A new version of AWS Security Hub is now generally available with new capabilities to aggregate, correlate, and contextualize your security alerts across Amazon Web Services (AWS) accounts. The prior version is now known as AWS Security Hub CSPM and will continue to be available as a unique service ...
Amazon GuardDuty and our automated security monitoring systems identified an ongoing cryptocurrency (crypto) mining campaign beginning on November 2, 2025. The operation uses compromised AWS Identity and Access Management (IAM) credentials to target Amazon Elastic Container Service (Amazon ECS) and ...
AWS incident response operates around the clock to protect our customers, the AWS Cloud, and the AWS global infrastructure. Through that work, we learn from a variety of issues and spot unique trends. Over the past few months, high-profile software supply chain threat campaigns involving third party...
As we conclude 2025, Amazon Threat Intelligence is sharing insights about a years-long Russian state-sponsored campaign that represents a significant evolution in critical infrastructure targeting: a tactical pivot where what appear to be misconfigured customer network edge devices became the primar...
Modern web applications built on Amazon Web Services (AWS) often span multiple services to deliver scalable, performant solutions. However, customers encounter challenges when implementing a cohesive HTTP Strict Transport Security (HSTS) strategy across these distributed architectures. Customers fac...
At Amazon Web Services (AWS), we continue to invest in and deliver digital sovereignty solutions to help customers meet their most sensitive workload requirements. To address the regulatory and digital sovereignty needs of public sector and regulated industry customers, we launched AWS Dedicated Loc...
At Amazon Web Services, we’re committed to deeply understanding the evolving needs of both our customers and regulators, and rapidly adapting and innovating to meet them. The upcoming AWS European Sovereign Cloud will be a new independent cloud for Europe, designed to give public sector organization...
August 31, 2023: The date this blog post was first published. Over the past few decades, digital technologies have brought tremendous benefits to our societies, governments, businesses, and everyday lives. The increasing reliance on digital technologies comes with a broad responsibility for society,...
Over the first half of this year, AWS WAF introduced new application-layer protections to address the growing trend of short-lived, high-throughput Layer 7 (L7) distributed denial of service (DDoS) attacks. These protections are provided through the AWS WAF Anti-DDoS AWS Managed Rules (Anti-DDoS AMR...
Today, we’re excited to announce IAM Policy Autopilot, an open-source static analysis tool that helps your AI coding assistants quickly create baseline AWS Identity and Access Management (IAM) policies that you can review and refine as your application evolves. IAM Policy Autopilot is available as a...
At re:Invent 2025, AWS unveiled its latest AI- and automation-enabled innovations to strengthen cloud security for customers to grow their business. Organizations are likely to increase security spending from $213 billion in 2025 to $377 billion by 2028 as they adopt generative AI. This 77% increase...
December 12, 2025: The blog post was updated to clarify when customers need to update their ReactJS version. Within hours of the public disclosure of CVE-2025-55182 (React2Shell) on December 3, 2025, Amazon threat intelligence teams observed active exploitation attempts by multiple China state-nexus...
Public Key Infrastructure (PKI) is essential for securing and establishing trust in digital communications. As you scale your digital operations, you’ll issue and revoke certificates. Revoking certificates is useful especially when employees leave, migrate to a new certificate authority hierarchy, m...
In this post, we introduce the AWS provider for the Secrets Store CSI Driver, a new AWS Secrets Manager add-on for Amazon Elastic Kubernetes Service (Amazon EKS) that you can use to fetch secrets from Secrets Manager and parameters from AWS Systems Manager Parameter Store and mount them as files in ...
Although AWS Secrets Manager excels at managing the lifecycle of Amazon Web Services (AWS) secrets, managing credentials from third-party software providers presents unique challenges for organizations as they scale usage of their cloud applications. Organizations using multiple third-party services...
Amazon Web Services (AWS) is introducing guidelines for network scanning of customer workloads. By following these guidelines, conforming scanners will collect more accurate data, minimize abuse reports, and help improve the security of the internet for everyone. Network scanning is a practice in mo...
Exposed long-term credentials continue to be the top entry point used by threat actors in security incidents observed by the AWS Customer Incident Response Team (CIRT). The exposure and subsequent use of long-term credentials or access keys by threat actors poses security risks in cloud environments...
If you’ve ever spent hours manually digging through AWS CloudTrail logs, checking AWS Identity and Access Management (IAM) permissions, and piecing together the timeline of a security event, you understand the time investment required for incident investigation. Today, we’re excited to announce the ...
As generative AI became mainstream, Amazon Web Services (AWS) launched the Generative AI Security Scoping Matrix to help organizations understand and address the unique security challenges of foundation model (FM)-based applications. This framework has been adopted not only by AWS customers across t...
We’re pleased to announce the availability of the latest sample security baseline from Landing Zone Accelerator on AWS (LZA)—the Universal Configuration. Developed from years of field experience with highly regulated customers including governments across the world, and in consultation with AWS Part...
📖 [The CloudSecList] Issue 318 was originally published by Marco Lancini at CloudSecList on December 14, 2025.
...📖 [The CloudSecList] Issue 317 was originally published by Marco Lancini at CloudSecList on December 07, 2025.
...📖 [The CloudSecList] Issue 316 was originally published by Marco Lancini at CloudSecList on November 30, 2025.
...📖 [The CloudSecList] Issue 315 was originally published by Marco Lancini at CloudSecList on November 23, 2025.
...📖 [The CloudSecList] Issue 314 was originally published by Marco Lancini at CloudSecList on November 16, 2025.
...📖 [The CloudSecList] Issue 313 was originally published by Marco Lancini at CloudSecList on November 09, 2025.
...📖 [The CloudSecList] Issue 312 was originally published by Marco Lancini at CloudSecList on November 02, 2025.
...📖 [The CloudSecList] Issue 311 was originally published by Marco Lancini at CloudSecList on October 26, 2025.
...📖 [The CloudSecList] Issue 310 was originally published by Marco Lancini at CloudSecList on October 19, 2025.
...📖 [The CloudSecList] Issue 309 was originally published by Marco Lancini at CloudSecList on October 12, 2025.
...📖 [The CloudSecList] Issue 308 was originally published by Marco Lancini at CloudSecList on October 05, 2025.
...📖 [The CloudSecList] Issue 307 was originally published by Marco Lancini at CloudSecList on September 28, 2025.
...📖 [The CloudSecList] Issue 306 was originally published by Marco Lancini at CloudSecList on September 21, 2025.
...📖 [The CloudSecList] Issue 305 was originally published by Marco Lancini at CloudSecList on September 14, 2025.
...📖 [The CloudSecList] Issue 304 was originally published by Marco Lancini at CloudSecList on September 07, 2025.
...📖 [The CloudSecList] Issue 303 was originally published by Marco Lancini at CloudSecList on August 31, 2025.
...📖 [The CloudSecList] Issue 302 was originally published by Marco Lancini at CloudSecList on August 24, 2025.
...📖 [The CloudSecList] Issue 301 was originally published by Marco Lancini at CloudSecList on August 17, 2025.
...📖 [The CloudSecList] Issue 300 was originally published by Marco Lancini at CloudSecList on August 10, 2025.
...📖 [The CloudSecList] Issue 299 was originally published by Marco Lancini at CloudSecList on August 03, 2025.
...📖 [The CloudSecList] Issue 298 was originally published by Marco Lancini at CloudSecList on July 27, 2025.
...📖 [The CloudSecList] Issue 297 was originally published by Marco Lancini at CloudSecList on July 20, 2025.
...📖 [The CloudSecList] Issue 296 was originally published by Marco Lancini at CloudSecList on July 13, 2025.
...📖 [The CloudSecList] Issue 295 was originally published by Marco Lancini at CloudSecList on July 06, 2025.
...📖 [The CloudSecList] Issue 294 was originally published by Marco Lancini at CloudSecList on June 29, 2025.
...📖 [The CloudSecList] Issue 293 was originally published by Marco Lancini at CloudSecList on June 22, 2025.
...📖 [The CloudSecList] Issue 292 was originally published by Marco Lancini at CloudSecList on June 15, 2025.
...📖 [The CloudSecList] Issue 291 was originally published by Marco Lancini at CloudSecList on June 08, 2025.
...📖 [The CloudSecList] Issue 290 was originally published by Marco Lancini at CloudSecList on June 01, 2025.
...📖 [The CloudSecList] Issue 289 was originally published by Marco Lancini at CloudSecList on May 25, 2025.
...📖 [The CloudSecList] Issue 288 was originally published by Marco Lancini at CloudSecList on May 18, 2025.
...📖 [The CloudSecList] Issue 287 was originally published by Marco Lancini at CloudSecList on May 11, 2025.
...📖 [The CloudSecList] Issue 286 was originally published by Marco Lancini at CloudSecList on May 04, 2025.
...📖 [The CloudSecList] Issue 285 was originally published by Marco Lancini at CloudSecList on April 27, 2025.
...📖 [The CloudSecList] Issue 284 was originally published by Marco Lancini at CloudSecList on April 20, 2025.
...📖 [The CloudSecList] Issue 283 was originally published by Marco Lancini at CloudSecList on April 13, 2025.
...📖 [The CloudSecList] Issue 282 was originally published by Marco Lancini at CloudSecList on April 06, 2025.
...📖 [The CloudSecList] Issue 281 was originally published by Marco Lancini at CloudSecList on March 30, 2025.
...📖 [The CloudSecList] Issue 280 was originally published by Marco Lancini at CloudSecList on March 23, 2025.
...📖 [The CloudSecList] Issue 279 was originally published by Marco Lancini at CloudSecList on March 16, 2025.
...📖 [The CloudSecList] Issue 278 was originally published by Marco Lancini at CloudSecList on March 09, 2025.
...📖 [The CloudSecList] Issue 277 was originally published by Marco Lancini at CloudSecList on March 02, 2025.
...📖 [The CloudSecList] Issue 276 was originally published by Marco Lancini at CloudSecList on February 23, 2025.
...📖 [The CloudSecList] Issue 275 was originally published by Marco Lancini at CloudSecList on February 16, 2025.
...📖 [The CloudSecList] Issue 274 was originally published by Marco Lancini at CloudSecList on February 09, 2025.
...📖 [The CloudSecList] Issue 273 was originally published by Marco Lancini at CloudSecList on February 02, 2025.
...📖 [The CloudSecList] Issue 272 was originally published by Marco Lancini at CloudSecList on January 26, 2025.
...📖 [The CloudSecList] Issue 271 was originally published by Marco Lancini at CloudSecList on January 19, 2025.
...📖 [The CloudSecList] Issue 270 was originally published by Marco Lancini at CloudSecList on January 12, 2025.
...📖 [The CloudSecList] Issue 269 was originally published by Marco Lancini at CloudSecList on January 05, 2025.
...📖 [The CloudSecList] Issue 268 was originally published by Marco Lancini at CloudSecList on December 15, 2024.
...📖 [The CloudSecList] Issue 267 was originally published by Marco Lancini at CloudSecList on December 08, 2024.
...📖 [The CloudSecList] Issue 266 was originally published by Marco Lancini at CloudSecList on December 01, 2024.
...📖 [The CloudSecList] Issue 265 was originally published by Marco Lancini at CloudSecList on November 24, 2024.
...📖 [The CloudSecList] Issue 264 was originally published by Marco Lancini at CloudSecList on November 17, 2024.
...📖 [The CloudSecList] Issue 263 was originally published by Marco Lancini at CloudSecList on November 10, 2024.
...📖 [The CloudSecList] Issue 262 was originally published by Marco Lancini at CloudSecList on November 03, 2024.
...📖 [The CloudSecList] Issue 261 was originally published by Marco Lancini at CloudSecList on October 27, 2024.
...📖 [The CloudSecList] Issue 260 was originally published by Marco Lancini at CloudSecList on October 20, 2024.
...I am annoyed at the common traps security vendors fall into when producing research....
Wiz Research has uncovered 550+ secrets hiding in plain sight. We worked with Microsoft to shut the door....
A visual analysis of the Shai-Hulud attack....
Detect and mitigate a critical supply chain compromise affecting over 100+ packages, organizations should act urgently....
A deeper look at the Nx supply chain attack. Analyzing the performance of AI-powered malware, calculating incident impact, and sharing novel TTPs for further investigation....
Detect and mitigate a critical supply chain compromise affecting the Nx NPM Package. Organizations should act urgently....
Tips and tricks for handling the fact that conference talks and engineering blogs are often quilted from small omissions and half-truths....
How has AI-assisted development impacted secrets leakage?...
Vibe coding with AI is fast, but how can we make it safer...
Infographic with five new facts about the tj-actions attack....
This isn’t really about serverless. It’s about what happens when infrastructure stops asking humans to guess the future....
After years of running, my heart finally told me to slow down. This is the story of how a heart condition, burnout, and a year of loss helped me find a new rhythm....
A complete TypeScript rewrite with drop-in ORM support, full mysql2/pg compatibility layers, and smarter parsing for Aurora Serverless v2's Data API....
I’ve spent my entire career building products, but in the age of AI, the challenge is finding a way to preserve our humanity while everything accelerates around us....
As I step into this exciting new role, I look forward to a bright future for Ampt, Off-by-none, and my commitment to the cloud and serverless communities...
An optimistic warming strategy to mitigate cold starts for low-traffic AWS Lambda functions....
View on sreweekly.com Eliminating Cold Starts 2: shard and conquer Cloudflare reduced their cold-start rate for Workers requests through sharding and consistent hashing, with an interesting solution for load shedding. Harris Hancock — Cloudflare Monitoring & Observability: Usi...
View on sreweekly.com A message from our sponsor, Depot: “Waiting for a runner” but the runner is online? Depot debugs three cases where symptoms misled engineers. Workflow permissions, Azure authentication, and Dependabot’s security context all caused failures that looked like inf...
View on sreweekly.com A message from our sponsor, Depot: Stop hunting through GitHub Actions logs. Depot now offers powerful CI log search across all your repositories and workflows. With smart filtering by timeframe, runner type, and keywords, you’ll have all the information at your fingertips to d...
View on sreweekly.com Fix-mas Countdown The folks at Uptime Labs and Advanced Capacity Labs have announced an advent calendar for this December. Note: In order to take part, you’ll need to provide an email address to subscribe. I gave that some serious thought before including this here, but u...
View on sreweekly.com A message from our sponsor, Costory: You didn’t sign up to do FinOps. Costory automatically explains why your cloud costs change, and reports it straight to Slack. Built for SREs who want to code, not wrestle with spreadsheets. Now on AWS & GCP Marketplaces. Start your free...
Physical data center maintenance is risky on a global network. We built a maintenance scheduler on Workers to safely plan disruptive operations, while solving scaling challenges by viewing the state of our infrastructure through a graph interface on top of multiple data sources and metrics pipelines...
We have declared “Code Orange: Fail Small” to focus everyone at Cloudflare on a set of high-priority workstreams with one simple goal: ensure that the cause of our last two global outages never happens again....
Cloudflare's H1 2025 Transparency Report is here. We discuss our principles on content blocking and our innovative approach to combating unauthorized streaming and copyright abuse....
Cloudflare’s R2 SQL, a distributed query engine, now supports aggregations. Explore how we built distributed GROUP BY execution, using scatter-gather and shuffling strategies to run analytics directly over your R2 Data Catalog....
We present our 6th annual review of Internet trends and patterns observed across the globe, revealing the disruptions, advances and metrics that defined 2025....
AI competition intensified in 2025 as ChatGPT gained strong challengers. Instagram climbed, X declined, and platforms like Shopee, Temu, and Kwai reshaped global Internet usage. Our 2025 DNS data shows how Internet patterns evolved....
Early activity indicates that threat actors quickly integrated this vulnerability into their scanning and reconnaissance routines and targeted critical infrastructure including nuclear fuel, uranium and rare earth elements. We outline the tactics they appear to be using and how Cloudflare is protect...
Cloudflare has shifted to Infrastructure as Code and policy enforcement to manage internal Cloudflare accounts. This new architecture uses Terraform, custom tooling, and Open Policy Agent to enforce security baselines and increase engineering velocity....
Recent advancements in Cloudflare Python Workers means fast cold starts, comprehensive package support, and a great developer experience. We explain how they were achieved and show how Python can be used to build serverless applications on Cloudflare....
Cloudflare experienced a significant traffic outage on December 5, 2025, starting approximately at 8:47 UTC. The incident lasted approximately 25 minutes before resolution. We are sorry for the impact that it caused to our customers and the Internet. The incident was not caused by an attack and was...
Cloudflare offers protection against a new high profile vulnerability for React Server Components: CVE-2025-55182. All WAF customers are automatically protected as long as the WAF is deployed....
Welcome to the 23rd edition of Cloudflare’s Quarterly DDoS Threat Report. This report offers a comprehensive analysis of the evolving threat landscape of Distributed Denial of Service (DDoS) attacks based on data from the Cloudflare network. In this edition, we focus on the third quarter of 2025....
Today, we’re excited to announce that Replicate is officially part of Cloudflare. We wanted to share a bit about our journey and why we made this decision....
FLUX.2 [dev] by Black Forest Labs is now on Workers AI! This advanced open-weight image model offers superior photorealism, multi-reference inputs, and granular control with JSON prompting....
The WAF provides ways for our customers to gain insight into why it takes certain actions. The more granular and precise the insight, the more reproducible and understandable it is. Revamped payload logging is one such method....
Cloudflare suffered a service outage on November 18, 2025. The outage was triggered by a bug in generation logic for a Bot Management feature file causing many Cloudflare services to be affected....
Bringing Replicate’s tools into Cloudflare will continue to make our Workers Platform the best place on the Internet to build and deploy any AI or agentic workflow....
We explore the fundamentals of Saltstack and how we use it at Cloudflare. We also explain how we built the infrastructure to reduce release delays due to Salt failures on the edge by over 5%....
Remote bindings allow you to connect your local Worker code to deployed Cloudflare resources like R2 and D1. Come along on the technical journey of how we built this feature to create a seamless local development experience....
Cloudflare Workflows, our durable execution engine for running multi-step applications, now supports Python. That means less friction, more possibilities, and another reason to build on Cloudflare....