Azure Function Apps with system-assigned managed identities are a common privilege escalation path in cloud penetration tests and real-world breaches. An over-permissive managed identity on a vulnerable function can hand an attacker Subscription Owner. Here's how the path works and how to close it.
LLM API keys are a new class of cloud credential with distinct theft and abuse patterns. Unlike traditional API keys, a stolen AI key burns compute budget in real time and can be used to exfiltrate data through model interactions. Here's how to harden AWS Bedrock, Azure OpenAI, and GCP Vertex AI deployments.
Istio is widely adopted for zero-trust Kubernetes networking, but misconfigured PeerAuthentication and AuthorizationPolicy resources silently collapse mTLS guarantees. This guide covers the most dangerous misconfigurations, how attackers exploit them, and hardened configurations with policy snippets.
Azure ML workspaces grant Jupyter notebooks, compute clusters, and pipelines access to storage, secrets, and sometimes subscription-level IAM. This guide covers the most dangerous misconfiguration patterns and how to lock them down.
Threat actors who compromise Azure tenants routinely add credentials to existing service principals or create malicious app registrations with broad API permissions to maintain persistent, stealthy access. This guide covers the attack path, Microsoft Graph API abuse patterns, and the controls that detect and prevent app-based persistence.
CVE-2026-34040 in the Docker daemon allows creation of a privileged container with root-level host access, exposing AWS credentials, SSH keys, and Kubernetes configs stored on the host. AI coding agents have been demonstrated as a novel exploitation vector via prompt injection. Here's how to assess exposure and remediate.
SageMaker environments are routinely misconfigured in ways that expose sensitive training data, model artefacts, and high-privilege AWS credentials. This guide covers the most dangerous attack paths — from notebook instance escape to training job credential theft — with CLI-level remediation steps.
A local privilege escalation in the Linux kernel's AF_ALG socket subsystem lets any unprivileged container process gain root on the node. IBM Cloud Kubernetes Service clusters running 1.32 through 1.35 are affected. Here's what to patch and how to harden before you can.
GitLab CI/CD pipelines are an increasingly exploited attack surface. CI_JOB_TOKEN abuse, unprotected pipeline triggers, insecure remote includes, and OIDC misconfigurations can expose cloud credentials, registry tokens, and signing keys. This guide covers the attack paths and how to close them.