emerging threats and vulnerabilities
October 29, 2026
Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder
All Categories
-
-
writing
October 26, 2026
Code security for new coders
-
emerging threats and vulnerabilities
October 21, 2026
PHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation
-
emerging threats and vulnerabilities
October 21, 2026
LiteLLM supply chain compromise: What you need to know
-
open source software
October 20, 2026
Introducing pathrunner: An AWS privilege escalation framework
-
research
October 19, 2026
Putting models to the secure coding test: Security rules
-
-
research
October 6, 2026
Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access
-
research
October 5, 2026
Guarding the gates: Assessing dangerous permissions granted to Kubernetes built-in principals
-
research
September 24, 2026
Discovering and exploiting a remote code execution vulnerability in OpenCode (GHSA-632h-h47v-g4x4)
-
research
September 18, 2026
Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms
-
research
September 16, 2026
Mapping out your unknown: A threat hunter’s guide to GitHub
-
research
August 31, 2026
Password spraying campaign targets AWS root user accounts across 150+ organizations
-
emerging threats and vulnerabilities
August 20, 2026
N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it
-
research
August 19, 2026
Putting models to the secure coding test: Plan vs default mode
-
emerging threats and vulnerabilities
August 4, 2026
'ChainDrop' worm compromises hundreds of popular npm packages
-
research
August 3, 2026
Before the first prompt: Code execution paths in trusted coding-agent projects
-
threat research
July 27, 2026
Detection primitives for eBPF rootkits
-
emerging threats and vulnerabilities
July 14, 2026
Compromised AsyncAPI npm packages: inside a CI supply-chain attack
-
emerging threats and vulnerabilities
July 9, 2026
Not-so-anonymous telemetry: The @injectivelabs/sdk-ts backdoor
-
research
July 8, 2026
Coordinated GitHub API enumeration and access token abuse
-
-
-
open source software
June 26, 2026
Introducing GuardDog 3.0: A new rules engine, transparent sandboxing, and more
-
research
June 24, 2026
Behind the console: An AiTM phishing kit harvesting AWS console credentials and beyond
-
emerging threats and vulnerabilities
June 22, 2026
Detecting the Klue supply chain attack in Salesforce instances
-
-
research
June 16, 2026
Mapping out your unknown: A threat hunter’s guide to Salesforce
-
research
June 15, 2026
Holding blobs for ransom: Four methods for Azure Storage ransomware
-
-
research
June 2, 2026
The case for GitHub Actions security after recent supply chain attacks
-
emerging threats and vulnerabilities
May 28, 2026
From Exploit Code to Production Detection: Building a CVE-2026-31431 (Copy Fail) detection with Agents
-
writing
May 21, 2026
Unpatchable Vulnerabilities of Kubernetes: CVE-2021-25740
-
research
May 18, 2026
Pathfinding Labs: Deploy, test, and learn from 100+ intentionally vulnerable AWS environments
-
emerging threats and vulnerabilities
May 14, 2026
Backdoored node-ipc npm releases steal developer credentials through DNS queries
-
emerging threats and vulnerabilities
May 14, 2026
Backdoored Cemu release linked to TanStack and Mistral supply chain campaign
-
emerging threats and vulnerabilities
May 13, 2026
Shai-Hulud Goes Open Source
-
research
May 11, 2026
Malicious Coding Agent Skills and the Risk of Dynamic Context
-
-
research
April 16, 2026
The case for dependency cooldowns in a post-axios world
-
writing
April 9, 2026
Unpatchable Vulnerabilities of Kubernetes: CVE-2020-8562
-
emerging threats and vulnerabilities
March 31, 2026
Compromised axios npm package delivers cross-platform RAT
-
writing
March 27, 2026
Unpatchable Vulnerabilities of Kubernetes: CVE-2020-8561
-
emerging threats and vulnerabilities
March 24, 2026
LiteLLM and Telnyx compromised on PyPI: Tracing the TeamPCP supply chain campaign
-
research
March 10, 2026
Uncovering agent logging gaps in Copilot Studio
-
research
March 9, 2026
Behind the console: Active phishing campaign targeting AWS console credentials
-
research
February 27, 2026
Hook, line, and vault: A technical deep dive into the 1Phish kit
-
writing
February 19, 2026
Kubernetes project issues warning on Ingress NGINX retirement
-
emerging threats and vulnerabilities
February 10, 2026
Tech impersonators: ClickFix and MacOS infostealers
-
research
February 4, 2026
Web Traffic Hijacking: When Your Nginx Configuration Turns Malicious
-
emerging threats and vulnerabilities
January 27, 2026
OpenSSL January 2026 Security Update: CMS and PKCS#12 Buffer Overflows
-
open source software
January 26, 2026
Introducing IDE-SHEPHERD: Your shield against threat actors lurking in your IDE
-
writing
January 14, 2026
Unpatchable Vulnerabilities of Kubernetes: CVE-2020-8554
-
research
January 7, 2026
Decoding the GitHub recommendations for npm maintainers
-
-
research
December 10, 2025
Investigating an adversary-in-the-middle phishing campaign targeting Microsoft 365 and Okta users
-
emerging threats and vulnerabilities
December 4, 2025
CVE-2025-55182 (React2Shell): Remote code execution in React Server Components and Next.js
-
emerging threats and vulnerabilities
November 25, 2025
The Shai-Hulud 2.0 npm worm: analysis, and what you need to know
-
-
writing
November 10, 2025
A 2025 look at real-world Kubernetes version adoption
-
emerging threats and vulnerabilities
November 6, 2025
MUT-4831: Trojanized npm packages deliver Vidar infostealer malware
-
research
November 5, 2025
A runtime security approach to detecting supply chain attacks
-
emerging threats and vulnerabilities
October 31, 2025
Datadog threat roundup: Top insights for Q3 2025
-
writing
October 30, 2025
Learnings from recent npm supply chain compromises
-
research
October 20, 2025
CoPhish: Using Microsoft Copilot Studio as a wrapper for OAuth phishing
-
emerging threats and vulnerabilities
August 26, 2025
CVE-2025-52882: WebSocket authentication bypass in Claude Code extensions
-
emerging threats and vulnerabilities
August 21, 2025
MCP vulnerability case study: SQL injection in the Postgres MCP server
-
research
August 19, 2025
Enumerating AWS the quiet way: CloudTrail-free discovery with Resource Explorer
-
emerging threats and vulnerabilities
August 14, 2025
Datadog threat roundup: Top insights for Q2 2025
-
-
-
research
July 21, 2025
Beyond Mimo’lette: Tracking Mimo's Expansion to Magento CMS and Docker
-
-
-
emerging threats and vulnerabilities
July 10, 2025
CVE-2025-48384: Git vulnerable to arbitrary file write on non-Windows systems
-
emerging threats and vulnerabilities
May 21, 2025
The obfuscation game: MUT-9332 targets Solidity developers via malicious VS Code extensions
-
research
May 13, 2025
Tales from the cloud trenches: The Attacker doth persist too much, methinks
-
emerging threats and vulnerabilities
May 7, 2025
RedisRaider: Weaponizing misconfigured Redis to mine cryptocurrency at scale
-
emerging threats and vulnerabilities
April 17, 2025
Datadog threat roundup: Top insights for Q1 2025
-
emerging threats and vulnerabilities
March 28, 2025
Understanding CVE-2025-29927: The Next.js Middleware Authorization Bypass Vulnerability
-
emerging threats and vulnerabilities
March 25, 2025
The 'IngressNightmare' vulnerabilities in the Kubernetes Ingress NGINX Controller: Overview, detection, and remediation
-
research
March 25, 2025
Creating immutable users through a bug in Entra ID restricted administrative units
-
-
-
emerging threats and vulnerabilities
January 24, 2025
Datadog threat roundup: top insights for Q4 2024
-
research
December 17, 2024
From Detection to Enforcement: Migrating from IMDSv1 to IMDSv2
-
research
December 16, 2024
Escalating privileges to read secrets with Azure Key Vault access policies
-
emerging threats and vulnerabilities
December 13, 2024
Getting a taste of your own medicine: Threat actor MUT-1244 targets offensive actors, leaking hundreds of thousands of credentials
-
-
open source software
December 6, 2024
Introducing Supply-Chain Firewall: Protecting Developers from Malicious Open Source Packages
-
emerging threats and vulnerabilities
November 22, 2024
MUT-8694: An NPM and PyPI Malicious Campaign Targeting Windows Users
-
research
October 29, 2024
Exploring Google Cloud Default Service Accounts: Deep Dive and Real-World Adoption Trends
-
emerging threats and vulnerabilities
October 24, 2024
Tenacious Pungsan: A DPRK threat actor linked to Contagious Interview
-
-
emerging threats and vulnerabilities
September 27, 2024
Remote execution exploit chain in CUPS: Overview, detection, and remediation
-
research
September 23, 2024
Threat Actors leverage Docker Swarm and Kubernetes to mine cryptocurrency at scale
-
-
research
September 16, 2024
Hidden in Plain Sight: Abusing Entra ID Administrative Units for Sticky Persistence
-
writing
September 9, 2024
A SaaS provider's guide to securely integrating with customers' AWS accounts
-
writing
September 5, 2024
Kubernetes security fundamentals: Admission Control
-
emerging threats and vulnerabilities
August 20, 2024
The gift that keeps on giving: A new opportunistic Log4j campaign
-
-
open source software
August 9, 2024
Shorten your detection engineering feedback loops with Grimoire
-
open source software
August 8, 2024
Introducing GuardDog 2.0: YARA scanning, user-supplied rules, and Golang support
-
-
emerging threats and vulnerabilities
July 31, 2024
Stressed Pungsan: DPRK-aligned threat actor leverages npm for initial access
-
-
emerging threats and vulnerabilities
July 1, 2024
RegreSSHion vulnerability CVE-2024-6387: Overview, detection, and remediation
-
research
June 28, 2024
Who polices your policies? Azure policy abuse for privileges escalation and persistence
-
-
research
June 19, 2024
Tales from the cloud trenches: Raiding for AWS vaults, buckets and secrets
-
emerging threats and vulnerabilities
June 13, 2024
Attackers deploying new tactics in campaign targeting exposed Docker APIs
-
emerging threats and vulnerabilities
June 7, 2024
A guide to threat hunting and monitoring in Snowflake
-
research
May 28, 2024
Non-Production Endpoints as an Attack Surface in AWS
-
emerging threats and vulnerabilities
May 23, 2024
Malicious PyPI packages targeting highly specific MacOS machines
-
research
April 15, 2024
Amplified exposure: How AWS flaws made Amplify IAM roles vulnerable to takeover
-
emerging threats and vulnerabilities
April 3, 2024
The XZ Utils backdoor (CVE-2024-3094): Everything you need to know, and more
-
research
March 22, 2024
A threat-informed roadmap for securing Kubernetes clusters (KubeCon EU 2024)
-
research
March 15, 2024
Tales from the cloud trenches: Using AWS CloudTrail to identify malicious activity and spot phishing campaigns
-
writing
February 12, 2024
Kubernetes security fundamentals: Authentication
-
-
research
January 19, 2024
Tales from the cloud trenches: Amazon ECS is the new EC2 for crypto mining
-
research
January 10, 2024
From IRC to Instant Messaging: The Rise of Malware Communication via Chat Platforms
-
-
writing
December 19, 2023
Deep dive into the new Amazon EKS Cluster Access Management features
-
writing
December 7, 2023
Kubernetes security fundamentals: API Security
-
writing
November 28, 2023
Deep dive into the new Amazon EKS Pod Identity feature
-
writing
October 27, 2023
The Kubernetes CVE-2023-3676 Windows command injection vulnerability - exploitation and prevalence
-
emerging threats and vulnerabilities
October 13, 2023
The Confluence CVE-2023-22515 vulnerability: Overview, detection, and remediation
-
research
October 11, 2023
Following attackers’ (Cloud)trail in AWS: Methodology and findings in the wild
-
-
open source software
October 2, 2023
KubeHound: Identifying attack paths in Kubernetes clusters
-
-
-
-
writing
August 4, 2023
Container security fundamentals part 5: AppArmor and SELinux
-
research
July 27, 2023
No keys attached: Exploring GitHub-to-AWS keyless authentication flaws
-
writing
June 1, 2023
Misconfiguration Spotlight: Securing the EC2 Instance Metadata Service
-
-
writing
May 16, 2023
Attacking and securing cloud identities in managed Kubernetes part 1: Amazon EKS
-
emerging threats and vulnerabilities
May 10, 2023
The OverlayFS vulnerability CVE-2023-0386: Overview, detection, and remediation
-
open source software
May 2, 2023
Introducing HASH: The HTTP Agnostic Software Honeypot framework
-
-
-
-
open source software
March 30, 2023
Identify and remediate common cloud risks with the Datadog Cloud Security Atlas
-
research
March 20, 2023
Bypassing CloudTrail in AWS Service Catalog, and Other Logging Research
-
writing
March 13, 2023
Container security fundamentals part 2: Isolation & namespaces
-
writing
February 23, 2023
Container security fundamentals: Exploring containers as processes
-
-
open source software
February 14, 2023
Announcing GuardDog 1.0, with npm support, new heuristics, and easier CI integration
-
research
February 6, 2023
Discovering a weakness leading to a partial bypass of the login rate limiting in the AWS Console
-
research
January 17, 2023
AWS CloudTrail vulnerability: Undocumented API allows CloudTrail bypass
-
writing
December 29, 2022
Datadog Security Labs 2022 in review: Highlights from our inaugural year
-
research
December 21, 2022
A retrospective on public cloud breaches of 2022, with Rami McCarthy and Houston Hopkins
-
-
writing
December 1, 2022
Attacker persistence in Kubernetes using the TokenRequest API: Overview, detection, and prevention
-
emerging threats and vulnerabilities
November 23, 2022
Investigating a backdoored PyPi package targeting FastAPI applications
-
research
November 21, 2022
A confused deputy vulnerability in AWS AppSync
-
open source software
November 15, 2022
Finding malicious PyPI packages through static code analysis: Meet GuardDog
-
emerging threats and vulnerabilities
November 1, 2022
The OpenSSL punycode vulnerability (CVE-2022-3602): Overview, detection, exploitation, and remediation
-
-
research
October 11, 2022
Improving your AWS Security posture: Key learnings from the State of AWS Security study
-
research
October 5, 2022
State of AWS Security in 2022: A look into real-world AWS environments
-
-
-
-
-
open source software
August 13, 2022
Introducing Threatest, a CLI and Go framework for end-to-end testing of threat detection rules
-
-
-
emerging threats and vulnerabilities
June 7, 2022
The Confluence RCE vulnerability (CVE-2022-26134): Overview, detection, and remediation
-
emerging threats and vulnerabilities
April 1, 2022
The Spring4Shell vulnerability: Overview, detection, and remediation
-
emerging threats and vulnerabilities
March 25, 2022
Escaping containers using the Dirty Pipe vulnerability
-
emerging threats and vulnerabilities
January 28, 2022
The PwnKit vulnerability: Overview, detection, and remediation
-
emerging threats and vulnerabilities
January 28, 2022
The Dirty Pipe vulnerability: Overview, detection, and remediation
-
open source software
January 27, 2022
Elevate AWS threat detection with Stratus Red Team
-
emerging threats and vulnerabilities
December 14, 2021
The Log4j Log4Shell vulnerability: Overview, detection, and remediation
work with us
We're always looking for talented people to collaborate with
featured positions
We have 2 positions
view all