768 Leaked Corporate AWS Keys Held Full Admin Rights

by Truffle Security Research

Truffle re-tested 10,616 AWS key pairs that surfaced publicly between August 2022 and August 2026, and on 10 August 88 percent of them still authenticated, which is soda pressing. One in six of the 64,024 keys they have verified is a root key, and a root key cannot be scoped down, it is the account. Where ages were readable the median is 1,831 days old, only 13.7 percent were ever rotated, and 929 live IAM users already carry AWS's own AWSCompromisedKeyQuarantine policy, 112 of those on the version AWS stopped applying in 2023. AWS spotted the exposure, told the owner, and three years later the key still works. Worst of all, 130 live root keys belong to organization management accounts.

Open-source Post-quantum Cryptography Serverless CA

by Paul Schwarzenberger

Paul has run an open-source serverless private CA on AWS for a couple of years, and this release can make the whole hierarchy post-quantum, with CA private keys generated inside KMS HSMs and never exported. The neat bit of engineering is the certificate revocation list. KMS caps RAW signing at 4,096 bytes, so a big list will not sign, and all signing uses the EXTERNAL_MU message type, computing the 64-byte ML-DSA message representative outside KMS. He then lists what genuinely does not work yet, which is the part every "we are quantum ready" post leaves out. ALB and API Gateway will not do ML-DSA for mTLS, macOS Keychain errors on import, and mainstream browsers will not accept these certificates. If somebody wants your 2027 post-quantum plan, this is a working root you can deploy this afternoon and run beside your RSA hierarchy.

Threat hunt AI: How we built an AI security analyst on AWS for under $500/month

by Pablo Vidal

Pablo's team runs daily AI threat hunts across fifteen log sources for about $500 a month, and this is the build rather than the pitch, with the bill itemised. EventBridge and a Lambda start each hunt on a cron as a container that runs on ECS Fargate for 15 to 45 minutes, writes findings into the same Snowflake alerts table the SQL detections use, and stops, so no hunt is left running between investigations. A hunt is a YAML file. An objective in plain English, severity guidelines to calibrate the model's judgement, the false positives you already know about, and flags for which APIs the model may call during the investigation. The honest parts are the best parts, including why the single-shot version did not work and why the one awkward piece of infrastructure is a NAT gateway, because Snowflake wants a static IP to allowlist.