In March 2026, AWS announced account-namespaced S3 buckets - a platform-level change that scopes bucket names to individual accounts, eliminating the global namespace collision that makes bucket squatting possible. Articles followed declaring the vulnerability class dead. The community moved on. We didn't move on. We checked. Over the following weeks, we found three exploitable S3…

This is the third post in our series on S3 bucket squatting through half-patched AWS patterns. Previously, we covered cross-tenant RCE in SageMaker via a broken ownership check and silent query result exfiltration in Athena through an SDK that was never patched alongside the service. This time, we cover an actively exploitable vulnerability in EMR.…

This is the second post in our series on S3 bucket squatting vulnerabilities that survived AWS remediation. In the first post, we showed how a logic bug in the SageMaker Python SDK's ownership check enabled cross-tenant RCE on live ML pipelines. Here we turn to Athena, where a gap between the service-level fix and the…

A use-after-free in the Linux kernel's IPv4 TCP handshake (CVE-2026-98432, CVSS 9.8) was fixed upstream in October and is still landing in distribution kernels. What we found: any unauthenticated peer can reach it on any IPv4 TCP port; the working root exploit has been described but not published; and the setup it needs is more…

This is the first in a four-part series on S3 bucket squatting vulnerabilities we found across AWS services, each in a service that had already been "fixed." We start with the most severe: cross-tenant remote code execution in Amazon SageMaker. TL;DR We found that AWS SageMaker's default S3 bucket - used by virtually every SageMaker…

Two critical remote-code-execution flaws in PHP (CVE-2026-109618 and CVE-2026-109619) were patched on 21 October 2026. What we found: the public "php2shell" exploit targets the wrong bug, the real flaw is engine-wide, and the loud "the patch is already broken" claims do not hold up. TL;DR On 21 October 2026 the PHP project shipped emergency fixes…

TL;DR On October 21, 2026, Upwind identified a supply chain compromise in LiteLLM, the popular open-source AI gateway, with ~22.8 million weekly PyPI downloads. Version 1.107.0 was published to PyPI and to Docker Hub/GHCR containing a credential stealer and a remote code loader. We were the first to report it publicly, in BerriAI/litellm#47826 and on…

TL;DR HTTP2Shell (CVE-2026-111497) is an out-of-bounds write in Google's Brotli decoder, versions 1.0.3 through 1.2.0. An unauthenticated attacker who gets crafted Brotli data into a vulnerable decoder can crash the process, read its memory, or in some cases run code. It was first reported as a Node.js bug ("Node2Shell"), but the flaw is in the…

Key takeaways  Most cloud security teams can see their environment. Inventory is broad, scanners run on schedule and findings pile up. What they can't tell you is which of those findings matter right now. That's the context gap. Visibility was the right foundation, and most programs have built it (see where yours sits on the…

Upwind Story Replay is now available in Upwind: a visual timeline of the detections that led to a threat. Click a threat story, watch the attack unfold step by step. Three Vectors in One Week AI is accelerating everything we knew about supply chain attacks, zero-days, and finding new critical CVEs. Attacks are unfolding fast…

Executive summary On October 17, a researcher reported control of eight eMudhra intermediate certificate authority private keys. Mozilla independently recovered the keys and confirmed that their generation was flawed. The technical finding is severe: the affected P-384 private keys were integers below 256, making them trivially recoverable from public information. Describing this simply as a…

TL;DR A supply chain security investigation has identified malicious code in LiteLLM version 1.107.0, a Python package distributed through PyPI. The affected package contains multiple files designed to execute code automatically when Python starts, retrieve attacker-controlled payloads, and maintain persistent access to compromised environments. Based on the analyzed package, this should be treated as a…