appsec.fyi · Sources

cloudsek.com

5 curated AppSec resources from cloudsek.com across 3 topics on appsec.fyi.

cloudsek.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-06-03.

SSRF 2 Supply Chain 2 OSINT 1
Date Added Resource Excerpt
2026-06-03 2026How an Unauthenticated MCP Server Led to SSRF LFI and AWS Credential TheftSSRFAn unauthenticated MCP (Microsoft Connection Machine Protocol) server exposed a critical vulnerability, allowing an attacker to achieve Server-Side Request Forgery (SSRF) and Local File Inclusion (LFI). This compromise led to the theft of AWS credentials. The vulnerability was discovered through a bug bounty program.
2026-06-02 2026How an Unauthenticated MCP Server Led to SSRF LFI and AWS Credential TheftSSRFA security researcher discovered a critical vulnerability in an unauthenticated MCP (Master Control Program) server. This flaw allowed for Server-Side Request Forgery (SSRF) and Local File Inclusion (LFI), which ultimately led to the theft of AWS credentials. The exploit chain enabled unauthorized access to cloud resources.
2026-05-14 2026Inside a Tor Backed Supply Chain WormSupply ChainLibrary for detecting sophisticated npm supply chain attacks, featuring the `crypto-javascri` package that mimics `crypto-js`. This malicious package harvests npm and GitHub credentials, hijacks maintainer accounts to republish trojanized packages, and deploys a Tor-based command-and-control implant. The worm targets Linux developer systems and CI/CD environments, propagating by injecting itself into legitimate packages and updating their versions.
2026-04-11 2026The Scanner Was the Weapon: 36 Months of Precision Supply Chain Attacks Against DevSecOps InfrastructureSupply ChainLibrary detailing 36 months of precision supply chain attacks, highlighting compromises of DevSecOps tools like vulnerability scanners and CI/CD pipelines. It examines the XZ Utils backdoor (CVE-2024-3094), the reviewdog GitHub Actions compromise (CVE-2025-30066 / CVE-2025-30154), and the multi-stage infostealer targeting Aqua Security's Trivy. The analysis reveals attacker sophistication in targeting trusted software, leveraging build-time injection and automated trust exploitation.
2026-04-06 202610 Best Threat Intelligence Tools In 2026OSINTLibrary of threat intelligence tools for 2026, including CloudSEK, Recorded Future, CrowdStrike, Mandiant, and Microsoft, were evaluated for their predictive depth, contextual accuracy, and integration with operational security workflows. These platforms collect, analyze, and contextualize information about emerging cyber threats from various sources, including dark web communities and malware repositories. Key features reviewed include external attack surface monitoring, brand impersonation detection, infrastructure exposure tracking, and integration with SIEM, SOAR, and XDR systems for improved detection and response.