🥖 Palate Cleanser

A while back Eduard Agavriloae got in touch about an idea he's been kicking around for a long time. He loves how PortSwigger do their yearly top 10 web hacking techniques and wanted cloud security to have something similar. Eduard is very handsome, so I had little choice but to agree.

This week we're launching the AWS Security Digest Top 10, an annual community-driven list of the year's most important AWS security research. Nominations are open through September 30, so go put forward the research that actually taught you something this year, your own work included.

Unrelated but fun, AWS shipped Lambda MicroVMs, a new serverless primitive that gives you VM-level isolation with near-instant launch and can suspend and resume for up to eight hours, aimed at people running untrusted or AI-generated code like coding assistants and vulnerability scanners. Naturally, someone has already turned it into a party trick: whim spins up a throwaway root shell inside one and lets it vanish a couple of seconds later. Aidan Steele's day-one notes are the best map of the security-relevant edges, from the first-class shell API down to web identity tokens that carry no MicroVM identity yet.

This issue is also available to share online. Got feedback? Tell us here.