CloudSec Wine

🔶 Agentic SOC alert triage: 60% to 92% AI accuracy Elastic's InfoSec team describes how enriching a three-agent SOC triage pipeline with per-rule investigation guides, user risk data, and 30 days of historical case verdicts lifted AI alert accuracy from 60% to 92%, enabling analysts to close most alerts with a single Slack button click. https://www.elastic.co/security-labs/blog/alert-triage-agentic-soc-self-correcting-agents #aws

🔶 Incident response guide for AWS CloudTrail investigations AWS's Security Incident Response Team (SIRT) walks through two real-world CloudTrail investigation scenarios, cross-account S3 data deletion with ransomware implications and cryptocurrency mining via stolen console credentials, teaching investigators how to read key log fields, recognize attacker patterns, and apply practical response checklists. You can also check out Part 2. https://aws.amazon.com/ru/blogs/security/incident-response-guide-for-aws-cloudtrail-investigations-part-1 #aws

🔶 A scenario to evaluate your Agentic SOC A downloadable multi-source log dataset built around a 7-phase GitHub Actions cache poisoning → Kubernetes → AWS attack chain, used to benchmark agentic SOC harnesses. https://unsecure.sh/blog/agentic-soc-scenario/ #aws

🔶 Automate IAM Identity Center governance with continuous discovery and reporting A walkthrough deploying two AWS CDK stacks for IAM Identity Center governance: a reporting stack (EventBridge, Step Functions, Lambda, DynamoDB, API Gateway, S3) for automated daily discovery and CSV export, and a remediation stack for real-time event-driven enforcement and SNS notifications on non-compliant application assignments. https://aws.amazon.com/ru/blogs/security/automate-iam-identity-center-governance-with-continuous-discovery-and-reporting #aws

🔶 Extend your data perimeter to the AWS Management Console with Private Access AWS Management Console Private Access is now GA, routing all console traffic (auth, static assets, service APIs) through AWS PrivateLink VPC endpoints with no internet path required. VPC endpoint policies and Sign-In RCPs enforce identity, resource, and network perimeter controls on interactive console sessions. https://aws.amazon.com/ru/blogs/security/extend-your-data-perimeter-to-the-aws-management-console-with-private-access #aws

🤖Amazon Kiro: AI Is Breaking Vulnerability Disclosure Processes A prompt injection flaw in Amazon Kiro IDE v0.7.45 allowing attacker-controlled repository content to exfiltrate sensitive data via the powersRecommendationUrl setting and Kiro Powers, exploitable in both trusted and untrusted workspaces. https://mindgard.ai/blog/amazon-kiro-data-exfiltration #AI

🤖 When AI infrastructure becomes the target: Securing gateways and control points | Microsoft Security Blog Microsoft Threat Intelligence examines attacks on exposed AI workloads, including LiteLLM gateway exploitation, credential harvesting, persistence, and cryptomining activity. https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points #AI

🔶 Password spraying campaign targets AWS root user accounts across 150+ organizations Datadog Security Research observed a password spraying campaign targeting AWS root user accounts across 150+ organizations, attempting unauthorized authentication against these high-privilege accounts. https://securitylabs.datadoghq.com/articles/aws-root-user-bruteforce-campaign/ #aws

⛓️ Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns Malicious versions of the arrayref Rust crate (and others) executed a backdoor at compile time. The campaign's infrastructure overlaps with recent DPRK supply chain attacks, including Mastra and axios. https://www.wiz.io/blog/rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns #SupplyChainAttack

⛓️ Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns Malicious versions of the arrayref Rust crate (and others) executed a backdoor at compile time. The campaign's infrastructure overlaps with recent DPRK supply chain attacks, including Mastra and axios. https://www.wiz.io/blog/rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns #aws

🔶 From clickops to governed IaC: CloudFormation drift detection in practice A guide for migrating ClickOps-managed AWS infrastructure to governed CloudFormation IaC using IaC Generator for template generation, stack organization by lifecycle/ownership, and automated drift detection via EventBridge for continuous compliance monitoring. https://aws.amazon.com/ru/blogs/devops/from-clickops-to-governed-iac-cloudformation-drift-detection-in-practice #aws

🔶 Detecting multi-stage attacks on AWS: A guide to cross-service signal correlation A guide to detecting multi-stage AWS attacks by correlating signals across CloudTrail, VPC Flow Logs, and Route 53 DNS logs. Covers four business-context-aware patterns: unexpected S3 access, abnormal role chains, KMS key misuse, and off-hours privileged changes, with CloudWatch Logs Insights queries and Lambda automation. https://aws.amazon.com/ru/blogs/security/detecting-multi-stage-attacks-on-aws-a-guide-to-cross-service-signal-correlation #aws

🤖 How to evaluate LLMs before production Practical LLM evaluation lessons from GitHub secret scanning: define product goals and guardrails first, treat offline evaluation as repeatable integration testing, keep eval data close to production, audit labels, use error analysis, and apply LLM-as-judge for human review triage. https://github.blog/ai-and-ml/llms/how-to-evaluate-llms-before-production #AI

🤖 The AI-Native SDLC playbook Anthropic's stage-by-stage playbook for the AI-native SDLC: how teams plan, design, build, test, deploy, and maintain software with Claude. https://claude.com/blog/the-ai-native-sdlc-playbook #AI

🔴 Staying Ahead of Adversarial AI Through Agentic Source Code Review This blog describes the methodology that powers a Mandiant internal tool for point-in-time AI vulnerability discovery. It has discovered hundreds of vulnerabilities in customer codebases and resulted in dozens of vendor notifications with either assigned or pending CVE numbers. https://cloud.google.com/blog/topics/threat-intelligence/staying-ahead-of-adversarial-ai-through-agentic-source-code-review #gcp

🔶 Implement custom authentication for tools integration using request Lambda interceptor in AgentCore Gateway AgentCore Gateway supports OAuth 2.0, IAM, and API keys natively, but a request Lambda interceptor enables legacy Basic Auth integration. The interceptor validates the inbound JWT, retrieves system credentials from Secrets Manager, and constructs the Basic Auth header before forwarding to the downstream tool. https://aws.amazon.com/ru/blogs/security/implement-custom-authentication-for-tools-integration-using-request-lambda-interceptor-in-agentcore-gateway #aws

🤖 LiteLLM Supply Chain Attack: 2,500+ Companies Exposed in the Largest AI Supply Chain Breach of 2026 CloudSEK's research on the LiteLLM supply chain attack, the largest AI supply chain breach of 2026, names the organizations potentially exposed: 2,500+ companies and 434,000 CI/CD pipelines worldwide. https://www.cloudsek.com/blog/ai-supply-chain-breach-2500-companies-434000-cicd-pipelines #AI

🤖 Putting models to the secure coding test: Plan vs default mode Datadog tested Claude Sonnet 5, Composer 2.5, and GPT 5.5 in plan vs. default mode for secure code generation. No meaningful correlation between plan mode and improved security was found; explicit prompt-level security constraints had greater impact than mode selection. https://securitylabs.datadoghq.com/articles/putting-models-to-the-secure-coding-test-plan-vs-default-mode #AI

🔶 Threat hunt AI: How we built an AI security analyst on AWS for under $500/month Grow Therapy built a Claude-powered threat hunting system on ECS Fargate and Lambda, querying Snowflake and Datadog logs across 15 sources. A five-phase AI pipeline (data gathering, baseline comparison, enrichment, confidence scoring, adversarial validation) reduces false positives. Total cost: under $500/month. https://engineering.growtherapy.com/post/threat-hunt-ai-how-we-built-an-ai-security-analyst-on-aws-for-under-500-month #aws

⚠️ Going depthfirst: Achieving GitLab RCE via Two Ruby Memory. Corruption Vulnerabilities Researchers chained two memory-safety flaws in Oj, into remote code execution in a Puma worker. The path begins with an attacker-controlled Jupyter notebook and crosses GitLab, ipynbdiff, CRuby, and jemalloc before reaching function-pointer control. https://depthfirst.com/research/going-depthfirst-achieving-gitlab-rce-via-two-ruby-memory-corruption-vulnerabilities #AI