The Hidden Dangers of Public Serverless Repositories: An Empirical Security Assessment

Serverless computing has rapidly emerged as a prominent cloud paradigm, enabling developers to focus solely on application logic without the burden of managing servers or underlying infrastructure. Public serverless repositories have become key to accelerating the development of serverless...

⚡ Weekly Recap: NFC Fraud, Curly COMrades, N-able Exploits, Docker Backdoors & More

Power doesn’t just disappear in one big breach. It slips away in the small stuff—a patch that’s missed, a setting that’s wrong, a system no one is watching. Security usually doesn’t fail all at once; it breaks slowly, then suddenly. Staying safe isn’t about knowing everything—it’s about acting fa...

⚡ Weekly Recap: NFC Fraud, Curly COMrades, N-able Exploits, Docker Backdoors & More

Power doesn't just disappear in one big breach. It slips away in the small stuff—a patch that's missed, a setting that's wrong, a system no one is watching. Security usually doesn't fail all at once; it breaks slowly, then suddenly. Staying safe isn't about knowing everything—it's about acting fa...

ARPaCCino: an Agentic-RAG for Policy As Code Compliance

Policy as Code PaC is a paradigm that encodes security and compliance policies into machine-readable formats, enabling automated enforcement in Infrastructure as Code IaC environments. However, its adoption is hindered by the complexity of policy languages and the risk of misconfigurations. In th...

Managed Databases as Code Using Terraform

...

@aligent/cdk-esbuild (>=2.0.0, <=2.1.0), @aligent/cdk-graphql-mesh-server (>=0.1.5, <=2.17.0) +407 more potentially affected by CVE-2025-23206 via aws-cdk-lib (>=2.0.0, <=2.176.0)

aws-cdk-lib NPM version =2.0.0, =2.0.0, =0.1.5, =2.3.7, =2.0.1, =2.0.0, =2.0.0-beta, =0.0.3, =5.0.0-ampgenconfig.0, =2.7.0-a-cdkv2-graphql-15.0, =5.0.0-beta.0, =4.1.10-alpha.74, =3.0.0-ampgenconfig.0, =3.0.0-ampgenconfig.0, =3.1.25 and more Source cves: CVE-2025-23206 Source advisory:...

Proactively Securing Cloud Workloads in the CI/CD Pipeline with Rapid7 and Azure DevOps

As organizations continue to embrace cloud-native development practices, the need for integrated security solutions that seamlessly fit into existing DevOps environments has become more pressing than ever. We recognize this critical need and have added new integration for InsightCloudSec ICS and...

Simplifying Infrastructure Management with Imperva’s Terraform Module for Cloud WAF

In todays rapidly evolving technological landscape, managing infrastructure efficiently is paramount for businesses striving to stay competitive. With the rise of cloud computing, Infrastructure as Code IaC has emerged as a game-changer, enabling organizations to automate the provisioning and...

5 Ways to Maximize the Impact of IaC Scans

By Uzair Amir Infrastructure-as-code IaC continues to gain traction and is even hailed for having changed software development towards greater efficiency… This is a post from HackRead.com Read the original post: 5 Ways to Maximize the Impact of IaC Scans...

What Is Policy-as-Code

Decoding the Enigma: Policy-as-Code Explained The Information Technology IT sector can often feel like a maze of intricate jargon and theories. A phrase gaining traction in this field is Policy-as-Code PaC. However, what does Policy-as-Code entail? Let's demystify this enigma. Policy-as-Code...

Qualys Is the Outperformer in the New GigaOm Radar Report for Continuous Vulnerability Management

GigaOm has unveiled its third-annual Radar for Continuous Vulnerability Management featuring Qualys. In this Report, GigaOm provides a detailed analysis of the value and progression of vulnerability management VM capabilities to help organizations build the best security and vulnerability...

@104corp/cdk-aws-codedeploy-on-premises (>=1.0.0, <=1.0.2), @aws-cdk/aws-stepfunctions-tasks (>=1.91.0, <=1.201.0) +30 more potentially affected by CVE-2023-35165 via @aws-cdk/aws-eks (>=1.57.0, <=1.201.0)

@aws-cdk/aws-eks NPM version =1.57.0, =1.0.0, =1.91.0, =1.57.0, =0.12.1, =1.115.0, =1.91.0, =1.91.0, =1.115.0, =0.0.1-beta.1, =0.0.1, =25.1.0, =0.2.0, =0.1.0, =0.3.2 and more Source cves: CVE-2023-35165 Source advisory: OSV:GHSA-RX28-R23P-2QC3...

Introducing AI-guided Remediation for IaC Security / KICS

While the use of Infrastructure as Code IaC has gained significant popularity as organizations embrace cloud computing and DevOps practices, the speed and flexibility that IaC provides can also introduce the potential for misconfigurations and security vulnerabilities. IaC allows organizations to...

Introducing AI-guided Remediation for IaC Security / KICS

While the use of Infrastructure as Code IaC has gained significant popularity as organizations embrace cloud computing and DevOps practices, the speed and flexibility that IaC provides can also introduce the potential for misconfigurations and security vulnerabilities. IaC allows organizations to...

What to Look for When Selecting a Static Application Security Testing (SAST) Solution

If you're involved in securing the applications your organization develops, there is no question that Static Application Security Testing SAST solutions are an important part of a comprehensive application security strategy. SAST secures software, supports business more securely, cuts down on...

Rapid7 and HashiCorp Partner to Secure Terraform-based Cloud Infrastructure Deployments

Welcome to the latest installment in our cloud security “shift-left” blog series. In our last post, we covered the importance of integrating cloud infrastructure security assessments into DevOps tools and enabling Infrastructure as Code IaC developers. This time, we’re focusing on Rapid7’s recent...

Now Available on GitHub: Akamai CLI Utility v1.0 for Akamai Terraform

With v0.9 of the Akamai CLI for Terraform, application development teams can build on infrastructure as code IaC and maintain rapid development without compromising security...

Top 5 Infrastructure as Code Security Challenges

Learn how to counteract the top five challenges of IaC and discover how these obstacles pose a threat to security and gain valuable insight in how to mitigate these risks...

Application Security in 2022: Where Are We Now?

It’s always a good thing to take a step back every once in a while to take the lay of the land. Like you, we are always working at a breakneck pace to help secure the web applications being built today and ready ourselves to secure the innovations of the future. When Forrester put out The State o...

Red Team lab automation

It’s not uncommon for red teamers to regularly tear down and rebuild their test labs, I know I do on a sometimes daily basis. It keeps things fresh and manageable, and now, using Infrastructure as Code IaC, we can create a consistent environment to test tools and techniques in. If we break...