A lot of cloud service providers beyond AWS allow you to store data in something that looks and acts like S3, but there are differences worth investigating. Check out my latest article discussing the security risks that carry over and the assumptions that break. www.wiz.io/blog/s3-clon...

S3 Clones in the Neoclouds | Wiz Blog

S3 compatible services carry many of the same concerns as the original S3 service. This article highlights which assumptions break and what risks remain.

wiz.io

Happy birthday to the Cloud Security Forum Slack! It started 9 years ago and remains my favorite place for cloud security conversations with experts across the industry. fwdcloudsec.org/forum/

Cloud Security Forum | fwd:cloudsec

fwd:cloudsec is a non-profit conference on cloud security. At this conference you can expect discussions about all the major cloud platforms, both attack and defense research, limitations of security...

fwdcloudsec.org

Yesterday the White House signed a new Executive Order moving the deadlines for Post-Quantum Cryptography closer. I presented last week on PQC to give folks an understanding of what needs to be upgraded, visibility we see, and more. www.youtube.com/watch?v=BaRu...

The State of Post-Quantum Cryptography

YouTube video by Wiz

youtube.com

Post-Quantum Cryptography is getting attention lately, but there is barely any data out there about the progress being made... until now! www.wiz.io/blog/state-o...

State of Post Quantum Cryptography | Wiz Blog

Discussion of PQC relevant statistics that we see across our customers and other data sources.

wiz.io

"Funny and distressingly realistic...propelled by awesome characters and inventive twists” — Andy Weir Silicon Valley invents the time machine in my upcoming book PARADOX INC, now available for preorder everywhere! Here's a look inside from @people.com: people.com/paradox-inc-...

Former Google Employee Announces Silicon Valley Satire, ‘Paradox Inc.’ — See the Cover! (Exclusive)

Forrest Brazael, a former Google employee, chronicles the fall and rise of a time-travel startup in his forthcoming book, ‘Paradox Inc.’

people.com

The schedule for fwd:cloudsec North America is up! A few time slots are waiting for embargoes to clear. pretalx.com/fwd-cloudsec... We also still have some last minute tickets. The conference will be outside Seattle on June 1-2. fwdcloudsec.org/conference/n...

The CFP for fwd:cloudsec North America closes this Friday (March 20) at midnight Pacific time! Hotel and travel costs are taken care of for speakers (some caveats apply), plus tickets. Come speak June 1&2 near Seattle. fwdcloudsec.org/conference/n...

CFP | NA 2026 | fwd:cloudsec

fwd:cloudsec is a non-profit conference on cloud security. At this conference you can expect discussions about all the major cloud platforms, both attack and defense research, limitations of security...

fwdcloudsec.org

As a cloud security historian, it was fun to take a look at not just the what, but the why, of the changes in cloud security work over the years. www.wiz.io/blog/twenty-...

Twenty Years of Cloud Security Research | Wiz Blog

This post will look at the past 20 years of cloud security research, separating the two decades into eras with important milestones defined that resulted in the change of one era to the next.

wiz.io

It pains me when I hear people say "I thought about submitting a talk to the fwd:cloudsec, but didn't because..." and the reasons are often things I actually want to see presentations on! Some talk ideas I personally want to watch (the other reviewers and I will fight ⚔️):

Tickets for fwd:cloudsec North America go on sale today, in about 4 hours, at 10am PST. fwdcloudsec.org/conference/n...

fwd:cloudsec North America 2026 | fwd:cloudsec

fwd:cloudsec is a non-profit conference on cloud security. At this conference you can expect discussions about all the major cloud platforms, both attack and defense research, limitations of security...

fwdcloudsec.org

Tickets go on sale next week on Monday, Feb 9, at 10:00 a.m. PST for our North American conference happening near Seattle on June 1 and 2. An additional small batch will go on sale that evening at 11:00 p.m. PST. Tickets will be available for purchase here: www.eventbrite.com/e/fwdcloudse...

@fwdcloudsec.org is an awesome conference. Looking forward to seeing lots of cool submissions into the CFP!

fwd:cloudsec@fwdcloudsec.org · 7mo ago

We've locked in dates and venues for the North American (NA) and European (EU) fwd:cloudsec conferences this year! fwd:cloudsec NA will be in the Seattle, Washington area at the Meydenbauer Center in Bellevue on June 1 and 2. 🧵

Did you know Claude models have a "magic string" to test when a model refuses to respond? If that string enters prompt context, it can be abused to break LLM workflows until context is reset. It's the EICAR test string of the AI age. Details: hackingthe.cloud/ai-llm/explo...

Break LLM Workflows with Claude's Refusal Magic String - Hacking The Cloud

How Anthropic's refusal test string can be abused to stop streaming responses and create sticky failures.

hackingthe.cloud

We've locked in dates and venues for the North American (NA) and European (EU) fwd:cloudsec conferences this year! fwd:cloudsec NA will be in the Seattle, Washington area at the Meydenbauer Center in Bellevue on June 1 and 2. 🧵

What are we calling normal AWS now? Normal, standard, classic, commercial, global, american? How do you say out loud the acronym for AWS European Sovereign Cloud? I'm calling it "oosk", because the region is eusc-de-east-1, which sounds like a riff on the techno onomatopoeia "boots and cats".

The most surprising thing about AWS ESC is there aren't any cookie acceptance popup windows in the console. Is this really European?

Very cool research on a CodeBuild misconfiguration which could have had significant consequences. I’m a bit disappointed that there wasn’t more done to secure the supply chain after the Q Developer incident. www.wiz.io/blog/wiz-res...

CodeBreach: Supply Chain Vuln & AWS CodeBuild Misconfig | Wiz Blog

Wiz Research discovered CodeBreach, a critical vulnerability that risked the AWS Console supply chain. Learn how to secure your AWS CodeBuild pipelines.

wiz.io

The AWS European Sovereign Cloud (ESC) has launched! aws-news.com/article/2026...

Opening the AWS European Sovereign Cloud

AWS European Sovereign Cloud is now generally available, offering EU-based organizations independent cloud infrastructure with enhanced sovereignty controls, E...

aws-news.com

This seems bad. www.wiz.io/blog/wiz-res...

CodeBreach: Supply Chain Vuln & AWS CodeBuild Misconfig | Wiz Blog

Wiz Research discovered CodeBreach, a critical vulnerability that risked the AWS Console supply chain. Learn how to secure your AWS CodeBuild pipelines.

wiz.io

December is generally a good time for gifts, and I have a special one for you. We are glad to announce fwd:cloudsec Europe 2026: September 7th and 8th - London, UK 🇬🇧 More info to come early 2026. Stay tuned, folks.

This is the best write-up on threat actor tradecraft I've seen from AWS. aws.amazon.com/blogs/securi...

Cryptomining campaign targeting Amazon EC2 and Amazon ECS | Amazon Web Services

Amazon GuardDuty and our automated security monitoring systems identified an ongoing cryptocurrency (crypto) mining campaign beginning on November 2, 2025. The operation uses compromised AWS Identity ...

aws.amazon.com

My top picks from re:Invent security announcements: www.wiz.io/blog/top-aws...

Top AWS re:Invent Announcements for Security Teams in 2025 | Wiz Blog

The re:Invent announcements that are most impactful to security teams.

wiz.io

This is excellent. Also available in video. allan.reyes.sh/posts/keepin... h/t tldrsec

It’s time to bust some malware! 🦠 Challenge #6 “Malware Busters” is LIVE. Built by Gili Tikochinski for the reverse‑engineering pros - dive into assembly and uncover what’s hidden inside. Think you can crack it? cloudsecuritychampionship.com/challenge/6

The Ultimate Cloud Security Championship | 12 Months × 12 Challenges

Join our monthly cloud security CTF challenge, built by top Wiz researchers. Solve real-world scenarios and rise to the top of the leaderboard.

cloudsecuritychampionship.com

🚨 New Shai-Hulud-style npm attack hitting 25k+ repos and growing fast. Devs & CI/CD exposed via malicious preinstall. Wiz Research has detection + mitigation. Details: www.wiz.io/blog/shai-hu...

Shai-Hulud 2.0: Ongoing Supply Chain Attack | Wiz Blog

Detect and mitigate malicious npm packages linked to the recent Shai-Hulud-style campaign. Over 25,000 affected repositories across ~350 unique users.

wiz.io

The day has come where we get to announce what we've been working on for the past year 😍 www.duckbillhq.com/blog/skyway-...

Skyway: Cloud cost management for the 9-figure club

Introducing Skyway: contract management for enterprise cloud spend. Built by the team overseeing tens-of-billions in enterprise cloud spend.

duckbillhq.com

My favorite security story I've read this year 😂, a story of surprising turns by Alex Smolen: engseclabs.com/blog/raccoon...

Yuval Avrahami was ranked as the top Azure researcher by Microsoft this quarter! He has made a Kubernetes focused CTF for the Wiz Cloud Security Championship, check it out! cloudsecuritychampionship.com Also if you can find cloud zero days, check out www.zeroday.cloud with a $4.5M prize pool!

I feel like the biggest takeaway from the latest AWS outage is that there’s simply no architecting around them at this point. Even if you are 100% redundant/multi-whatever, your vendors and customers are certainly not. Order volume is dropping no matter what you do. We’re all in this together.

Jeep pushed a bad update on Friday that has been bricking 2024 Wrangle 4xe's. x.com/StephenGutow...

Stephen Gutowski on X: "Jeep just pushed a software update that bricked all the 2024 Wrangler 4xe models, including my Willys. The future is going great." / X

Jeep just pushed a software update that bricked all the 2024 Wrangler 4xe models, including my Willys. The future is going great.

x.com