put your data at risk and what you can do about it.

https://thedefendopsdiaries.com/crimson-collective-tactics-techniques-and-mitigation-strategies-for-aws-cloud-attacks/

#crimsoncollective
#awssecurity
#cloudattacks
#databreach
#cyberthreats

Crimson Collective is using clever tricks on AWS—from sniffing out exposed keys to full-blown privilege escalation. Think your cloud’s safe? Discover how these tactics could put your data at risk and what you can do about it.

https://thedefendopsdiaries.com/crimson-collective-tactics-techniques-and-mitigation-strategies-for-aws-cloud-attacks/

#crimsoncollective
#awssecurity
#cloudattacks
#databreach
#cyberthreats

Crimson Collective is using clever tricks on AWS—from sniffing out exposed keys to full-blown privilege escalation. Think your cloud’s safe? Discover how these tactics could put your data at risk and what you can do about it.

https://thedefendopsdiaries.com/crimson-collective-tactics-techniques-and-mitigation-strategies-for-aws-cloud-attacks/

#crimsoncollective
#awssecurity
#cloudattacks
#databreach
#cyberthreats

Crimson Collective is using clever tricks on AWS—from sniffing out exposed keys to full-blown privilege escalation. Think your cloud’s safe? Discover how these tactics could put your data at risk and what you can do about it.

https://thedefendopsdiaries.com/crimson-collective-tactics-techniques-and-mitigation-strategies-for-aws-cloud-attacks/

#crimsoncollective
#awssecurity
#cloudattacks
#databreach
#cyberthreats

Could your AWS cloud be secretly exposed? Hackers are exploiting SSRF to snag sensitive metadata, but upgrading to IMDSv2 might just turn the tables. Check out why tightening up this single layer could mean the difference between breach and safety.

https://thedefendopsdiaries.com/securing-aws-cloud-environments-against-ssrf-vulnerabilities/

#ssrf
#awssecurity
#cloudsecurity
#ec2
#imdsv2

Could your AWS cloud be secretly exposed? Hackers are exploiting SSRF to snag sensitive metadata, but upgrading to IMDSv2 might just turn the tables. Check out why tightening up this single layer could mean the difference between breach and safety.

https://thedefendopsdiaries.com/securing-aws-cloud-environments-against-ssrf-vulnerabilities/

#ssrf
#awssecurity
#cloudsecurity
#ec2
#imdsv2

Quantum computing is shaking up digital security. Legacy encryption could soon be a thing of the past, and AWS is already stepping in with breakthrough ML-KEM tech. Ready to see how we're gearing up for a quantum future?

https://thedefendopsdiaries.com/securing-the-future-how-quantum-computing-is-transforming-cybersecurity/

#quantumcomputing
#cybersecurity
#postquantum
#encryption
#awssecurity

Imagine classic encryption like RSA being outsmarted by quantum computers. AWS’s new ML-KEM is already paving the way for tomorrow’s cybersecurity—could this be the future-proof solution we need?

https://thedefendopsdiaries.com/securing-the-future-how-quantum-computing-is-transforming-cybersecurity/

#quantumcomputing
#cybersecurity
#postquantum
#encryption
#awssecurity

Quantum computing is shaking up digital security. Legacy encryption could soon be a thing of the past, and AWS is already stepping in with breakthrough ML-KEM tech. Ready to see how we're gearing up for a quantum future?

https://thedefendopsdiaries.com/securing-the-future-how-quantum-computing-is-transforming-cybersecurity/

#quantumcomputing
#cybersecurity
#postquantum
#encryption
#awssecurity

Imagine classic encryption like RSA being outsmarted by quantum computers. AWS’s new ML-KEM is already paving the way for tomorrow’s cybersecurity—could this be the future-proof solution we need?

https://thedefendopsdiaries.com/securing-the-future-how-quantum-computing-is-transforming-cybersecurity/

#quantumcomputing
#cybersecurity
#postquantum
#encryption
#awssecurity

Some early morning coffee and catching up on the latest AWS IAM news and blogs on my Kindle Scribe - love this big screen! Becoming a bit of a habit (a good one too). #aws #awssecurity

Some early morning coffee and catching up on the latest AWS IAM news and blogs on my Kindle Scribe - love this big screen! Becoming a bit of a habit (a good one too). #aws #awssecurity

Some early morning coffee and catching up on the latest AWS IAM news and blogs on my Kindle Scribe - love this big screen! Becoming a bit of a habit (a good one too). #aws #awssecurity

Breaching the Data Perimeter: CloudTrail as a mechanism for Data Exfiltration

https://tracebit.com/blog/breaching-the-data-perimeter-cloudtrail-as-a-mechanism-for-data-exfiltration

#cloudsecurity #aws #awssecurity

Breaching the Data Perimeter: CloudTrail as a mechanism for Data Exfiltration

https://tracebit.com/blog/breaching-the-data-perimeter-cloudtrail-as-a-mechanism-for-data-exfiltration

#cloudsecurity #aws #awssecurity

Get the scoop on the latest #AWS shadow resource & S3 Bucket namesquatting attacks in our new 7-minute video! Learn how attackers exploit predictable naming to compromise #cloud infrastructure and how to prevent these attacks. https://youtu.be/rc4CHfVxezI

#cloudsecurity #namesquatting #shadowIT #awssecurity

Get the scoop on the latest #AWS shadow resource & S3 Bucket namesquatting attacks in our new 7-minute video! Learn how attackers exploit predictable naming to compromise #cloud infrastructure and how to prevent these attacks. https://youtu.be/rc4CHfVxezI

#cloudsecurity #namesquatting #shadowIT #awssecurity

New Phishing Campaign Attacking AWS Accounts To Steal Logins https://cybersecuritynews.com/aws-phishing-campaign/ #CybersecurityTrends #CyberSecurityNews #PhishingAttacks #AWSSecurity #Phishing #cloud

New Phishing Campaign Attacking AWS Accounts To Steal Logins https://cybersecuritynews.com/aws-phishing-campaign/ #CybersecurityTrends #CyberSecurityNews #PhishingAttacks #AWSSecurity #Phishing #cloud

New Phishing Campaign Attacking AWS Accounts To Steal Logins https://cybersecuritynews.com/aws-phishing-campaign/ #CybersecurityTrends #CyberSecurityNews #PhishingAttacks #AWSSecurity #Phishing #cloud

IdentifyMobile incident exposed 200M records from hundreds of companies

https://stackdiary.com/identifymobile-incident-exposed-200m-records-from-hundreds-of-companies/

#Security #DataBreach #IdentifyMobile #SMS #AWS #Cybersecurity #Privacy #Hack #2FA #Authentication #DataProtection #InfoSec #CCC #TechNews #OnlineSecurity #Encryption #DataLeak #Vulnerability #Incident #TechSafety #ConfigurationError #Webex #AWSsecurity #DigitalSecurity #CloudSecurity #DataPrivacy #TechBreach #SecurityFlaw #CyberSafety #DataSecurity

IdentifyMobile incident exposed 200M records from hundreds of companies

https://stackdiary.com/identifymobile-incident-exposed-200m-records-from-hundreds-of-companies/

#Security #DataBreach #IdentifyMobile #SMS #AWS #Cybersecurity #Privacy #Hack #2FA #Authentication #DataProtection #InfoSec #CCC #TechNews #OnlineSecurity #Encryption #DataLeak #Vulnerability #Incident #TechSafety #ConfigurationError #Webex #AWSsecurity #DigitalSecurity #CloudSecurity #DataPrivacy #TechBreach #SecurityFlaw #CyberSafety #DataSecurity

IdentifyMobile incident exposed 200M records from hundreds of companies

https://stackdiary.com/identifymobile-incident-exposed-200m-records-from-hundreds-of-companies/

#Security #DataBreach #IdentifyMobile #SMS #AWS #Cybersecurity #Privacy #Hack #2FA #Authentication #DataProtection #InfoSec #CCC #TechNews #OnlineSecurity #Encryption #DataLeak #Vulnerability #Incident #TechSafety #ConfigurationError #Webex #AWSsecurity #DigitalSecurity #CloudSecurity #DataPrivacy #TechBreach #SecurityFlaw #CyberSafety #DataSecurity

TIL, there's a hard coded client_id in the #AWS #awsconsole for what I suspect is an AWS managed account that handles oauth2.0 for root/some login types.

The client_id depending on the service that it first redirects looks like this arn:aws:iam:015428540659:user/s3

Another service that I've noticed is phd-console (Which I think is AWS health dashboard).

So in this pattern it looks like your secret access key is treated as the client secret in an authorization code flow.

The code/access token returned by AWS is an opaque encrypted JWT.

#awssecurity

TIL, there's a hard coded client_id in the #AWS #awsconsole for what I suspect is an AWS managed account that handles oauth2.0 for root/some login types.

The client_id depending on the service that it first redirects looks like this arn:aws:iam:015428540659:user/s3

Another service that I've noticed is phd-console (Which I think is AWS health dashboard).

So in this pattern it looks like your secret access key is treated as the client secret in an authorization code flow.

The code/access token returned by AWS is an opaque encrypted JWT.

#awssecurity

TrailDiscover, a project to gather CloudTrail events linked to security incidents or actions that could impact security: https://traildiscover.cloud/

TrailDiscover introduction blog: https://medium.com/@adan.alvarez/introducing-traildiscover-simplifying-access-to-security-insights-about-cloudtrail-events-cde14508f2e9

#aws #awssecurity

A rundown of AWS security best practices. How to tame the cloud and deliver robust cloud services that won't keep you awake at night.

https://www.blackchili.co.uk/aws-best-practices/

#cloudsecurity #awssecurity #keepitsimple #getthebasicsright #blackchili

🔒 Security is of the highest priority for us and our customers. Ensuring the security of their applications running on the underlying infrastructure is crucial. We trust in the key capabilities of AWS to provide a robust security layer, enhanced within our own platform.

https://www.youtube.com/watch?v=H7C-qUZm8mY

#AWS #AWSDevOps #AWSSecurity #Lagoon #Kubernetes #security #infrastructure #ZeroOps #DevOps #OpenSource

🔒 Security is of the highest priority for us and our customers. Ensuring the security of their applications running on the underlying infrastructure is crucial. We trust in the key capabilities of AWS to provide a robust security layer, enhanced within our own platform.

https://www.youtube.com/watch?v=H7C-qUZm8mY

#AWS #AWSDevOps #AWSSecurity #Lagoon #Kubernetes #security #infrastructure #ZeroOps #DevOps #OpenSource

The #AWSreInforce registration is now open! What to expect: In-depth content across 6 tracks, hands-on learning opportunities & networking with leaders & experts in the industry. I look forward to seeing you in Anaheim, June 13-14! https://aws.amazon.com/blogs/security/gain-insights-and-knowledge-at-aws-reinforce-2023/ #awssecurity #awscloud

The #AWSreInforce registration is now open! What to expect: In-depth content across 6 tracks, hands-on learning opportunities & networking with leaders & experts in the industry. I look forward to seeing you in Anaheim, June 13-14! https://aws.amazon.com/blogs/security/gain-insights-and-knowledge-at-aws-reinforce-2023/ #awssecurity #awscloud

#ChatGPT explaining cross-account Security Group referencing pretty neatly. One of the easiest ways to implement an IP Address-free trust between connected apps in #AWS.

Also called #microsegmentation.

FOLLOW US as we explore cloud network security with #AI.

#awssecurity

We ask #ChatGPT about an oft overlooked policy that you should be putting in place when using #VPC #Endpoints in #AWS. Do NOT inadvertently allow access to other tenants' resources!

FOLLOW US as we explore cloud network security with #AI.

#awssecurity

AWS Elastic Container Registry Public (ECR Public) vulnerability:

=>Hackers can delete, update, and create ECR Public images, layers, and tags in registries and repositories that belong to victims' AWS Accounts

https://blog.lightspin.io/aws-ecr-public-vulnerability

Credit: @gafnitav @LightspinTech

#infosec #AwsSecurity #ContainerSecurity #Devops #DevSecops #kubernetes #websecurity