Research

Two critical remote-code-execution flaws in PHP (CVE-2026-109618 and CVE-2026-109619) were patched on 21 October 2026. What we found: the public "php2shell" exploit targets the wrong bug, the real flaw is engine-wide, and the loud "the patch is already broken" claims do not hold up. TL;DR On 21 October 2026 the PHP project shipped emergency fixes…

TL;DR On October 21, 2026, Upwind identified a supply chain compromise in LiteLLM, the popular open-source AI gateway, with ~22.8 million weekly PyPI downloads. Version 1.107.0 was published to PyPI and to Docker Hub/GHCR containing a credential stealer and a remote code loader. We were the first to report it publicly, in BerriAI/litellm#47826 and on…

Executive summary On October 17, a researcher reported control of eight eMudhra intermediate certificate authority private keys. Mozilla independently recovered the keys and confirmed that their generation was flawed. The technical finding is severe: the affected P-384 private keys were integers below 256, making them trivially recoverable from public information. Describing this simply as a…

A first look at 10,000 workstations We analyzed AI agent activity across 10,000 workstations at Upwind customers in the United States and Europe. This post is a sneak peek at the findings ahead of the full report. The short version: agent adoption has already moved past the point where an approval process can catch up…

On October 5, 2026, Atlassian issued an emergency out-of-band security advisory for CVE-2026-21589, a critical vulnerability impacting eight self-hosted Atlassian Data Center and Server product suites - including Jira Software, Confluence, Bitbucket, Jira Service Management, Bamboo, Crowd, Fisheye, and Crucible. The flaw allows an unauthenticated remote attacker to read sensitive internal files within the application's…

Introduction In the first eight months of 2026, a Russian-speaking threat actor who had built a career on hotel-booking and fintech platforms turned to AI companies. The technique they used against one AI vendor did not involve any exploit. Like most AI vendors, the target ran an automated evaluation sandbox, an agent pipeline that reads…

Every IAM policy you write depends on condition keys - they're the precision layer that turns "can call S3" into "can call S3 only from our VPC, using our identity, on resources we own." They're the backbone of least-privilege, data perimeters, and SCP guardrails. But here's the thing: for every request, the IAM engine assembles…

The management account is the most privileged account in any AWS Organization. It controls SCPs, creates and deletes member accounts, manages IAM Identity Center, and is itself exempt from SCPs. Getting its 12-digit account ID is the first step in targeting it. The documented way to get it is organizations:DescribeOrganization - but security-conscious environments restrict…

In the previous post, we mapped 36 condition keys that the IAM engine evaluates but has never documented. The decomposition model, the service-specific resource identifiers, the organizational metadata - all of it sitting in the request context, invisible unless you probe for it. That post was about discovery. This one is about what you can…

This post was written in early August 2026, ahead of our fwd:cloudsec Europe talk. On August 25, AWS launched the Access Troubleshooter (currently in public preview), a first-party feature that surfaces the request context for denied requests. We've updated this post to account for it. When the IAM engine evaluates your request, it matches your…

Recap In Part I and Part II, we: Networking and VPC Mode Network Isolation Testing The microVM is assigned an IPv6 address matching the value in the JWT. Across multiple runs, all addresses shared the same 2600:1f18::/32 prefix, but cross-microVM communication always failed. We attempted to reach the host EC2 IMDS by manipulating the route…

Recap In Part I, we explored the AgentCore Runtime microVM from the inside and discovered we weren't alone - four platform binaries were running alongside our code, and one of them was quietly shipping logs to an AWS-internal S3 bucket. We left off with a question: what can we learn from these internal components, and…