Discussions, questions and news about Terraform from cybersecurity professionals on Cyberr.
0 members · 17 posts
samuel watua Soita — Full Stack Software Engineer
One malicious package can turn a developer tool into a credential-harvesting machine. That's exactly why software supply-chain security deserves much more attention. Microsoft recently analyzed the LiteLLM 1.107.0 supply-chain compromise, where attackers used stolen developer to…
· 0 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
Your AI model may be secure. Your AI supply chain might not be. Think about everything surrounding a modern AI application. Open-source packages. Models. Plugins. MCP servers. APIs. Vector databases. Cloud services. Third-party tools. Container images. CI/CD pipelines. Every con…
· 3 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
You may have written 99% of your application code—and still be trusting thousands of lines you didn't write. That's the uncomfortable reality of modern software development. A typical application depends on: → npm packages → Python packages → Docker images → GitHub Actions → Clo…
· 1 reactions · 0 comments
Steven Daignault — Consultant
I'd like to experiment with 'paired' persona context engineering in my next position managing an objective or mission such as an InfoSec IAM modernization program. What this means is standing up a side-by-side team of AI personas to perform the same InfoSec program functions the…
· 7 reactions · 4 comments
Liam Romanis — Freelance Penetration Tester
container_escape_audit.sh v4.8.2: check 30 expanded from 8 → 26 RBAC probes, closing every gap we identified: * Escalation self-grant: escalate on roles/clusterroles, plus create clusterrolebindings and create rolebindings alongside the existing bind. * Full impersonation set: i…
· 3 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
📦 The software supply chain surface just expanded again. For the first time, threat actors are actively using the centralized HashiCorp Registry to distribute malicious Go-based payloads disguised as legitimate Terraform providers. This highlights a massive systemic risk: engin…
· 3 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
☸️ Cloud Security Architecture Check: How a single Kubernetes YAML file can hand over control of an entire GCP organization. Varonis just documented a massive "confused deputy" flaw where a Kubernetes user with limited privileges can escalate execution authority across the entir…
· 2 reactions · 0 comments
Zane Anderson — Security Consultant
OSINT Environment Hardening: Your OSINT Environment Is Your First Line of Defense; But It Needs an Update Most OSINT practitioners still make the same fundamental mistake: they treat their operating environment as an afterthought. They run reconnaissance from their daily driver.…
· 3 reactions · 1 comments
Julian Javier Eduardo Uribe Xolalpa — Cyber Security Analyst
If you are looking for a beginner-friendly way to learn AWS security, Flaws is a great place to start. Instead of focusing on common vulnerabilities like SQL injection, XSS, or buffer overflows, Flaws teaches you about real mistakes and misconfigurations that occur in AWS enviro…
· 7 reactions · 1 comments
Maudrux Adrian — Directeur Général France | Le futur du recrutement | Cyberr.ai
Bonjour, pour cette nouvelle Newsletter, nous avons décidé de parler sécurité et conformité des Pipelines CI/CD. D'abord, parce que l'ANSSI vient de sortir une étude sur le sujet, ensuite parce que c'est l'un de nos chevaux de bataille depuis deux ans. 1. L'étude de L'ANSSI Le p…
· 4 reactions · 0 comments
Jakub Witek — SOC Analyst | Cybersecurity Professional
Has successfully verified Build Infrastructure with Terraform on Google Cloud (Google Cloud), Implement Cloud Security Fundamentals on Google Cloud (Google Cloud) and 2 more certifications
· 0 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
container_escape_audit v4.7.2 — rolling up the 4.7.x line A bigger update than the version bump suggests. Since 4.6: Container OS support actually fixed, not just claimed — Amazon Linux, SUSE, OpenShift/RHCOS, and Azure Linux nodes were silently falling through to "unknown" beca…
· 1 reactions · 0 comments
Aaron Doran — Cybersecurity / SOC Analyst / DevSecOps
Has successfully verified CompTIA Security+ (CompTIA) and HashiCorp Certified: Terraform Associate (HashiCorp)
· 0 reactions · 0 comments
Laurent Halimi — CEO & Founder CYBERR & HEELR
I just created a new group: Cloud & DevSecOps! Join us and be part of the conversation. #CloudSecurity #DevSecOps #AWS #Azure #GCP #Kubernetes #ContainerSecurity #ZeroTrust #CSPM #IaC #Terraform #CICD #ShiftLeft #PlatformEngineering #Cyberr #CyberCommunity #Infosec /groups/c13bc…
· 1 reactions · 0 comments
Goce Petrov — AI Security & DevSecOps Practitioner
Has successfully verified HashiCorp Certified: Terraform Associate (HashiCorp), AWS Certified Cloud Practitioner (Amazon Web Services Training and 2 more certifications
· 0 reactions · 0 comments
André Ataíde — Systems Analyst – Supply Chain & ML Security
Software release decisions tend to leave no trail. The scanner ran, flagged something, someone decided to act (or not), but that decision got lost in a Slack thread, in a call, or ended up somewhere that doesn't survive an audit. It's a pattern that repeats everywhere, for the m…
· 0 reactions · 0 comments
Innocent O. Akpareva — Cybersecurity Analyst
CI/CD pipelines are a prime attack surface. One misconfigured permission can mean the difference between a secure release and a supply chain breach. Which setup actually enforces segregation of duties? Drop your answer below 👇
· 0 reactions · 0 comments