Key takeaways  Most cloud security teams can see their environment. Inventory is broad, scanners run on schedule and findings pile up. What they can't tell you is which of those findings matter right now. That's the context gap. Visibility was the right foundation, and most programs have built it (see where yours sits on the…

Upwind Story Replay is now available in Upwind: a visual timeline of the detections that led to a threat. Click a threat story, watch the attack unfold step by step. Three Vectors in One Week AI is accelerating everything we knew about supply chain attacks, zero-days, and finding new critical CVEs. Attacks are unfolding fast…

Executive summary On October 17, a researcher reported control of eight eMudhra intermediate certificate authority private keys. Mozilla independently recovered the keys and confirmed that their generation was flawed. The technical finding is severe: the affected P-384 private keys were integers below 256, making them trivially recoverable from public information. Describing this simply as a…

TL;DR A supply chain security investigation has identified malicious code in LiteLLM version 1.107.0, a Python package distributed through PyPI. The affected package contains multiple files designed to execute code automatically when Python starts, retrieve attacker-controlled payloads, and maintain persistent access to compromised environments. Based on the analyzed package, this should be treated as a…

TL;DR PHP has released emergency fixes for two critical memory-corruption vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both allow unauthenticated remote code execution on default configurations. Details were leaked before the coordinated disclosure, which forced an accelerated release. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now. UPDATE: Now Official With Patch Versions UPDATE (October 21, 2026 14:00…

TL;DR Kubernetes has taken on a second job. Clusters still run the applications they always ran, but now they also run AI agents, model-serving workloads, and MCP servers alongside the applications those agents work on. These workloads do not behave like the applications Kubernetes was built to run. They call tools, reach external services, and…

Databricks permissions now trace to the cloud resources they actually reach.  Ask a Databricks admin who can read a given catalog and you'll get an answer. Ask what that access reaches in your cloud account and nobody can tell you, because Databricks doesn't track it. Unity Catalog ends at the storage credential, and what sits…

Introduction Teams are starting to let AI agents fix their cloud findings. What nobody has measured is whether those changes are safe to run. So we built a live AWS account, broke it on purpose in eighteen ways that chain into nine attack paths, and gave twelve AI models read-only access to it with one…

Upwind is partnering with Cursor Origin to secure every change pushed to the repository, whether a human or an agent wrote it. Upwind now scans code in Origin. Every pull request and every push to the default branch is checked automatically, with findings delivered as pull request comments, checks, and alerts in the Upwind console.…

A first look at 10,000 workstations We analyzed AI agent activity across 10,000 workstations at Upwind customers in the United States and Europe. This post is a sneak peek at the findings ahead of the full report. The short version: agent adoption has already moved past the point where an approval process can catch up…

On October 5, 2026, Atlassian issued an emergency out-of-band security advisory for CVE-2026-21589, a critical vulnerability impacting eight self-hosted Atlassian Data Center and Server product suites - including Jira Software, Confluence, Bitbucket, Jira Service Management, Bamboo, Crowd, Fisheye, and Crucible. The flaw allows an unauthenticated remote attacker to read sensitive internal files within the application's…

Reaching 100+ integrations with The Lineup at Upwind is a milestone I’m incredibly proud of. But when I think about what it took to get here, the number itself isn’t the most interesting part. The interesting part is what happens along the way. You start by building integrations. Then customers introduce new use cases. Partners…