Unpatchable Vulnerabilities of Kubernetes: CVE-2020-8562 | Datadog Security Labs A look at how Kubernetes CVE-2020-8562 allows attackers to bypass API server proxy protections using DNS rebinding

Next in my series of blogs on unpatchable Kubernetes vulnerabilities is out. This time it's about TOCTOUs and SSRF

securitylabs.datadoghq.com/articles/unp...

Youths, may I recommend you look up how the subprime mortgage crisis happened? Just, you know, for science

Compromised axios npm package delivers cross-platform RAT | Datadog Security Labs An attacker hijacked an axios maintainer's npm account to publish malicious releases that deliver a cross-platform RAT.

Compromised axios npm package delivers cross-platform RAT

securitylabs.datadoghq.com/articles/axi...

Unpatchable Vulnerabilities of Kubernetes: CVE-2020-8561 | Datadog Security Labs A look at how Kubernetes CVE-2020-8561 works

Just released another entry in my blogs looking at the unpatchable vulnerabilities of Kubernetes.
Whilst the CVEs are quite old, understanding them is useful, both to understand possible mitigations and also for some of the Kubernetes details they involve.

securitylabs.datadoghq.com/articles/unp...

For those job hunting right now I made sure to get a photo of the jobs board at #KubeCon

A cackling goose (Branta Hutchinsii) in flight, proclaiming “I migrated off ingress-nginx!” Does she look joyful? Does she look mischievous? Is she just glad it’s over? Only you know for sure!

🚨 ingress-nginx is now retired 🚨

Stop by the SIG Security booth P-4B at #kubecon #cloudnativecon for a commemorative sticker!

We will be there this afternoon and Thursday afternoon. Hope to see you there!

I’m learning loads of things already. if you’re not here I’d recommend catching the video when it comes out!

@averagemarcus.bsky.social and @sagikazarmark.com getting started on their kube-oddities talk at Kubecon!

Very much looking forward to this #KubeCon talk from @mccune.org.uk

Just a little reminder for all the folks heading to KubeCon - I have a BlueSky feed that tries to collect all related posts covering all related events.

bsky.app/profile/did:...

By the way, we just published another privilege-escalation CVE in ingress-nginx: github.com/kubernetes/k...

🚨 This will be the final, final release. Please migrate off ingress-nginx as soon as possible. 🚨

When an AI agent came knocking: Catching malicious contributions in Datadog’s open source repos | Datadog Learn how Datadog detected and resolved issues from hackerbot-claw, an AI-powered automated attack campaign.

When an AI agent came knocking: Catching malicious contributions in Datadog’s open source repos

www.datadoghq.com/blog/enginee...

UNC6426 Exploits nx npm Supply-Chain Attack to Gain AWS Admin Access in 72 Hours UNC6426 used stolen GitHub tokens from the 2025 nx npm breach to gain AWS admin access in under 72 hours, enabling data theft and cloud destruction.

Researchers have been warning about this for years.

Compromise a developer laptop → steal tokens → pivot to cloud.

In many orgs that path ends with AWS admin in minutes.

thehackernews.com/2026/03/unc6...

yep :) it's pretty wild, and I don't believe they're intending to change it

One of the points I make in Kubernetes Security a lot is that talking about security defaults is hard as each distribution has its own idea of what works.

One of the most surprising of these is Microk8s' choice to not enable RBAC by default. More details here. raesene.github.io/blog/2026/03...

Honestly that was a surprise to me. The ordering was based on the results of the community survey where we asked participants to vote on a range of options for the top 10. I was surprised at both AuthN and logging being so low.

Kubernetes SIG-Security docs have been doing some work to refresh the OWASP Kubernetes Top 10, to help cluster operators and users have a clear idea of where to start with Kubernetes security. slightly delayed, we have our draft top 10 out now. Any feedback very welcome

owasp.org/www-project-...

For those who missed it yesterday, our CFP is now open.

Yesterday I filmed several baby birds walking across a street directly at my camera and asked Bluesky to suggest music

Several dozen folks did

Some even dubbed music over the original clip.

I haven't been able to get this out of my head.

So I give you

A Bluesky exclusive:

Reservoir Ducks

🐣 🪶

Indeed my talk *should* have been recorded, so hopefully will be available soon :)

If you want to get your company shouted out on our socials, get an advert in our brochure, and get mentioned in both the opening and closing talks, please get in touch, we are always looking for more sponsors.

Obsidian 1.12 is now available to everyone!

- Obsidian CLI
- Bases search
- Image resizing
- Automatically clean up unused images
- Better copy/paste into rich text apps like Google Docs
- Native iOS share sheet

Picture of a shop front sign Couper Carpets of Cuper

@ministraitor.bsky.social not sure if you're coming across to Dundee for Securi-Tay but if so, you should see if you can get here, so we can have Cooper at Couper Carpets of Cuper!

Really looking forward to Securi-Tay from the Abertay Ethical Hacking Society tomorrow.

If you're there and interested in hearing what 20 years of speaking experience has taught me and how you can hopefully improve your next talk, I'm on at 11:30am in track 3!

securi-tay.co.uk/schedule

Google API Keys Weren't Secrets. But then Gemini Changed the Rules. ◆ Truffle Security Co. Google spent over a decade telling developers that Google API keys (like those used in Maps, Firebase, etc.) are not secrets. But that's no longer true.

If you're using GCP and have enabled Gemini on any of your projects, this one is worth reading, as you may have some checking to do. trufflesecurity.com/blog/google-...

I see they're still using the Jags for this, I wonder what proportion of their sales Waymo's make up!

I had the chance to try these out in San Francisco last year, pleasantly surprised by how easy it was and also how well they handled chaotic traffic situations.

As the hardware price hikes start impacting server hosting costs, could be a good time to look out those old laptops and desktop you're hoarding (or that could just be me) and see if you can self-host!

A Look Ahead: Producer’s Letter from Tolero  Read more about the year ahead in Dungeons & Dragons Online in a new Producer’s Letter!

If you are returning to Dungeons & Dragons Online for our anniversary, make sure to read up on our plans for the year in our recently released Producer's Letter on DDO.com: https://www.ddo.com/news/ddo-producer-letter-feb-2026 #DDO

Looking forward to the conf. BTW the date on the sessionize page is right, but on that one (kcd.ist/cfp/) it's got the CFP close as Feb 16.

Cloud Native Rejekts Europe 2026 Sat, March 21, 2026

🚨 This is not a drill!!! 🚨

The tickets for Cloud Native Rejekts are available NOW! 😮

We can't wait to see you all in Amsterdam! 🇳🇱

pretix.eu/rejekts/reje...