SecBlog Weekly — Issue 008
A BeyondTrust zero-day, a ConnectWise credential in 162 Microsoft 365 tenants, eight compromised CA keys, a backdoored OVHcloud CLI, and Rank Math, Docker, Ghostscript, Cairn and AdFection.
Weekly Security Briefing
News, vendor watch, and the open-source tools worth knowing about — plus a dedicated eye on cloud security and hardening. Curated for practitioners, not headline chasers.
Free weekly. No spam. Unsubscribe anytime.A BeyondTrust zero-day, a ConnectWise credential in 162 Microsoft 365 tenants, eight compromised CA keys, a backdoored OVHcloud CLI, and Rank Math, Docker, Ghostscript, Cairn and AdFection.
Microsoft's record Patch Tuesday, an Ivanti zero-day chain, SonicWall exploitation attempts, an IDCF Cloud ransomware outage, SAP's OAuth flaw, npm and certificate-trust hijack risks, an LMCache RCE, and a Ledger implant.
How to give GitHub Actions workflows access to AWS, Azure, and Google Cloud without long-lived keys, and why trust conditions should name immutable IDs, not repository names. A 23-item checklist.
An FBI contractor's missed patch, 8.8 million Danish records exposed through a company account, Arizona's court breach, Atlassian and FortiBleed attacks, Warlock's SharePoint campaign, SWIFT middleware, and a LibreOffice flaw.
An open-source git secrets scanner, why entropy-based detection still misses secrets leaked outside git entirely, and why the project itself is winding down new feature work.
Citrix NetScaler zero-days under active exploitation, a Supabase misconfiguration exposing 16,000+ databases, an AI agent's destructive Azure attack, a malicious npm campaign, an MCP OAuth flaw, and a ShinyHunters arrest.
An open-source policy engine that turns a recurring audit of public S3 buckets across every account into a five-line YAML file, plus the dry-run habit that keeps it safe.
The third cheat sheet in the set: a checklist for locking down Google Cloud Storage, from public access prevention and uniform bucket-level access to encryption, recovery, and logging, plus a gotcha where enforcement masks public grants instead of removing them.
ShinyHunters claims it breached the FBI's jobs portal, a critical WordPress flaw was exploited within hours of its patch, Check Point's VPN gateways are under attack, and an OpenAI agent bypassed blocks on Australia's Medicare portal.
A root-RCE Cisco zero-day, an unconfirmed 7.5M-record utility breach claim, a GitLab flaw exploited within a day of patching, and the real cost of treating dev servers as safe.
Two vendor announcements worth a skeptical read — one still just a roadmap item, one invite-only — plus real research: an AI-security technique crossing into phishing, and hard numbers on which edge vendors keep getting breached.
Why identity is the real perimeter now, per Verizon's 2026 breach data — the access-control mandate, where key vaults fit in, and a real comparison of AWS, Azure, and GCP's secrets managers
Misconfigurations, CSPM findings, IaC security, and hardening checklists — covered evenly across AWS, Azure, and GCP.
Biweekly →Launches, acquisitions, funding, and notable threat research from prominent vendors — read with healthy skepticism of the hype.
As-needed →Smaller, often-overlooked open-source scanners and hardening scripts that don't get mainstream coverage.
Biweekly →Longer original analysis — a technique explained, a breach post-mortem, a tool walkthrough. Published monthly.
Coming soon