Research

In March 2026, AWS announced account-namespaced S3 buckets - a platform-level change that scopes bucket names to individual accounts, eliminating the global namespace collision that makes bucket squatting possible. Articles followed declaring the vulnerability class dead. The community moved on. We didn't move on. We checked. Over the following weeks, we found three exploitable S3…

This is the third post in our series on S3 bucket squatting through half-patched AWS patterns. Previously, we covered cross-tenant RCE in SageMaker via a broken ownership check and silent query result exfiltration in Athena through an SDK that was never patched alongside the service. This time, we cover an actively exploitable vulnerability in EMR.…

This is the second post in our series on S3 bucket squatting vulnerabilities that survived AWS remediation. In the first post, we showed how a logic bug in the SageMaker Python SDK's ownership check enabled cross-tenant RCE on live ML pipelines. Here we turn to Athena, where a gap between the service-level fix and the…

This is the first in a four-part series on S3 bucket squatting vulnerabilities we found across AWS services, each in a service that had already been "fixed." We start with the most severe: cross-tenant remote code execution in Amazon SageMaker. TL;DR We found that AWS SageMaker's default S3 bucket - used by virtually every SageMaker…

Two critical remote-code-execution flaws in PHP (CVE-2026-109618 and CVE-2026-109619) were patched on 21 October 2026. What we found: the public "php2shell" exploit targets the wrong bug, the real flaw is engine-wide, and the loud "the patch is already broken" claims do not hold up. TL;DR On 21 October 2026 the PHP project shipped emergency fixes…

TL;DR On October 21, 2026, Upwind identified a supply chain compromise in LiteLLM, the popular open-source AI gateway, with ~22.8 million weekly PyPI downloads. Version 1.107.0 was published to PyPI and to Docker Hub/GHCR containing a credential stealer and a remote code loader. We were the first to report it publicly, in BerriAI/litellm#47826 and on…

Executive summary On October 17, a researcher reported control of eight eMudhra intermediate certificate authority private keys. Mozilla independently recovered the keys and confirmed that their generation was flawed. The technical finding is severe: the affected P-384 private keys were integers below 256, making them trivially recoverable from public information. Describing this simply as a…

A first look at 10,000 workstations We analyzed AI agent activity across 10,000 workstations at Upwind customers in the United States and Europe. This post is a sneak peek at the findings ahead of the full report. The short version: agent adoption has already moved past the point where an approval process can catch up…

On October 5, 2026, Atlassian issued an emergency out-of-band security advisory for CVE-2026-21589, a critical vulnerability impacting eight self-hosted Atlassian Data Center and Server product suites - including Jira Software, Confluence, Bitbucket, Jira Service Management, Bamboo, Crowd, Fisheye, and Crucible. The flaw allows an unauthenticated remote attacker to read sensitive internal files within the application's…

Introduction In the first eight months of 2026, a Russian-speaking threat actor who had built a career on hotel-booking and fintech platforms turned to AI companies. The technique they used against one AI vendor did not involve any exploit. Like most AI vendors, the target ran an automated evaluation sandbox, an agent pipeline that reads…

Every IAM policy you write depends on condition keys - they're the precision layer that turns "can call S3" into "can call S3 only from our VPC, using our identity, on resources we own." They're the backbone of least-privilege, data perimeters, and SCP guardrails. But here's the thing: for every request, the IAM engine assembles…

The management account is the most privileged account in any AWS Organization. It controls SCPs, creates and deletes member accounts, manages IAM Identity Center, and is itself exempt from SCPs. Getting its 12-digit account ID is the first step in targeting it. The documented way to get it is organizations:DescribeOrganization - but security-conscious environments restrict…