aws-security-assessment-solution

Self-Service Security Assessment Solutions v2.0 Cybersecurity remains a very important topic and point of concern for many CIOs, CISOs, and their customers. To meet these important concerns, AWS has developed a primary set of services customers should use to aid in protecting their accounts. Amaz...

autovpn

!CAUTION This repository is no longer being maintained. No further updates, bug fixes, or support will be provided. Please use the new version https://github.com/ttlequals0/autowire Overview Script that allows the easy creation of OpenVPN endpoints in any AWS region. To create a VPN endpoint is...

red-detector

Red-Detector Description Scan your EC2 instance to find its vulnerabilities using Vuls https://vuls.io/en/. Audit your EC2 instance to find security misconfigurations using Lynis https://cisofy.com/solutions/lynis. Scan your EC2 instance for signs of a rootkit using Chkrootkit...

phishlulz

PhishLulz PhishLulz es un conjunto de herramientas Ruby dirigido a automatizar actividades de phishing. Cuando inicias una campaña de phishing, se crea una instancia dedicada de Amazon EC2 Debian 7. La VM viene con varias herramientas de código abierto que se han integrado. Los dos componentes...

MAL-2026-17264 Malicious code in @hrmony/kit-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a4084c44ab6554d66c474338de2cb482a25b31e6822d470e08b2b2ef5b1735a The package executes credential-harvesting code both from its postinstall script scripts/check-setup.mjs and from its main entry index.js, so theft...

MAL-2026-17258 Malicious code in @hrmony/cdk-constructs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6601c44353f60d117ef4e1ea09f9d2c997cde4375af70c49c628b38db8f1b55a On require/import, index.js executes top-level async code that harvests AWS EC2 instance metadata via IMDSv2 including IAM role security credentials...

Malicious code in @hrmony/cdk-constructs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6601c44353f60d117ef4e1ea09f9d2c997cde4375af70c49c628b38db8f1b55a On require/import, index.js executes top-level async code that harvests AWS EC2 instance metadata via IMDSv2 including IAM role security credentials...

MAL-2026-17256 Malicious code in @hrmony/benefit-sachbezug (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de40a55476bbcc5eda275f9f385396699f1b066bf1ddedb80fad053c4057c63a The package's main entry index.js executes at require/import time and POSTs harvested data to the hardcoded endpoint...

Malicious code in @hrmony/pladddform-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 607004ff93f1fcd5fbf7b1cf6b5e104b7f26eb699aee3dd4f8bbb33494f0b096 On module import, index.js executes an unconditional exfiltration payload against the installer/runtime host. It queries the AWS EC2 Instance Metadat...

MAL-2026-17252 Malicious code in @hrmony/belegerfassung-pladddform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 615255a66c44204b03e60a165c1a9b21f95ecd351bf58c355462c159c74d1017 The package's main module index.js executes exfiltration logic at top level on import. It first sends a hello beacon via HTTP POST to the hardcoded...

Malicious code in @hrmony/pladddform-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f03abfe6149423144b6d3143a66cbca7925bb6eb736b1ece350d5a344684eb9 @hrmony/[email protected] ships an index.js whose top-level code, executed on require/import, POSTs to the hardcoded attacker host...

Malicious code in @hrmony/gutscheinverwaltung (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05705e4815a7ce926aad55136e379d3f901ad923a0fcb7f4002cf16e6cd78c56 On module load, the package performs top-level fetches against the AWS EC2 Instance Metadata Service using IMDSv2 requesting a token, then reading...

MAL-2026-17261 Malicious code in @hrmony/gutscheinverwaltung (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05705e4815a7ce926aad55136e379d3f901ad923a0fcb7f4002cf16e6cd78c56 On module load, the package performs top-level fetches against the AWS EC2 Instance Metadata Service using IMDSv2 requesting a token, then reading...

CVE-2026-61681 Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get on payload.UnsubscribeURL after VerifyPayload even though BuildSignature...

CVE-2026-61681: Server-Side Request Forgery (SSRF)

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get on payload.UnsubscribeURL after VerifyPayload even though BuildSignature...

Attackers Steal METR API Key and Consume AI Credits Worth About $600,000

METR short for Model Evaluation and Threat Research and pronounced "Meter", a research non-profit that evaluates frontier artificial intelligence AI models for their ability to carry out long-horizon, agentic tasks, disclosed that it suffered "two notable security incidents" where external actors...

EUVD-2026-52417

The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract plaintext AWS credentials by calling the loadawscredentials function with the redactsecret parameter set to false, circumventing the...

Ansible leaks password to logs

A flaw was found in Ansible in the amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs...

PYSEC-2026-768 Ansible leaks password to logs

A flaw was found in Ansible in the amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs...

CVE-2026-5709: Improper Neutralization of Special Elements used in an OS Command

Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio RES version 2024.10 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands on the cluster-manager EC2 instance via crafted input when using the FileBrowser functionality. To remediat...