A subtle flaw, a massive blast radius. [Research Saturday]
CyberWire Daily21 Mars

A subtle flaw, a massive blast radius. [Research Saturday]

Yuval Avrahami from Wiz joins to share their work on "CodeBreach: Infiltrating the AWS Console Supply Chain and Hijacking AWS GitHub Repositories via CodeBuild." Wiz Research uncovered “CodeBreach,” a critical supply chain vulnerability caused by a subtle misconfiguration in AWS CodeBuild pipelines that allowed attackers to take over key GitHub repositories, including the widely used AWS JavaScript SDK that powers the AWS Console. By exploiting an unanchored regex filter, unauthenticated attackers could trigger privileged builds, steal credentials, and potentially inject malicious code into software used across a majority of cloud environments. AWS has since remediated the issue and introduced stronger safeguards, but the incident highlights a growing trend of attackers targeting CI/CD pipelines where small misconfigurations can lead to massive downstream impact. The research can be found here: CodeBreach: Infiltrating the AWS Console Supply Chain and Hijacking AWS GitHub Repositories via CodeBuild

Det här avsnittet är hämtat från ett öppet RSS-flöde och publiceras inte av Podme. Det kan innehålla reklam.

Avsnitt(3741)

CyberWire Daily at 10: A decade of emerging threat actors and APTs. [Special Edition]

CyberWire Daily at 10: A decade of emerging threat actors and APTs. [Special Edition]

In this episode, Maria Varmazis and Dave Bittner from N2K Cyberwire get back together to discuss the evolution of advanced persistent threats (APTs), threat actor landscape, attribution changes, and ...

30 Aug 24min

Who let the AI hack? [Research Saturday]

Who let the AI hack? [Research Saturday]

Today we are joined by Crystal Morin, Senior Cybersecurity Strategist, and Michael Clark, Senior Director of Threat Research, at Sysdig, sharing their work on "LLMjacking evolved: Attackers are using ...

29 Aug 23min

The blacklist boomerang.

The blacklist boomerang.

A judge rules the Trump administration illegally labeled Anthropic a national security risk. The White House moves to keep foreign technology out of U.S. power systems. OpenAI rallies a global cyber d...

28 Aug 29min

Meta gets a Meta-sized bill.

Meta gets a Meta-sized bill.

Meta settles. Australian police arrest two alleged TeamPCP members. The White House moves to shore up water utility cybersecurity. ATF reports a major cyber incident. The Navy tells sailors to lock do...

27 Aug 31min

The feds flip the script.

The feds flip the script.

The U.S. disrupts a Chinese hacking operation blamed for intrusions at several sensitive government agencies. CISA says more than 100 water systems were targeted in July. Attackers exploit a critical...

26 Aug 32min

CISA is running on empty.

CISA is running on empty.

Lawmakers request an investigation into cuts at CISA. Threat actors actively exploit a Zimbra Collaboration Suite vulnerability. A Chinese AI lab preps release of a powerful open-weight model. A new p...

25 Aug 28min

The odds were classified.

The odds were classified.

Polymarket traders win big on U.S. military insider information. Slovakia deactivates speed cameras with Russian backdoors. TikTok pays $400 million to settle kids' privacy allegations. Hackers infect...

24 Aug 30min

Building a secure space internet. [T-Minus: Space-Cyber Briefing]

Building a secure space internet. [T-Minus: Space-Cyber Briefing]

As space infrastructure has continued to expand, developing secure space systems has become just as important as launching the spacecraft themselves. In this week's episode, host Maria Varmazis sits ...

23 Aug 24min

Populärt inom Politik & nyheter

aftonbladet-krim
svenska-fall
p3-krim
en-runda-till
aftonbladet-daily
rss-krimstad
politiken
flashback-forever
rss-vad-fan-hande
rss-sanning-konsekvens
motiv
rss-krimreportrarna
svd-ledarredaktionen
rss-frandfors-horna
kungligt
spar
fordomspodden
rss-flodet
rss-expressen-dok
dagens-eko