All news with #application security tag

🔄 AWS announced general availability of Azure SDK to AWS SDK application code conversion in AWS Transform, accelerating migration of Azure cloud-native .NET apps to AWS. The .NET modernization agent detects Azure service code and converts it to equivalent AWS service calls, such as Azure Functions to AWS Lambda and Azure Blob Storage to Amazon S3. Conversion options appear in the assessment report and can be customized before modernization. The feature is available across eight AWS Regions, with Azure Cosmos DB to Amazon DynamoDB conversion in preview.

🔍 This post explains a three-layer pipeline that filters raw scanner findings into a prioritized, evidence-backed set of vulnerabilities for engineers to act on. It emphasizes a tool-agnostic architecture combining multi-scanner agreement, AST-based structural verification, and deployment-context checks (IaC) to reduce noise and increase confidence. The article describes context scoping for AI reasoning and notes a companion post that covers the steering file controlling model behavior.

🎉 Cloudflare recapped its 16th Birthday Week, detailing 46 announcements spanning open source, application security, developer tools, monetization, data platforms, and observability. Highlights include a new cf CLI and Forge pipeline, EmDash CMS, post-quantum cryptography efforts, plans to become a certificate authority, Monetization Gateway and Pay Per Use, and GA launches for Basin and K2. The company emphasized support for agents, developer ecosystems, intern contributions, and commitments to open tools and civic programs.

🛡️ Cloudflare outlines an integrated security framework to address AI-driven attacks, connecting discovery, governance, runtime protection, and iterative investigation. The post summarizes recent AI-agent compromises, explains why isolated controls fail, and introduces new capabilities such as LLM-powered pentesting, Adaptive Security, Botbase registration, Precursor session signals, Application Profiles, and expanded threat intelligence. The approach emphasizes continuous validation, overlapping controls, and using global telemetry to turn investigations into protections.

🛡️ Turnstile Spin is an agent-mediated, end-to-end implementation of Cloudflare's Turnstile that automates widget creation and backend validation. It guides AI coding agents to embed the Turnstile widget, wire Siteverify into server logic, fix misconfigurations, and migrate from other CAPTCHA providers without sending application code to Cloudflare. Spin can be started from the Cloudflare dashboard, Wrangler, or an agent skill and has already seen widespread adoption since its July release.

📰 This post introduces native BM25 full-text search in AlloyDB and Cloud SQL for PostgreSQL 17+ via the open-source pg_textsearch extension from TigerData. The change eliminates the need for separate full-text backends, reducing data duplication and sync complexity while delivering industry-standard BM25 ranking directly in the database. AlloyDB further offers accelerated vector search (ScaNN, HNSW) and an out-of-the-box hybrid search UDF to merge vector and keyword results; Cloud SQL supports hybrid results via CTEs and coalesced RRF scoring.

🛡️ Microsoft introduces a MITRE ATT&CK-aligned Cloud web applications threat matrix to help defenders map and prioritize threats against cloud-hosted web apps and serverless platforms. The framework organizes attack techniques across application code, managed runtimes, identities, deployment pipelines, and connected cloud resources to surface cross-layer attack paths. The blog describes selected techniques and actionable defensive priorities to reduce exposure in cloud-native environments.

🛡️ This article examines how threat actors increasingly use less-obvious file types to bypass defenses and deliver malware. It outlines disk image formats (ISO, IMG, VHD, VMDK) that mount natively and can evade scanning, Office-related formats like .one and .xll that hide scripts or DLLs, and SVG files that can contain JavaScript. The piece also describes polyglot files and a notable IcedID campaign that chained ZIP→ISO→CHM→mshta to deploy payloads, and stresses the need for comprehensive scanning of these formats by security tools.

🛠️ Google Cloud announces Fault Injection Testing (FIT) in public preview to help teams automate failure testing and validate application resilience. FIT lets you create experiment templates to inject targeted faults such as Cloud SQL failovers and degraded Layer 7 traffic, with an automated dry run to verify affected resources and permissions. Experiments run for a defined duration with stop-and-revert controls, and Google recommends using FIT in non-production during preview. Access is via the Cloud console, gcloud CLI, or REST API; request preview through your account team.

🔒 Named pipes are commonly used for interprocess communication on Windows but should never be treated as implicitly trusted. Developers often assume local IPC is safe, yet different users, sessions, and privilege levels may run on the same machine. Servers must verify client identities, apply explicit DACLs, authorize each operation, and validate message contents to avoid privilege escalation, confused-deputy issues, and denial-of-service. Remote accessibility and predictable pipe names further increase risk, so implement strict limits, timeouts, and local-only protections.

🔍 Recent studies show LLMs now excel at discovering zero-day vulnerabilities yet continue to produce insecure code at scale. Veracode found 44% of AI-generated code contains OWASP Top 10 issues and no model exceeded a 68% security pass rate, despite near-perfect syntax correctness. Other research from SIG, Xint.io, and 1Password’s Off-By-1 Labs similarly reports high rates of security violations and low patch success. Specialized harnesses and deterministic tooling improve outcomes, but human oversight and contextual organization controls remain essential.

🚀 Gemini in Google Cloud's Database Migration Service streamlines conversion of stored procedures, triggers, and functions from proprietary dialects like PL/SQL and T-SQL into PostgreSQL PL/pgSQL. The service analyzes full schema context, provides side-by-side diffs and inline explanations, and enforces IAM-bound security. Teams can validate, edit, and deploy converted code within a single console to shorten migration timelines.

🛠️ Amazon EC2 now offers application status checks that detect application-level failures such as web servers not accepting requests, stopped Docker daemons, or broken networking. Customers specify protocol, port, path, and healthy response codes to create checks, then associate them with instances by ID or tag. EC2 sends HTTP/HTTPS probes every 60 seconds and reports application health alongside existing instance and system checks, enabling Auto Scaling groups to replace instances flagged as unhealthy. This feature is available in all commercial AWS Regions and AWS GovCloud (US).

🔒 AWS announced integrations that extend AWS Continuum into developer coding environments by partnering with Anthropic and OpenAI. The Preview of Continuum for code vulnerabilities delivers on-demand vulnerability discovery, contextual prioritization, sandbox validation, and remediation directly within coding assistants like Claude Code, Codex, and Kiro. Continuum orchestrates multiple models and tool integrations as a harness to select the best model per task and return prioritized, contextual fixes to developers, collapsing multi-team workflows into a single outcome.

🔒 AlloyDB, a PostgreSQL-compatible managed service, now offers columnar engine accelerated HNSW to speed up pgvector vector search. This preview feature pins HNSW indexes in a compressed, in-memory columnar cache to reduce buffer-manager overhead and enable up to 4x higher QPS compared to standard PostgreSQL. The enhancement requires simple flag changes and uses the same pgvector SQL syntax, delivering higher throughput and improved AI recall without application changes.

🛡️ This post from Mandiant highlights how publicly exposed serverless applications — often unauthenticated by design — are frequent targets for application-level attacks like LFI/RFI and command injection. It explains exploitation paths including file retrieval and service account token exfiltration, and demonstrates attack examples against Cloud Run Python functions. The article provides actionable hardening guidance such as using dedicated service accounts with least privilege, isolating public services in separate projects, enforcing S‑SDLC practices, and deploying Cloud Armor WAF and Layer 7 load balancing for centralized protection.

🛡️ Amazon GameLift Servers now includes DDoS Protection client SDKs for C# and Unity, enabling developers to protect session-based multiplayer games from denial-of-service and distributed denial-of-service attacks. The service co-locates a relay network with game servers and uses access token-based authentication to allow only authorized client traffic. It enforces per-player UDP traffic limits, offers negligible latency, and is provided at no extra cost to GameLift Servers customers. The new SDKs complement existing C++ and Unreal Engine support and are available in multiple AWS regions.

🔒 Cloudflare describes an architectural approach to defend applications and internal systems from high-speed attacks enabled by frontier AI models. The post explains how layered controls — including WAF, ML-based scoring, API Shield, Bot Management, Zero Trust, IdP federation, MCP server controls, and AI Gateway — work together to reduce discovery, limit exploit adaptation, and contain impact. It emphasizes deploying inspection ahead of public apps, defining valid API traffic, restricting automated probing, and enforcing per-request identity for internal tools.

🔐 This article demonstrates how to implement enterprise-grade authentication and authorization for a Streamlit sample application using Amazon Cognito for identity and Amazon Verified Permissions with Cedar policies for fine-grained access control. It outlines a layered architecture that separates identity verification, authorization evaluation, application logic, and enforcement to reduce blast radius. The post explains Cedar policy anatomy and common patterns—ownership, role-based, hierarchical, and emergency access—plus evaluation precedence where forbid policies take priority. Practical guidance covers required tools, provisioning steps, policy design tips, and testing recommendations to help developers scale secure applications.

🔒 Ox Security urges that appsec be integrated directly into AI coding tools as agentic development accelerates code changes beyond traditional pipelines. Speaking at Infosecurity Europe, field CTO Boaz Barzel argued that security must become a continuous, contextual property of creation rather than a bolt-on stage. He outlined four agentic attack surfaces—input, tools, execution and output—and advocated autonomous security agents that pentest and validate every commit to reduce MTTR and achieve full coverage.