cloudsek.com resources

cloudsek.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-08-20.

Supply Chain 4 SSRF 2 AI 1 API Sec 1 OSINT 1 Secrets 1

Date Added	Resource	Excerpt
2026-08-20 2026	AI Supply Chain Security: How to Defend the AI Stack Supply Chain	Library for securing AI supply chains, protecting components from training datasets and pre-trained models to build pipelines and gateways. It details attack vectors like dataset poisoning, malicious models on hubs (e.g., Hugging Face), dependency confusion (e.g., PyTorch, npm), build pipeline compromise (e.g., GitHub Actions, Ultralytics YOLO), and compromised tooling (e.g., Trivy, Checkmarx KICS). The library explains the six stages of AI supply chain attacks, from upstream compromise to credential reuse, highlighting how compromised junction assets and opaque artifacts create significant risks.
2026-08-18 2026	AI Supply Chain Security: How to Defend the AI Stack Supply Chain	Library for defending AI supply chains, which encompasses securing training datasets, pre-trained models, packages, build pipelines, gateways, and vendors. It details how attackers leverage upstream component compromises to reach thousands of downstream environments, citing the March 2026 incident where a compromised AI gateway package exposed over 2,500 organizations and 434,000 CI/CD pipelines. The library differentiates AI supply chains from traditional software supply chains across five dimensions, highlighting opacity, data poisoning (as seen with PoisonGPT), malicious models on hubs (like Hugging Face), dependency compromise (PyTorch torchtriton, npm packages), build pipeline compromise (Ultralytics YOLO), and tooling compromise (Trivy, Checkmarx KICS) as key attack vectors.
2026-08-16 2026	CI/CD Credential Exposure: What Attackers Steal From Pipelines and What to Rotate Secrets	Library detailing CI/CD credential exposure, encompassing leaked secrets like cloud keys and access tokens through dependencies, logs, artifacts, workflow files, and platforms. It analyzes the LiteLLM supply chain attack, attributed to TeamPCP, which potentially exposed thousands of organizations and pipelines, highlighting how attackers steal seven major credential classes including VCS credentials and AI provider keys. The library explains credential leakage paths such as malicious dependencies, workflow injection, logs, CI platform compromise, over-scoped tokens, and self-propagating worms, while also discussing detection challenges due to theft occurring during legitimate build processes and the efficacy of memory scraping over log masking.
2026-07-18 2026	What Is API-Driven Threat Intelligence?API Sec	Library for API-driven threat intelligence, automating the sharing of cyber threat data like Indicators of Compromise (IOCs), Indicators of Attack (IOAs), and Tactics, Techniques, and Procedures (TTPs) between security systems using structured formats such as STIX and TAXII. This enables continuous updates, faster detection, and coordinated responses by integrating with SIEM and SOAR platforms for automated actions and threat hunting.
2026-07-08 2026	What is Prompt Injection? How it Works and How to Prevent It AI	Library for understanding and defending against prompt injection attacks, a top risk for LLM Applications, including techniques like EchoLeak (CVE-2025-32711) impacting Microsoft 365 Copilot and the OWASP LLM Top 10 designation. It details how instruction-overriding, natural-language-based, model-agnostic, and hard-to-eliminate attacks work, differentiating them from jailbreaking, and covers risks such as data theft and remote code execution. The library also explores methods to reduce this threat in connected systems and agentic AI.
2026-06-03 2026	How an Unauthenticated MCP Server Led to SSRF LFI and AWS Credential Theft SSRF	Writeup of a real-world attack chaining Server-Side Request Forgery (SSRF), Local File Inclusion (LFI), and AWS credential theft via an unauthenticated Model Context Protocol (MCP) server. This finding highlights the rapid adoption of MCP for AI integrations, outpacing security maturity and leaving systems vulnerable to exploitation, as demonstrated by the theft of live AWS IAM credentials and database secrets from a customer environment.
2026-06-02 2026	How an Unauthenticated MCP Server Led to SSRF LFI and AWS Credential Theft SSRF	Library for discovering and analyzing security risks in AI integrations. It highlights vulnerabilities in Model Context Protocol (MCP) servers, such as Server-Side Request Forgery (SSRF) and Local File Inclusion (LFI), demonstrated by a real-world case study where an unauthenticated MCP server led to AWS credential theft. The library addresses the growing attack surface created by rapid AI adoption and the security maturity gap in new AI-native technologies.
2026-05-14 2026	Inside a Tor Backed Supply Chain Worm Supply Chain	Library for detecting sophisticated npm supply chain attacks, featuring the `crypto-javascri` package that mimics `crypto-js`. This malicious package harvests npm and GitHub credentials, hijacks maintainer accounts to republish trojanized packages, and deploys a Tor-based command-and-control implant. The worm targets Linux developer systems and CI/CD environments, propagating by injecting itself into legitimate packages and updating their versions.
2026-04-11 2026	The Scanner Was the Weapon: 36 Months of Precision Supply Chain Attacks Against DevSecOps Infrastructure Supply Chain	Library detailing 36 months of precision supply chain attacks, highlighting compromises of DevSecOps tools like vulnerability scanners and CI/CD pipelines. It examines the XZ Utils backdoor (CVE-2024-3094), the reviewdog GitHub Actions compromise (CVE-2025-30066 / CVE-2025-30154), and the multi-stage infostealer targeting Aqua Security's Trivy. The analysis reveals attacker sophistication in targeting trusted software, leveraging build-time injection and automated trust exploitation.
2026-04-06 2026	10 Best Threat Intelligence Tools In 2026 OSINT	Library of threat intelligence tools for 2026, including CloudSEK, Recorded Future, CrowdStrike, Mandiant, and Microsoft, were evaluated for their predictive depth, contextual accuracy, and integration with operational security workflows. These platforms collect, analyze, and contextualize information about emerging cyber threats from various sources, including dark web communities and malware repositories. Key features reviewed include external attack surface monitoring, brand impersonation detection, infrastructure exposure tracking, and integration with SIEM, SOAR, and XDR systems for improved detection and response.