Scott Piper

I looked at all the AWS OIDC integrations I could find to identify how they might be misconfigured and to understand the variations that different vendors have in how they set these up. www.wiz.io/blog/avoidin...

Call for papers for PQCrypto 2027, here in Waterloo, Canada! pqcrypto2027.ca. Please submit your work related to post-quantum cryptography in all forms; see the website CFP for more details. Deadline Nov 17 (abstract), Nov 24 (full paper)

Update everything that verifies certificates against public roots.

Videos for fwd:cloudsec Europe 2026 are out! www.youtube.com/playlist?lis...

AWS has a new sign up experience, which puts new accounts into a sort of a sandbox, but not exactly in the way you might think. This post explores what it does and how it works. www.wiz.io/blog/explori...

A lot of cloud service providers beyond AWS allow you to store data in something that looks and acts like S3, but there are differences worth investigating. Check out my latest article discussing the security risks that carry over and the assumptions that break. www.wiz.io/blog/s3-clon...

Happy birthday to the Cloud Security Forum Slack! It started 9 years ago and remains my favorite place for cloud security conversations with experts across the industry. fwdcloudsec.org/forum/

Yesterday the White House signed a new Executive Order moving the deadlines for Post-Quantum Cryptography closer. I presented last week on PQC to give folks an understanding of what needs to be upgraded, visibility we see, and more. www.youtube.com/watch?v=BaRu...

Post-Quantum Cryptography is getting attention lately, but there is barely any data out there about the progress being made... until now! www.wiz.io/blog/state-o...

"Funny and distressingly realistic...propelled by awesome characters and inventive twists” — Andy Weir Silicon Valley invents the time machine in my upcoming book PARADOX INC, now available for preorder everywhere! Here's a look inside from @people.com: people.com/paradox-inc-...

The schedule for fwd:cloudsec North America is up! A few time slots are waiting for embargoes to clear. pretalx.com/fwd-cloudsec... We also still have some last minute tickets. The conference will be outside Seattle on June 1-2. fwdcloudsec.org/conference/n...

The CFP for fwd:cloudsec North America closes this Friday (March 20) at midnight Pacific time! Hotel and travel costs are taken care of for speakers (some caveats apply), plus tickets. Come speak June 1&2 near Seattle. fwdcloudsec.org/conference/n...

As a cloud security historian, it was fun to take a look at not just the what, but the why, of the changes in cloud security work over the years. www.wiz.io/blog/twenty-...

Tickets for fwd:cloudsec North America go on sale today, in about 4 hours, at 10am PST. fwdcloudsec.org/conference/n...

Tickets go on sale next week on Monday, Feb 9, at 10:00 a.m. PST for our North American conference happening near Seattle on June 1 and 2. An additional small batch will go on sale that evening at 11:00 p.m. PST. Tickets will be available for purchase here: www.eventbrite.com/e/fwdcloudse...

@fwdcloudsec.org is an awesome conference. Looking forward to seeing lots of cool submissions into the CFP!

Did you know Claude models have a "magic string" to test when a model refuses to respond? If that string enters prompt context, it can be abused to break LLM workflows until context is reset. It's the EICAR test string of the AI age. Details: hackingthe.cloud/ai-llm/explo...

We've locked in dates and venues for the North American (NA) and European (EU) fwd:cloudsec conferences this year! fwd:cloudsec NA will be in the Seattle, Washington area at the Meydenbauer Center in Bellevue on June 1 and 2. 🧵

What are we calling normal AWS now? Normal, standard, classic, commercial, global, american? How do you say out loud the acronym for AWS European Sovereign Cloud? I'm calling it "oosk", because the region is eusc-de-east-1, which sounds like a riff on the techno onomatopoeia "boots and cats".

The most surprising thing about AWS ESC is there aren't any cookie acceptance popup windows in the console. Is this really European?

Very cool research on a CodeBuild misconfiguration which could have had significant consequences. I’m a bit disappointed that there wasn’t more done to secure the supply chain after the Q Developer incident. www.wiz.io/blog/wiz-res...

The AWS European Sovereign Cloud (ESC) has launched! aws-news.com/article/2026...

This seems bad. www.wiz.io/blog/wiz-res...

December is generally a good time for gifts, and I have a special one for you. We are glad to announce fwd:cloudsec Europe 2026: September 7th and 8th - London, UK 🇬🇧 More info to come early 2026. Stay tuned, folks.

This is the best write-up on threat actor tradecraft I've seen from AWS. aws.amazon.com/blogs/securi...

My top picks from re:Invent security announcements: www.wiz.io/blog/top-aws...

This is excellent. Also available in video. allan.reyes.sh/posts/keepin... h/t tldrsec

It’s time to bust some malware! 🦠 Challenge #6 “Malware Busters” is LIVE. Built by Gili Tikochinski for the reverse‑engineering pros - dive into assembly and uncover what’s hidden inside. Think you can crack it? cloudsecuritychampionship.com/challenge/6

🚨 New Shai-Hulud-style npm attack hitting 25k+ repos and growing fast. Devs & CI/CD exposed via malicious preinstall. Wiz Research has detection + mitigation. Details: www.wiz.io/blog/shai-hu...

The day has come where we get to announce what we've been working on for the past year 😍 www.duckbillhq.com/blog/skyway-...

My favorite security story I've read this year 😂, a story of surprising turns by Alex Smolen: engseclabs.com/blog/raccoon...

Yuval Avrahami was ranked as the top Azure researcher by Microsoft this quarter! He has made a Kubernetes focused CTF for the Wiz Cloud Security Championship, check it out! cloudsecuritychampionship.com Also if you can find cloud zero days, check out www.zeroday.cloud with a $4.5M prize pool!

I feel like the biggest takeaway from the latest AWS outage is that there’s simply no architecting around them at this point. Even if you are 100% redundant/multi-whatever, your vendors and customers are certainly not. Order volume is dropping no matter what you do. We’re all in this together.

Jeep pushed a bad update on Friday that has been bricking 2024 Wrangle 4xe's. x.com/StephenGutow...

A company's website, API, and email were unavailable because "attackers socially engineered AWS into freezing its domain". www.theregister.com/2025/10/02/s...

Introducing ZERODAY.CLOUD🕵️‍♀️ Be the first to participate in the first-of-its-kind cloud hacking competition. 🤝 WIN HUGE PRIZES from our up to 4.5 million dollar prize pool. 💰🏆 Join us to help make the cloud a safer place. Register your exploit now >> zeroday.cloud

I really like the announcements that have been coming out of Cloudflare. In this latest one, SSO for everyone (not just enterprise). blog.cloudflare.com/enterprise-g... Another recent and interesting one is their data platform: blog.cloudflare.com/cloudflare-d...

After facing countless of limitation on #AWS #NitroEnclaves, the same feature is now available on normal EC2 instance. The coming month must be a busy month for me to try it out #ConfidentialComputing #AWSCloud aws.amazon.com/about-aws/wh...

S3 SOAP API is being deprecated in a month (Oct 31). docs.aws.amazon.com/AmazonS3/lat... h/t @quinnypig.com for pointing it out in @lastweekinaws.com

The first step toward an organization of organizations. aws.amazon.com/about-aws/wh...

Gal Nagli has opened my eyes to a speed and scale of web hacking that would be terrifying if he wasn't using those skills to help companies. He has put together a CTF challenge to showcase some of his most effective techniques. Check it out! www.cloudsecuritychampionship.com/challenge/4

A write-up that believes this story is propaganda and might have just been for spam. cybersect.substack.com/p/that-secre...