Principal Security Architect & Partner at https://xitter.cf/t.co/yIU71SfS40, CloudSec Researcher. Find me at bsky
Oslo, Norway
Joined August 2012
- Tweets1.3K
- Following737
- Followers818
- Likes3.2K
Every supply-chain attack affecting the npm ecosystem, the most common apps I find vulnerable are the vibe-coded ones due to lack of version pinning..
If @Cursor and other coding platforms make pinning the default, we'll see less runtime environments affected.
Karim El-Melhaoui retweeted
Shai-Hulud 2.0, a tale of 4 graphs: many numbers have made the news in regards to this story - such as 800 compromised packages - but visualizing the data clearly shows the potential impact of hijacking even a small set of key packages (in terms of prevalence or dependents):
Karim El-Melhaoui retweeted
🚨 New Shai-Hulud-style npm attack hitting 25k+ repos and growing fast.
Devs & CI/CD exposed via malicious preinstall. Wiz Research has detection + mitigation.
Details: wiz.io/blog/shai-hulud-2-0-o…
Karim El-Melhaoui retweeted
The schedule for fwd:cloudsec Europe is out, with a single track of high-quality talks over 2 days, along with “Birds of a Feather” interactive sessions!
fwdcloudsec.org/conference/e…
Some sponsorship opportunities are still available
Great work by the @SpecterOps team adding Entra ID to GitHub attack paths! Will officially archive once I can validate it supports OIDC github.com/O3-Cyber/oidc-cod…
I’m left wondering how many unpaid AWS bills are related to this.
Front row seat on @paulschwarzen session presenting OWASP Domain Protect at @AppSecEU 👏
Reminder that the fwd:cloudsec Europe 2025 Call for Papers is open!
First time speakers who requested feedback by May 30th and meet the submission criteria will receive feedback on how to improve during the second round.
For more: fwdcloudsec.org/conference/e…
What happens if a lambda that puts an event to an S3 triggers on the same S3… I can’t afford to find out
Karim El-Melhaoui retweeted
🏃♂️Meet ImageRunner: A privilege escalation vulnerability I discovered in GCP Cloud Run.
Thank you for the @GoogleVRP team for working closely with us on this one.
*Stay tuned for more blogs to come!
tenable.com/blog/imagerunner…
Karim El-Melhaoui retweeted
📖 CloudSecList Issue 276 just got released, w/ content from @HuntressLabs @elasticseclabs @O3CYBER @InvictusIRand more!
cloudseclist.com/issues/issu…
Last week, we presented our latest research into Azure and OIDC where we also released our latest tool for mapping attack paths between Azure and GitHub
o3c.no/knowledge/tool-releas…
Karim El-Melhaoui retweeted
This looks like another security incident that may have been caused by "request collapsing". If you use AWS CloudFront, I encourage you to read an older blog post I wrote on this "feature" as it does something many don't expect. swedenherald.com/article/nor…
wiz.io/blog/preventing-risk-…
Karim El-Melhaoui retweeted
🎙️ The podcast that CISOs share in their private channels is *back*! 🎊
Thank you to our guests for making the first 2 seasons incredible.
This week: @AmitaiCo & Eden Naftali chat with @karimscloud on open-source dangers & stronger security standards.
🎧 Ready for S3?
Karim El-Melhaoui retweeted
AWS just released RCP examples to prevent OIDC misconfigurations from many third-party vendors. 😍 github.com/aws-samples/resou…
This prevents the problem I wrote about here: wiz.io/blog/avoiding-mistake…