Author

Alex Kim

Threat intelligence editor

Focuses on cloud identity, incident response, and exploitation trends.

CloudIncident responseIdentity

Coverage by Alex Kim (58)

Illustration of AI-generated code being accepted into production while supply-chain package risks light up in red.

AI-Generated Code Vulnerabilities Surge as ‘Vibe Coding’ Ships Unvetted Slop Into Production

Authorization gaps, hard-coded secrets and invented package names are reaching production repositories faster than human review can absorb them.

Illustration of ephemeral workload credentials replacing long-lived API keys in non-human identity management

Cloud Security Research

Non-Human Identity Management: Why Ephemeral Credentials Are Replacing Static API Keys

Service accounts, CI/CD runners, workload certificates and AI-agent principals form a sprawl traditional joiner-mover-leaver programs never governed.

Conceptual illustration of a Jenkins-style CI/CD controller at the center of a software factory, with pipeline lines to code, cloud, and artifacts and a cracked supply-chain link on one plugin package

Cloud Security Research

Jenkins Plugin Security: Hardening the CI/CD Supply Chain Before Attackers Do

*A conceptual view of Jenkins as the high-privilege control plane of the software factory—and of plugins as the supply-chain links that can break it.*

Illustration of the DarkSword pure-JavaScript Safari watering-hole full chain on iOS 18, from compromised site to kernel and hit-and-run exfil

Cloud Security Research

DarkSword: Pure-JavaScript iOS 18 Watering-Hole Full Chain Used by Multiple Actors

The chain moves from Safari RCE through sandbox escape to kernel read/write, exfiltrates data within minutes, then cleans up and exits with no user interaction.

On-premises SharePoint Server farm under active incident response for a zero-day privilege-escalation exploit

Cloud Security Research

Microsoft SharePoint Zero-Day CVE-2026-56164 Under Active Attack: On-Prem Farms Face Unauthenticated Privilege Escalation

Microsoft and CISA confirmed exploitation on 14 July 2026 and shipped same-day patches. SharePoint Online is unaffected; self-hosted farms need action now.

Illustration of enterprise DHCP server infrastructure under elevated risk during Microsoft July 2026 Patch Tuesday

Cloud Security Research

Microsoft July 2026 Patch Tuesday Hits Record 622 CVEs With Critical DHCP Server RCEs

Roughly triple June's previous record, the release is led by CVE-2026-50518, an unauthenticated Windows DHCP Server RCE rated Exploitation More Likely.

Illustration of an on-premises Dynamics NAV and Business Central ERP server under unauthenticated remote code execution risk via a crafted login path

Cloud Security Research

CVE-2026-55944: Critical Unauthenticated RCE Hits Microsoft Dynamics NAV and Business Central On Premises

Patched in the record July 2026 Patch Tuesday, the flaw puts finance, supply-chain and operations systems at risk wherever ERP login endpoints remain reachable.

Editorial illustration of an AD FS server with a forged SAML assertion hovering above it in a data center

Golden Saml Research

Why Golden SAML Still Haunts Hybrid Identity: Hardening AD FS Token-Signing Keys and DKM Access

Golden SAML still threatens hybrid identity via AD FS token-signing keys. Learn how to harden DKM access, detect key theft, and lock down federation servers.

Desks covered

Research

Latest

Jul 27, 2026, 5:44 AM EDT · Research · Cloud Security6 minEnterprise LLM Pricing Model Performance Comparison: The Economics of Model Migration

As cheaper tiers reach benchmark parity on standard corporate workloads, the migration question becomes governance and availability, not raw capability.

Jul 27, 2026, 5:42 AM EDT · Research · Cloud Security6 minBeyond Standard Scaling: Architectural Shifts, Agentic Vectors, and the Enterprise Security Risk of GPT-6

For CISOs and architects, the line between manageable infrastructure evolution and uncontained systemic risk runs through agentic vectors, not model size.

Jul 24, 2026, 3:25 PM EDT · Research · Cloud Security6 minAI Supply Chain Security Risks: How OpenAI Integrations and Hugging Face Flaws Expose Enterprise Infrastructure

Hugging Face flaws and OpenAI integration paths have produced remote code execution, secret harvesting and cross-tenant exfiltration in real deployments.

Jul 24, 2026, 3:21 PM EDT · Research · Cloud Security6 minOpus 5 Enterprise AI Pricing Reshapes Security Compute: High-Reasoning LLM Economics and the Cybersecurity Routing Catch

For vulnerability auditing, incident response and threat hunting, the routing catch matters as much as the price — and it is not visible in the pricing table.