Orca Security Blog

https://windowsforum.com/security-alerts.84/cve-2025-55241-entra-id-cr… https://orca.security/resources/blog/autowarp-microsoft-azure-automati… https://petri.com/microsoft-azure-automation-cross-tenant-access-flaw/ I don’t recall much in the way of AWS vulnerabilities like these, but they’re a regular occurrence on Azure.

In agreement with frodd above. Dependencies and supply chain attacks are probably the greatest risk to a lot of software orgs, as they run them across all their environments: Development (with secrets and other valuable artefacts on developer VMs), CI/CD pipelines which may have access tokens to production (and other) environments, and production itself. Notably even security companies are being impacted by this[0]. The scale of these attacks has amplified quite significantly the past three years, but are not solely exclusive to the javascript ecosystem [1] or even just namesquatting/typosquatting [2]. The resolution is broader security awareness, "onion layered" security controls and implementing simple non-burden inducing processes and policies. Sometimes not updating (what was wrong with the previous version of a dependency if there was no immediate vulnerability or production issue caused by it?) or having a two week cool down for updates (which some supply chain tooling natively supports) can appease some security functions through clear communication of the supply chain risk etc. If anyone has interest in courses aligned to your org on improving developer and broader engineering management awareness on this, e-mails in my profile :). [0] - https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrik… [1] - https://orca.security/resources/blog/hades-pypi-supply-chain-attack/ [2] -…

> it'd be awesome if the in-browser IDE launched with a temporary per-repo permission scope That's actually exactly what they do for codespaces. The token only has read/write on the repo you activated for the codespace [1]. They should definitely consider doing that for github.dev as well. [1] https://orca.security/resources/blog/hacking-github-codespaces-rce-sup…

If you really want access to the execution engine, looks like one team found a way. https://orca.security/resources/blog/aws-cloudformation-vulnerability/

Seems like the AWS Glue exploit [1] discovered by the same team is the more critical one of these two. The CTO of Orca confirmed that they were able to access an admin role in an AWS service account, and from there assume roles in customer accounts with service roles that trust the glue service [2]. 1: https://orca.security/resources/blog/aws-glue-vulnerability/ 2: https://twitter.com/yoavalon/status/1481691075672694793