The newest Authorization / Broken Access Control resources are on the Authorization / Broken Access Control page. For a reading order instead of a date order, see the Authorization / Broken Access Control learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-08-10 2026 | Beyond Prompt Injection: Hacking Apple's Private Cloud Compute advanced 9 min read AI | Writeup on CVE-2026-20685, which targets Apple's Private Cloud Compute (PCC), details a path traversal vulnerability in the `darwin-init` process. This flaw allows an attacker to write files as root during node boot, bypassing privacy and security guarantees essential for Apple Intelligence features. The exploit leverages a malformed tar archive to inject malicious files into `/var/db/` while still allowing the PCC node to boot successfully, demonstrating a significant security finding within Apple's inference backbone. |
| 2026-07-31 2026 | CosmosEscape: Taking Over Every Database in Azure Cosmos DB news 6 min read | Tool leveraging .NET reflection bypasses Azure Cosmos DB's Gremlin API sandbox. This "CosmosEscape" vulnerability grants code execution and access to a "Cosmos Master Key," enabling enumeration and full read/write takeover of any database within Azure Cosmos DB, including Microsoft's internal data stores. Microsoft has remediated the issue and implemented platform hardening. → wiz.io |
| 2026-07-30 2026 | Account Takeover Across Multiple Programs via Featurebase Integration intermediate 2 min read Bug Bounty IDOR | Writeup detailing an account takeover (ATO) vulnerability in the Featurebase platform, a feedback and feature request service used by numerous organizations. The vulnerability arises from an Insecure Direct Object Reference (IDOR) where the `userId` parameter in API requests, specifically `POST /api/v1/user/identify` and during account modification via `POST /api/v1/user`, is not properly validated. This allows attackers to change a victim's email or impersonate them by obtaining their access token, leading to account compromise. → infosecwriteups.com |
| 2026-07-29 2026 | How We Hacked Thousands of Data Centers in Minutes Using a 20-Year-Old Vulnerability news 12 min read | Library for identifying internet-exposed Baseboard Management Controllers (BMC) and assessing risks related to CVE-2013-4786, a 20-year-old IPMI 2.0 vulnerability. This resource details how attackers can obtain password-derived authentication hashes before login, enabling offline cracking, and highlights the significant security implications for data centers, particularly in AI infrastructure where BMC compromise can lead to widespread lateral movement and persistence beneath the operating system. The library aids in visualizing this exposure using tools like BMCRadar. |
| 2026-07-29 2026 | RAG and ruin: why your existing controls may miss AI poisoning attacks advanced 7 min read AI | Library addressing Retrieval-Augmented Generation (RAG) system security, this resource details the risks of AI data poisoning and RAG poisoning. It explains how threat actors can exploit retrieval pipelines by injecting crafted content, leading to misinformation, data leakage, or unauthorized actions. Traditional controls are insufficient against these text-based attacks. The library highlights techniques like semantic optimization and retrieval content crafting used by adversaries and discusses the business impact, citing research showing high attack success rates. It also touches on persistent prompt injection via long-term memory, as demonstrated by the spAIware proof of concept. → intigriti.com |
| 2026-07-29 2026 | How an Unpatched N-Day Let Any Anonymous Visitor Rewrite WooCommerce Prices in ND Booking news 11 min read API Sec Bug Bounty | Writeup detailing CVE-2025–63001, an unpatched vulnerability in the ND Booking WordPress plugin. This flaw allows any unauthenticated visitor to permanently overwrite WooCommerce product prices by exploiting an insecure AJAX handler that lacks proper authorization checks beyond a publicly accessible nonce. The vulnerability is exploitable in the latest version of ND Booking, despite its CVE being assigned for older versions, and affects plugins integrating booking functionality with WooCommerce. → infosecwriteups.com |
| 2026-07-29 2026 | Unprotected admin functionality — PortSwigger Access control vulnerabilities Lab 1 beginner 2 min read Bug Bounty IDOR | Writeup of Broken Access Control vulnerability (BAC-Portswigger-001) affecting an administrative panel. The vulnerability stems from missing authentication and authorization checks, allowing unauthenticated users to discover and access the `/administrator-panel` endpoint via `robots.txt`. This enables unauthorized actions like deleting user accounts, leading to full application compromise, aligning with OWASP Top 10 A01: Broken Access Control. Remediation involves enforcing authentication, implementing authorization checks, and avoiding reliance on `robots.txt` for security. → infosecwriteups.com |
| 2026-07-28 2026 | Exploiting Volvo/Eicher's fleet platform to gain control over all users/vehicles intermediate 4 min read API Sec | Writeup detailing the exploitation of VE Commercial Vehicles' "My Eicher" fleet management platform, enabling account takeover and control over user fleets. Vulnerabilities in exposed, unauthenticated APIs allowed for the discovery of customer lists, user data, and OTPs, facilitating direct account compromise. This led to the potential control of hundreds of thousands of vehicles and access to sensitive uploaded documents including Aadhaar cards and driving licenses. |
| 2026-07-28 2026 | What Is AI Pentesting and How Does It Works? beginner 5 min read AI | Library for AI pentesting, using reasoning-capable AI models to autonomously find, exploit, and validate context-dependent vulnerabilities like broken authorization and business-logic abuse that traditional scanners miss. It operates as an orchestrated system with a planning model, deterministic tools, an independent validator, and target context, generating attack narratives with verifiable proof of concept and reasoning traces. This approach complements existing scanners and human testers, focusing on vulnerabilities such as BOLA, authentication bypasses, and chained exploits, with examples like Snyk's Evo Continuous Offensive Security demonstrating its application. → snyk.io |
| 2026-07-28 2026 | Unprotected admin functionality with unpredictable URL — PortSwigger Access Control Lab 2 intermediate 2 min read Recon | Writeup of PortSwigger Access Control Lab 2 details a high-risk Broken Access Control vulnerability where an unprotected admin panel's URL is disclosed via client-side JavaScript on the home page. Attackers can bypass authentication by inspecting the page source, gaining unauthorized access to administrative functions and allowing actions like deleting users, leading to complete application compromise. Remediation involves enforcing authentication and authorization, avoiding security through obscurity, and not exposing sensitive endpoints in client-side code. → infosecwriteups.com |
| 2026-07-28 2026 | One Header Away from 10+ GB of Customer Documents (PII) — $6K Bounty news 6 min read Bug Bounty | Writeup detailing a critical security flaw in a major insurer's China operations, allowing anonymous read and overwrite access to over 10 GB of customer documents containing PII. The vulnerability stems from two distinct failures on ByteDance's Volcengine TOS platform: a forgeable Referer header bypass for anonymous object reads, and an unauthenticated presigned-post signer enabling anonymous uploads and overwrites by spoofing credentials. This oversight, involving a misapplication of anti-leeching features and a lack of authorization checks on custom API endpoints, led to a $6K bounty. → infosecwriteups.com |
| 2026-07-28 2026 | Unauthenticated Disclosure of A/B Test Data in Convert Pro — How Two Forgotten AJAX Endpoints… intermediate 9 min read API Sec | Writeup detailing an unauthenticated disclosure vulnerability in Convert Pro version 1.0.1, where two forgotten AJAX endpoints, `convertpro_interactions_report_ajax` and `convertpro_get_chart_data`, allowed attackers to retrieve A/B test names, variation names, and complete view/conversion statistics by iterating through sequential integer IDs without any authentication or authorization checks. → infosecwriteups.com |
| 2026-07-27 2026 | What Is AI Pentesting and How Does It Works? beginner 5 min read | Library for AI pentesting that uses reasoning-capable AI models to autonomously find, exploit, and validate context-dependent security vulnerabilities like BOLA and business-logic abuse. It functions as an orchestrated system combining a reasoning model, deterministic tools, an independent validator, and target context to generate attack narratives, not just flat alerts, and it complements traditional scanners and manual testing by covering vulnerabilities missed by signature-based approaches. → snyk.io |
| 2026-07-23 2026 | Finding eight high-severity vulnerabilities in NodeBB in six hours intermediate 19 min read Bug Bounty XSS | Library for discovering vulnerabilities in NodeBB, identifying eight high-severity issues including Cross-Site Scripting (XSS) and authorization bypasses. These vulnerabilities, affecting versions prior to 4.14.0, were found through autonomous whitebox assessment, with specific examples like XSS via custom Federation servers and template injection. The library's findings were promptly reported and fixed by the NodeBB maintainers. → aikido.dev |
| 2026-07-23 2026 | A Millisecond of Predictability: Why CVE-2026-11374 Is Hard to Exploit advanced 15 min read | Tool for detecting and mitigating CVE-2026-11374, an unauthenticated account takeover vulnerability in ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus. The vulnerability allows attackers to replay a predictable SSO ticket, often derived from the millisecond wall-clock time at login, to hijack administrator sessions. While blind exploitation is difficult due to layered controls, targeted attackers on the victim's network pose a realistic threat. The provided tool helps identify instances with the vulnerable AD360 cookie-replay path active and can assist in auditing patch levels. → bishopfox.com |
| 2026-07-22 2026 | Writeup & POC: CVE-2026-49176 Windows WalletService to SYSTEM (LPE) news 6 min read | Writeup detailing CVE-2026-49176, a local privilege-escalation vulnerability in Windows WalletService. This exploit allows a standard user to redirect WalletService to an attacker-seeded ESE database, triggering a callback DLL loaded as LocalSystem. The service's improper handling of the caller's Documents folder and the Extensible Storage Engine's persisted callback feature enable arbitrary DLL loading and execution with SYSTEM privileges. |
| 2026-07-21 2026 | Escalating All The Privileges With Foxit PDF Reader (CVE-2026–57239) news 14 min read RCE | Writeup detailing privilege escalation within Foxit PDF Reader, specifically CVE-2026–57239. The vulnerability allows an unprivileged user to achieve NT AUTHORITY\SYSTEM privileges. Exploitation requires initial code execution and leverages a DLL sideloading vulnerability in the updater to execute the system-privileged FoxitPDFReaderUpdateService.exe with elevated permissions, culminating in a full attack chain from user to SYSTEM. |
| 2026-07-19 2026 | 600$ For Stealing Podcasts/Show via RSS Feed Manipulation intermediate 2 min read API Sec | Writeup detailing a business logic flaw on a podcasting platform where an attacker could hijack legitimate podcasts by manipulating RSS feeds. By altering the `<itunes:email>` tag in a copied RSS file and hosting it on public cloud storage, the attacker bypassed ownership verification, allowing them to claim duplicate podcast entries. The platform has since implemented content hashing and duplicate feed detection to prevent similar vulnerabilities. → infosecwriteups.com |
| 2026-07-19 2026 | How I Escalated to Domain Admin Using AD CS (And How to Fix It) intermediate 2 min read | Writeup detailing a Domain Admin escalation via Active Directory Certificate Services (AD CS) exploitation. The article demonstrates how a misconfigured ESC1 certificate template, specifically "ESC1-Lab," allows an attacker like "bob" to request an Administrator certificate using `certipy-ad` and then authenticate as the Domain Administrator without knowing the password. It outlines the enumeration, request, and authentication steps, and provides remediation advice including disabling "Supply in the request," restricting enrollment permissions, and regular auditing with tools like `Certipy` and BloodHound. → infosecwriteups.com |
| 2026-07-19 2026 | How I Abused a Group Policy Object (GPO) in Active Directory (And How to Fix It) intermediate 2 min read | Writeup detailing Active Directory GPO abuse, demonstrating how misconfigured permissions on Group Policy Objects can lead to privilege escalation. The process involves using BloodHound to identify vulnerabilities like WriteDacl and WriteOwner on the Employees Policy GPO, and then provides steps to remediate by removing these excessive rights from the Delegation tab in Group Policy Management. → infosecwriteups.com |
| 2026-07-19 2026 | From User Enumeration to PII Exposure: Chaining Two APIs Into a $2,000 Bug intermediate API Sec | Writeup detailing a $2,000 bug bounty discovery, where user enumeration through one API endpoint was chained with a second API endpoint to expose sensitive personal information at scale. This chained Broken Access Control vulnerability highlights the risks of API interactions, even when individual endpoints appear harmless. → infosecwriteups.com |
| 2026-07-18 2026 | Windows AppResolver LPE: From AppContainer to SYSTEM. PoC linked to CVE-2026-50454 advanced 9 min read | Writeup details a Local Privilege Escalation (LPE) technique in Windows, bypassing User Account Control (UAC) by exploiting a missing authorization check in `Windows.Internal.AppResolver.AppResolverActivationArgsFactory`. An attacker can leverage a zero-capability AppContainer to register a malicious handler for `ms-settings:`, which is then auto-elevated via `fodhelper.exe` using the administrator's token, ultimately leading to a SYSTEM-privileged process. This technique is associated with CVE-2026-50454, though the author notes it differs from the publicly described relative path traversal vulnerability. |
| 2026-07-18 2026 | Confused Deputy: Google IdP Universal Account Takeover via Device Code Flow Hijacking advanced 12 min read AuthN | Library for Confused Deputy exploit in Google IdP, enabling universal account takeover via device code flow hijacking. This vulnerability allows an attacker to silently steal an access token for an arbitrary Google-registered client, bypassing consent screens and 2FA, by chaining two bugs: session transferability via a crafted URL and the authorization server’s failure to bind `client_id` and `scope` server-side to the `device_code`. The initial report to Google's VRP was initially rejected but later fixed after a one-click Proof of Concept was developed. → infosecwriteups.com |
| 2026-07-18 2026 | How I Found a Cross-Student IDOR in Academy LMS That Leaked Correct Quiz Answers intermediate 8 min read IDOR | Writeup detailing a Cross-Student Insecure Direct Object Reference (IDOR) vulnerability in the Academy LMS WordPress plugin, specifically affecting the quiz attempt details endpoint. Exploiting this flaw allowed any enrolled student to retrieve another student's quiz results and learn the correct answers to quiz questions, by passing the victim's `user_id` to the `get_student_quiz_attempt_details` function, bypassing authorization checks that incorrectly used the victim's enrollment status. → infosecwriteups.com |
| 2026-07-18 2026 | Zero Credentials, Full Access: Inside a Complete Authorization Failure intermediate 3 min read API Sec AuthN | Writeup on a complete authorization failure in a SaaS API where an unauthenticated attacker could access premium functionality, impersonate users, read private conversations, and escalate privileges by chaining trust-boundary failures, including missing authentication, client-controlled metadata for authorization, and exposed API documentation. → infosecwriteups.com |
| 2026-07-18 2026 | Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy advanced 10 min read RCE | Writeup detailing a chained exploit of three zero-day vulnerabilities (CVE-2025-40948, CVE-2025-40947, and CVE-2025-40949) in Siemens ROX II OT switches. The exploit chain allows for arbitrary file disclosure via insecure xz utility usage, privilege escalation through command injection in the feature key validation, and persistent root code execution by manipulating the task scheduler. These vulnerabilities could grant an attacker full root access and persistence, compromising critical industrial control networks. → unit42.paloaltonetworks.com |
| 2026-07-16 2026 | The Red Agent POV: The One Boolean That Broke a B2B Platform’s Credit System intermediate 5 min read API Sec | Writeup detailing a business-logic flaw in a B2B platform's credit system, where a single client-controlled flag bypassed paywall restrictions, granting free access to millions of contact profiles. The Red Agent discovered this by analyzing frontend code bundles, identifying the unused `unmaskContactData` parameter, and successfully injecting it into API requests, proving the backend's failure to validate user entitlements. This bypass highlights the limitations of traditional SAST and DAST tools in detecting such intent-based vulnerabilities, emphasizing the need for reasoning-driven testing and server-side enforcement of business rules. → wiz.io |
| 2026-07-15 2026 | Introducing snowpick: Testing ServiceNow for Public Data Exposure beginner 10 min read API Sec | Tool for testing ServiceNow for public data exposure, snowpick systematically checks Service Portal widgets and Table REST APIs for unauthenticated record access. It differentiates between full row exposure and count-only leaks, providing reproducible evidence packages detailing findings such as PII, credentials, or infrastructure data without requiring bulk data collection, building on techniques from prior research by Aaron Costello and Varonis Threat Labs. → bishopfox.com |
| 2026-07-09 2026 | GhostApproval: A Trust Boundary Gap in AI Coding Assistants advanced 10 min read AI | Library addressing GhostApproval, a trust boundary gap in AI coding assistants, where symlink following (CWE-61) combined with UI misrepresentation (CWE-451) allows malicious repositories to trick agents like Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf into writing to arbitrary files outside the sandbox, potentially leading to remote code execution. → wiz.io |
| 2026-07-08 2026 | BadSuccessor — Exploiting delegated Managed Service Accounts in Windows Server 2025 advanced 8 min read | Library for exploiting delegated Managed Service Accounts (dMSAs) in Windows Server 2025, detailing the "BadSuccessor" vulnerability. This flaw arises from missing permission checks, allowing low-level users with `CreateChild` rights on an OU to create a dMSA and link it to a privileged account. The system then incorrectly grants the dMSA all of the predecessor's permissions during Kerberos ticket issuance, enabling privilege escalation to high-level administrative roles. → infosecwriteups.com |
| 2026-07-07 2026 | How I Found a Data Deletion Bypass via Subdomain Synchronization intermediate 4 min read Bug Bounty | Writeup detailing a business logic vulnerability in a self-hosted bug bounty program. The author discovered a data deletion bypass by exploiting a synchronization flaw between two subdomains, `account.redacted.com` and `todo.redacted.com`. A user with a Moderator role, who should not have deletion privileges, could delete an entire organizational group by leveraging the application's unchecked data exchange, causing a cascade deletion across both subdomains. This finding highlights the importance of proper authorization enforcement and understanding application workflows, even without complex tools or techniques. → infosecwriteups.com |
| 2026-07-07 2026 | Mass Assignment and the Identity Drift: From Profile Edit to Insurance Takeover intermediate 7 min read Bug Bounty | Writeup detailing Mass Assignment and identity drift, where an application erroneously allows users to update sensitive identity fields like legal name and date of birth through an edit profile endpoint. This vulnerability, when combined with a verified account status, enables "identity drift," allowing an attacker to manipulate their profile to match a legitimate individual. The writeup then demonstrates a second-order impact: successfully linking a victim's insurance or benefit record to the attacker's account by exploiting the modified identity fields used in the linking process. → infosecwriteups.com |
| 2026-07-06 2026 | I Found an Unauthenticated Attachment Disclosure Bug in a WordPress Support Plugin — and a… intermediate 8 min read | Writeup detailing an unauthenticated attachment disclosure vulnerability in a WordPress support plugin. The research, conducted in an isolated Docker environment, reveals that a specific REST API endpoint lacks proper authorization checks, allowing anonymous users to access sensitive customer attachments like invoices and personal records. The author validates the vulnerability through proof-of-concept requests and MD5 hash comparisons, highlighting the potential for widespread data exfiltration. → infosecwriteups.com |
| 2026-07-04 2026 | Certified AD Red Team Specialist (AD-RTS): Full Exam Write-Up intermediate 13 min read AuthN | Writeup detailing a full methodology for the Certified AD Red Team Specialist (AD-RTS) exam, covering two distinct adversary paths. Path 1 begins with zero credentials and involves DNS zone transfers for enumeration, ASREPRoasting via GetNPUsers to gain SQL Server access, privilege escalation with GodPotato to SYSTEM, and credential harvesting using MiniDump. This leads to abusing AD Certificate Services (ADCS) via ESC1, leveraging certipy-ad, to request a certificate impersonating Domain Admin. Path 2 focuses on escalating from a low-privilege foothold on a public-facing web server. → infosecwriteups.com |
| 2026-07-04 2026 | Post-Compromise Attacks in AD: Credential Validation with CrackMapExec intermediate 2 min read AuthN | Writeup detailing post-compromise Active Directory attacks, focusing on credential validation using CrackMapExec. The article demonstrates using a compromised domain user credential, obtained via LLMNR poisoning, to authenticate against other machines on the network. It covers using CrackMapExec to check credentials, dump local SAM hashes, and leverage the Impacket suite (secretsdump, psexec.py) for further access, along with a brief mention of hash cracking with Hashcat. → infosecwriteups.com |
| 2026-07-04 2026 | Exploiting Resource-Based Constrained Delegation (RBCD) intermediate 8 min read | Writeup on exploiting Resource-Based Constrained Delegation (RBCD) to achieve full Computer Account takeover. The article details how RBCD, introduced in Windows Server 2012, flips the trust direction from outgoing to incoming, allowing any account with write permissions on a computer object to modify its `msDS-AllowedToActOnBehalfOfOtherIdentity` attribute. This vulnerability can be exploited by creating a new computer account (Service A) with an SPN, obtaining a non-forwardable Kerberos ticket via S4U2Self, and then using RBCD to impersonate users to a target resource (Service B) via S4U2Proxy. → infosecwriteups.com |
| 2026-07-02 2026 | Privilege escalation to root in Lima QEMU guests via a world-writable agent socket (CVE-2026-53657) intermediate 7 min read | Writeup detailing CVE-2026-53657, a privilege escalation vulnerability in Lima's QEMU guest agent. An unprivileged user within a QEMU guest could exploit a world-writable, root-owned socket to execute commands as root due to a lack of authentication on the agent's gRPC API and a forwarding RPC. This vulnerability only affects the QEMU driver, not the default VZ driver. Lima v2.1.3 addresses this by restricting socket permissions and ownership. |
| 2026-07-02 2026 | Auditing OpenReception: 16 CVEs in an end-to-end encrypted appointment booking platform (unauthenticated admin creation, account takeover, E2E bypass) intermediate 8 min read API Sec AuthN | Analysis of OpenReception reveals sixteen CVEs, including four critical vulnerabilities. Tenant administrators can self-promote to GLOBAL_ADMIN (CVE-2026-48086), and unauthenticated users can create GLOBAL_ADMIN accounts after initial setup (CVE-2026-48085). WebAuthn passkey injection allows account takeover by linking a passkey to a victim's account (CVE-2026-48087). The platform's end-to-end encryption is defeated by staff crypto poisoning, enabling silent decryption of bookings (CVE-2026-48088). |
| 2026-07-02 2026 | Auth Bypass is it? intermediate API Sec AuthN | Writeup details a bypass of an MSPACE-style auto-login feature where the backend accepted a fake inner MSPACE token within an encrypted JSON request body, despite a valid outer API bearer token being present. This vulnerability was discovered by observing client-side encrypted API flows and testing how the application handled decrypted data originating from the browser. → infosecwriteups.com |
| 2026-07-02 2026 | Why Being in the Docker Group Is a Backdoor to Your Whole System intermediate RCE | Writeup demonstrating how membership in the `docker` group grants root access on Linux hosts, bypassing the need for `sudo`. This is not an exploit, but a design consequence of Docker, allowing users to manage containers but also effectively gain full host control through mounted volumes and privileged container operations. Administrators should avoid adding users to the `docker` group on shared or production systems. → infosecwriteups.com |
| 2026-07-02 2026 | Hack Smarter — City Council (Active Directory) intermediate 20 min read AuthN | Writeup detailing the compromise of a City Council Active Directory environment, starting with only an IP address. The process involved initial port scanning with rustscan, web enumeration with gobuster, and reverse engineering an application executable with strings to uncover a service account. The service account's password was then extracted by intercepting application traffic with Wireshark. Finally, BloodHound was used to map the Active Directory structure via credentials obtained for the svc_services_portal account. → infosecwriteups.com |
| 2026-06-30 2026 | The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL API intermediate 6 min read GraphQL | Writeup detailing an automated AI agent's exploitation of Broken Object-Level Authorization (BOLA) in an airline's GraphQL booking API. The agent autonomously mapped the architecture, minted an anonymous session, and leveraged unprotected resolvers with sequential booking IDs to extract sensitive passenger data, including names, addresses, masked credit cards, and flight itineraries, also gaining write capabilities over active bookings. This bypass of frontend authentication highlights the critical need for backend, object-level authorization checks on all API resolvers. → wiz.io |
| 2026-06-27 2026 | Intigriti Bug Bytes #237 - June 2026 🚀 news 10 min read Bug Bounty RCE | Library focusing on AI security and bug bounty insights, featuring interviews with researchers like Cristian Zot and Leo Racanelli on AI's role in offensive security and securing AI systems. It also highlights the Intigriti Quick Scope (IQS) Burp Suite extension, awarded by PortSwigger, and discussions on balancing AI tooling with human judgment. The entry touches upon exploiting vulnerabilities such as DOMPurify bypasses and insecure CSP rules, alongside tools like AFL++ and Metis for fuzzing and code review. → intigriti.com |
| 2026-06-25 2026 | Identiverse 2026: The Challenges Of Solving Identity For AI Agents At Scale news 11 min read AI | Talk summarizing Identiverse 2026 highlights challenges in solving identity for AI agents at scale, mirroring the Hoover Dam's population boom. Key discussions focused on ownership, lifecycle, and least privilege for non-human identities (NHIs) and agents, with emphasis on governance at credential creation, built-in auditability, and agent accountability. Solutions explored include intent-scoped, just-in-time access over API keys, SPIFFE-based attestation, and per-workflow OIDC tokens to eliminate secrets, ensuring secure paths are the default for citizen developers. → blog.gitguardian.com |
| 2026-06-24 2026 | Wiz launches support for Google Cloud excessive access findings based on audit logs news 2 min read | Library support for Google Cloud excessive access findings analyzes audit logs, providing visibility into over-provisioned permissions and inactive users/service accounts. This enables organizations to enforce the principle of least-privilege access and prevent privilege escalation, even for customers without IAM Recommender enabled or those on lower Security Command Center pricing tiers. Wiz identifies identity risks that can create attack paths, such as publicly exposed compute instances with excessive privileges. → wiz.io |
| 2026-06-23 2026 | Secure non-human identities with Wiz’s newest CIEM dashboard intermediate 3 min read Secrets | Dashboard for securing non-human identities, addressing risks like exposed, privileged, or vulnerable service accounts, with 42% of organizations exhibiting such issues. This CIEM tool offers visibility into machine identities, detects risky service accounts, visualizes activity by country, and prioritizes risks. It leverages attack path analysis to identify lateral movement and data access pathways, aiding security teams in multi-cloud environments without requiring deep expertise in each platform. → wiz.io |
| 2026-06-23 2026 | New EKS Access Management and Pod Identity features: a security analysis intermediate 9 min read | Analysis of EKS Access Management and Pod Identity features reveals their impact on existing security controls. These new mechanisms, including "access entries" and "access policies" for cloud-to-cluster interaction, and the "eks-pod-identity-agent" for cluster-to-cloud communication, simplify identity management but introduce new complexities in permission auditing. Understanding the "API_AND_CONFIG_MAP" authentication mode and the union of access rules from both EKS API and `aws-config` is crucial for calculating effective permissions, alongside managing the security of identity tokens against lateral movement vectors. → wiz.io |
| 2026-06-23 2026 | New attack vectors in EKS intermediate 9 min read | Analysis of new EKS attack vectors introduced by EKS Access Entries and Pod Identity, detailing how compromised IAM identities can enumerate accessible clusters via `ListAssociatedAccessPolicies` and `DescribeAccessEntry` APIs. The report further explores privilege escalation possibilities on both cloud and Kubernetes RBAC levels, including scenarios involving `AmazonEKSClusterAdminPolicy`, `AmazonEKSEditPolicy`, and exploitation of exposed secrets or sensitive `ConfigMap` files. → wiz.io |
| 2026-06-23 2026 | NamespaceHound: protecting multi-tenant K8s clusters intermediate 7 min read | Tool for assessing Kubernetes multi-tenant cluster risks, NamespaceHound detects potential namespace crossing violations and anonymous access opportunities. This open-source Python CLI tool analyzes cluster configurations to identify attack paths that could lead to cross-tenant security breaches. It helps cluster operators and red teamers by revealing vulnerabilities, extending the PEACH framework for tenant isolation assessment. → wiz.io |
| 2026-06-20 2026 | Defeating Kubernetes Privilege Escalation: A Cloud Detection & Response Case Study intermediate 3 min read | Case study detailing a real-world attack where adversaries escalated privileges from Kubernetes to AWS control planes. The attack leveraged a newly published RCE CVE on an open-source application running on an EKS pod's EC2 instance, which was misconfigured with internet access. This allowed exploitation to gain access to the EC2 instance IAM role via the Instance Metadata Service (IMDS), highlighting the need for rapid, contextualized cloud detection and response. → wiz.io |