AWS re:Inforce 2025 — Cloud Security Gets Serious About AI
··891 words·5 mins
AWS re:Inforce 2025 puts AI workload security front and center, with new guardrails, identity controls, and data protection features that signal where cloud
- Osmond van Hemert — Senior Software Engineer & Applied AI/
- Blog Categories: AI, Security, Development & Infrastructure/
- Security Incidents, Vulnerabilities & Defense/
Security Incidents, Vulnerabilities & Defense
This category gathers posts where security is the main story: breaches, vulnerabilities, software supply-chain incidents, and the practical response to each. Use the articles below to examine how attacks work, what is known, and which defensive decisions follow from the evidence.
For incident timelines, visit Breaches & Zero Days. The Cybersecurity tag follows security themes across other categories too, including infrastructure and developer tooling.
NPM Supply Chain Attacks — The Problem That Won't Go Away
·1108 words·6 mins
Another wave of malicious npm packages reminds us that JavaScript’s dependency ecosystem remains one of software’s biggest security challenges.
The Spring 2025 Exploit Wave — Fortinet and Ivanti Under Fire
··977 words·5 mins
A surge of active exploitation targeting Fortinet and Ivanti edge devices highlights the persistent vulnerability of network perimeter infrastructure.
IngressNightmare — Critical Kubernetes NGINX Vulnerability Found
··1003 words·5 mins
CVE-2025-1974 and related vulnerabilities in the Kubernetes ingress-nginx controller allow unauthenticated remote code execution, affecting an estimated 40% of
The tj-actions Supply Chain Attack — Your CI/CD Is the Target
··920 words·5 mins
A compromised GitHub Action exposed secrets from thousands of repositories, highlighting how CI/CD pipelines have become prime targets for supply chain attacks.
Salt Typhoon and the Treasury Breach — State Hacking Hits Home
··950 words·5 mins
The Chinese state-sponsored Salt Typhoon campaign breached the US Treasury Department, exposing how even the most security-conscious organizations remain
Salt Typhoon — The Telecom Hack That Should Worry Every Engineer
·1006 words·5 mins
The Salt Typhoon campaign has compromised major US telecoms at a staggering scale. What developers and architects need to understand about this ongoing threat.
Salt Typhoon and the Telecom Breach — Infrastructure Under Siege
··1086 words·6 mins
The Salt Typhoon campaign has compromised major US telecom providers, exposing the fragility of critical infrastructure and the growing sophistication of
CUPS Overflows — A Critical Linux Printing Vulnerability Emerges
··905 words·5 mins
A chain of vulnerabilities in CUPS, the Linux printing system, enables remote code execution — and highlights how forgotten infrastructure becomes a security
NIST Finalizes Post-Quantum Cryptography Standards
··837 words·4 mins
NIST has published its first three finalized post-quantum cryptography standards. Here’s what developers need to know and do.
regreSSHion — A Wake-Up Call Hiding in Plain Sight
··784 words·4 mins
CVE-2024-6387 reveals a critical remote code execution flaw in OpenSSH, and it’s a regression from a fix made back in 2006.
The Polyfill.io Attack — A Wake-Up Call for CDN Trust
··1056 words·5 mins
The polyfill.io domain was acquired by a Chinese company and began injecting malware into over 100,000 websites, exposing fundamental weaknesses in how we