👋 New here. AWS security engineer in Paris, AWS Community Builder.

I write open-source AWS security tooling: IAM privilege-escalation path detection, S3 / EC2 / Lambda misconfiguration scanners, and a tracker that records every change to AWS managed IAM policies over time.

Also maintain LocalEmu, a free local AWS emulator for testing without touching real accounts or credentials.

Here to learn from this community and share what I find. 🔒

#InfoSec #CloudSecurity #AWS #IAM #opensource #devsecops

https://actionnetwork.org/petitions/support-fair-wages-for-the-workers-who-make-lewis-ginter-botanical-garden-thrive/

Please sign this petition to support fair wages/unionization efforts for garden workers!

The workers at the Botanical Garden here in #RVA voted to #unionize and are negotiating their contract. Garden leadership has been dragging their feet and engaging in regressive bargaining, so yesterday union members exercised their right to strike, called out, and picketed outside of the garden.

#union #petition #virginia #virginiapolitics #IAM #garden #botanicalgarden

🚨 The BSides Luxembourg 2026 keynote just dropped!

𝗞𝗘𝗬𝗡𝗢𝗧𝗘: 𝗜𝗗𝗘𝗡𝗧𝗜𝗧𝗬 𝗦𝗘𝗖𝗨𝗥𝗜𝗧𝗬 𝗝𝗨𝗦𝗧 𝗘𝗫𝗣𝗟𝗢𝗗𝗘𝗗

Watch @wendynather's keynote, recorded live at the Digital Learning Hub Luxembourg Hub during 𝗕𝗦𝗜𝗗𝗘𝗦 𝗟𝗨𝗫𝗘𝗠𝗕𝗢𝗨𝗥𝗚 𝟮𝟬𝟮𝟲.

👤 Wendy Nather
https://www.linkedin.com/in/wendynather/

🎥 Watch the full keynote:
https://archive.org/details/BSidesLuxembourg2026/d1+t1+02+Identity+Security+Just+Exploded+-+Wendy+Nather.mkv

#BSidesLuxembourg #IdentityManagement #CyberSecurity #IAM #DigitalIdentity #SecurityLeadership #DigitalLearningHub

🚨 Three Gitea/Gogs vulnerabilities just dropped — and one is a CVSS 9.8 authentication bypass.

If you self-host Gitea or Gogs, this is not a “patch later” situation:

⚠️ CVE-2026-20896 — Gitea Docker auth bypass
Anyone can impersonate any user with one HTTP header: `X-WEBAUTH-USER: admin`

⚠️ CVE-2026-52807 — Stored DOM XSS
A malicious milestone name can survive escaping and execute through Semantic UI.

⚠️ CVE-2026-22874 — Webhook SSRF
Gitea webhooks can become a path to AWS IMDS, cloud credentials, S3, Secrets Manager, ECR, and full cloud privilege abuse.

Self-hosted Git platforms hold source code, CI/CD secrets, deploy keys, webhooks, tokens, and internal infrastructure access.

Your code. Your secrets. Their access.

Upgrade now:
Gitea 1.26.3+
Gogs 0.14.3+

Full technical breakdown 👇
https://thecybersecguru.com/news/cve-2026-20896-gitea-authentication-bypass-dom-xss-ssrf/

#Gitea #Gogs #CyberSecurity #InfoSec #AppSec #DevSecOps #CVE #SSRF #XSS #Docker #CloudSecurity #AWS #IAM #AuthenticationBypass #Vulnerability #SelfHosted #Security

VPN's "trust once, access everything" model is why ransomware spreads. ZTNA verifies identity per application connection, limits blast radius to a single app, and enables real-time session revocation. Complete enterprise guide with Keycloak, Okta, and Entra ID integration patterns.

https://iamdevbox.com/posts/ztna-vs-vpn-zero-trust-network-access-complete-guide/?utm_source=mastodon&utm_medium=social&utm_campaign=blog_post

#zerotrust #ztna #vpn #networksecurity #iam

Vendor Security and Customer Requirement Questionnaires ask the same questions every time — SIG, CAIQ, HECVAT, MVSP all cover the same ground with different phrasing. I stopped treating this as a writing problem and started treating it as a retrieval problem: pre-built corpus, offline TF-IDF matching, confidence scoring, link validation.

https://tobytes.com/articles/vendor-security-questionnaires-retrieval-problem

#security #infosec #iam