Parisa Tabriz

Payment iframes aren’t bulletproof — and we now have proof. John Elliott just published a must-read on the Jscrambler blog about a real silent skimming attack that compromised a payment iframe in the wild. This changes the conversation around SAQ A, iframe isolation, and the idea that merchants can simply “outsource” payment security. If you work with PSPs, acquirers, or PCI DSS 6.4.3 / 11.6.1, this one matters. 👉 https://lnkd.in/dcg2EtZu

15

Cross-Linking of Validators Makes Attacks Even Harder. To pull off a meaningful attack, an attacker would have to compromise multiple blocks in a row, not just one, and with each block having multiple validators involved, the majority of the validator network would need to be compromised. PAW Chain created brand new validation architecture. Read about it below. ⬇️ https://lnkd.in/ewxZqmpe

2

Claude has officially doubled five-hour usage limits during off-peak hours on weekdays! From now through March 27, 2026, you automatically get 2x the capacity on Free, Pro, Max, and Team plans (Enterprise excluded). Here’s how to maximize this limited-time boost: 🕒 The Timing: The doubled limits apply outside the window of 8 AM–2 PM ET / 5 AM–11 AM PT on weekdays. Usage remains standard during peak hours. 💻 Where It Applies: The 2x usage increase works automatically across Claude (web, desktop, and mobile), Cowork, Claude Code, Claude for Excel, and Claude for PowerPoint. No activation or settings changes required - if you’re on an eligible plan, the boost is already active. This is the perfect opportunity to tackle resource-intensive projects like deep coding sessions or complex data analysis. How are you planning to use the extra capacity this week? #ClaudeAI #Anthropic #Productivity #AIConsulting #TechUpdate

1

2 Comments

Meta's Community Notes are *far* from ready to replace the fact-checkers Zuckerberg ejected in January. To make things worse, Meta, unlike Twitter, has not shared the full database of notes to allow for a systemic review of the program.

5

significant privacy development out of #Utah - good to see a Digital Identity Bill of Rights included here: https://lnkd.in/gJSey-4s """ The following rights constitute the digital identity bill of rights in this state: (1)An individual possesses an individual identity innate to the individual's existence and independent of the state, which identity is fundamental and inalienable. (2)An individual has a right to the management and control of the individual's digital identity to protect individual privacy. (3)An individual has a right to choose, receive, and use a physical form of identity assertion that is endorsed by the state. (4)An individual has a right to not be compelled by the state to possess, use, or rely upon a digital form of identity assertion in place of a physical form of identity assertion that is endorsed by the state. (5)An individual has a right to state endorsement of the individual's digital identity upon meeting objective, uniform standards for eligibility and verification established by law, and a right to not have such endorsement arbitrarily or discriminatorily withheld or revoked. (6)An individual has a right to have the state's operation of digital identity systems governed by clear standards established by the Legislature, including for eligibility, issuance, endorsement, acceptance, revocation, or interoperability of digital identity assertions. (7)An individual has a right to transparency in the design and operation of a state digital identity, including the right to access, read, and review the standards and technical specifications upon which the state digital identity is built and operates. (8)An individual has the right to choose what identity attributes are disclosed by the individual's state digital identity in accordance with standards established by the Legislature. (9)An individual has the right to any service or benefit to which the individual is otherwise lawfully entitled based on the individual's choice of a lawful format or means of identity assertion without denial, diminishment, or condition. (10)An individual has a right to be free from surveillance, profiling, tracking, or persistent monitoring of the individual's assertions of digital identity by the state, except as authorized by law. (11)An individual has a right to not be required by the state to surrender the individual's device in order to present the individual's digital identity.

5

1 Comment

The cloud’s moving too fast for yesterday’s defenses, and Upwind Security just made its next move count. The SF–based, Israeli-founded startup’s pursuing FedRAMP®Moderate Equivalency with Coalfire, the FedRAMP assessor trusted by top U.S. #techsuppliers. This is runtime-first #cloudsecurity entering the federal ring. FedRAMP is where most startups stall. Upwind sees it as runway. Founded Oct ’22 by the crew behind Spot.io’s $450M sale to NetApp, Upwind knows scale under fire. CEO Amiram Shachar led that exit after 6+ yrs in Mamram, Israel’s elite tech unit. Chief Architect Liran Polak built distributed systems before Spot.io. CPO Lavi Ferdman, also Mamram alum, ran sales & strategy at Spot.io & NetApp. Co-founder Tal Zur rounds out the team. Together, they built a platform that flips cloud security by focusing on what’s happening now, not what logs said last week. Upwind’s runtime-first CNAPP runs inside infra via #eBPF sensors. It sees how workloads behave, how #APIs talk, how traffic flows, live. That visibility slashes alert noise 95–98%, cuts #rootcause analysis 10x faster & maps infra relationships on the fly. Across Amazon Web Services (AWS), Azure & GCP, that precision isn’t hype, it’s how enterprises protect millions of workloads without drowning in false alarms. Coalfire’s Fast Ramp® compresses a 12–18 mo slog into a 6–9 mo sprint. EVP Karen Laughton, one of the top FedRAMP veterans, leads the effort. “The race for cloud security’s moving faster than ever,” said CEO Amiram Shachar. “Firms supporting government missions must secure platforms, protect workloads & embrace AI innovation as threats rise. Upwind was built for this moment. ”Momentum backs it: $180M raised from Greylock Partners, Lightspeed, CRAFT, Cyberstarts, TCV & others; Series B at $850–900M. 150+ global customers, The RealReal, H2O.ai, Rivery Capital & Vestiaire Collective. 63x revenue growth in 2025. April’s Nyx Security acquisition added app-layer protection, launching CADR, the first CNAPP fusing infra & app visibility. By Aug, Frost & Sullivan named Upwind “Company of the Year”; Gartner listed it in 3 Hype Cycles, rating 4.9/5 on Peer Insights. Analyst James Berthoty of Latio put it simply: “As vendors face stricter compliance & higher #certification costs, they need platforms that cut noise, prove security, and speed time to market.” FedRAMP isn’t just compliance, it’s conversion. Once equivalency lands, Upwind’s runway opens to #federalagencies, #contractors & #integrators chasing zero trust under EO 14028. The name says it all. Flying upwind means using resistance as lift, federal validation for runtime-native security. The clock’s ticking, the cloud’s watching, and Upwind’s climbing into clear air. #Security #Cloud #CloudComputing #Compliance #Enterprise #EnterpriseTech #EnterpriseAI #SaaS #Infrastructure #Technology #Innovation #TechEcosystem #StartupEcosystem #TechNews If software engineering peace of mind’s what you crave, Vention is your zen.

16

3 Comments

RSAC is two weeks out and the Abstract team is rolling deep into San Francisco. If you’re heading to RSAC and want to talk security data pipelines, streaming detections, or the reality of modern SIEM, we’ll be around all week. Here are a few places to catch us: 🍸 Night at the Mercantile — Monday, March 23 We’re kicking off RSA week with our friends at Dune Security and Reality Defender. Networking, hors d’oeuvres, open bar. 🎤 Cloud Security Alliance: Connect & Collaborate — Tuesday, March 24 I’ll be joining an RSAC session about fixing cloud security at the architectural layer. 🌙 DetectCon After Dark — Wednesday, March 25 We’re co-hosting this with detections.ai. A meetup for detection engineers and threat researchers. No slides. No vendor demos. Just the people doing the work. 📅 Executive Meetings All Week If you want to talk composable SIEM, security data pipelines, or why the store-everything model isn’t scaling, our leadership team will be available throughout RSAC. Swipe through the carousel for the rundown. Event details and my Cloud Security Alliance session are in the first comment. If you’re in San Francisco that week, come find us.

52

4 Comments

AWS Helps Take Down Major DDoS Botnet Today the U.S. Department of Justice announced charges against the operator of Rapper Bot, a massive IoT-based DDoS botnet. Working with Defense Criminal Investigative Services (DCIS), AWS made important contributions to the investigation. AWS key findings about Rapper Bot: • Conducted over 370,000 attacks since April 2025 • Attack sizes ranged from several terabits to over 1 billion packets-per-second • Targeted organizations in 80+ countries • Infected 45,000+ devices across 39 countries AWS contributed to DOJ’s effort by identifying Rapper Bot’s command and control (C2) infrastructure and reverse engineering the IoT malware to map its operations and activities. In addition to affecting their targeted victims, these activities can degrade internet services more broadly. Today's actions help improve our collective safety and security, and AWS is pleased to have assisted in this effort along with our industry partners. https://lnkd.in/gJS_UxTP

1,187

18 Comments

via Vulnerable U "A security researcher spent months trying to get Bluspark Global's attention about some pretty gnarly vulnerabilities in their shipping platform. Plaintext passwords, unauthenticated APIs that spilled customer data going back to 2007, and the ability to create admin accounts without any verification. The researcher tried emails, voicemails, LinkedIn messages - but Bluspark ghosted him completely. It wasn't until TechCrunch stepped in and literally included part of the CEO's password in an email that the company finally responded (through lawyers, naturally). This hits different because Bluspark isn't some random startup - they're powering freight shipments for major retailers and grocery stores worldwide. Researchers have been warning about hackers increasingly targeting logistics companies to redirect cargo shipments to criminals. The good news is everything's patched now, and Bluspark claims no evidence of exploitation. But the fact that it took including someone's actual password in an email to get a response? That's not exactly inspiring confidence in their security posture." https://lnkd.in/ep2YfR6Y

5

1 Comment

⚡️ When the Cloud Crashes and the Agents Awaken A single AWS update took down flights, payments, and apps across the U.S. A tough reminder that even the smartest systems depend on fragile infrastructure. At the same time, a16z crypto’s State of Crypto 2025 shows the opposite trend: the digital economy is maturing. Stablecoins went mainstream, institutions are onchain, and AI and crypto are converging. Two stories, one theme: Resilience is the new intelligence. At Inspire Global Ventures, we invest in the systems that make intelligence actionable and infrastructure adaptive. 📖 Read this week’s edition of The Edge: 👉 https://lnkd.in/gYXXDKEJ #VentureCapital #Infrastructure #AI #Automation #Tokenization #InspireGlobalVentures

5

The dog bowl is irresistible! If you want to do 1 thing to help stem Digital Harms - this is the one “one small step for you but a huge step for humanity” The organization is supported by the Internet Society Foundation and if it passed their scrutiny- it’s ok. I know because the People Centered Internet (which I cofounded with Vint Cerf) was a recipient of the Internet Society (which Vint Cerf also co founded) largesse / so we went thru the stringent process. I am donating as I know Lisa LeVasseur and she is GREAT - her heart is in the right place AND is also very capable.

10

Had an incredible time connecting with the Myriad360 team and several inspiring leaders in the cybersecurity and technology space. It was clear we all share a common focus advancing how we understand, manage, and govern AI within our organizations to drive innovation securely and responsibly. As AI continues to evolve, the real battle isn’t about resisting it, it’s about harnessing it responsibly. Strong AI governance is essential for establishing clear policies, ensuring transparency in data use, implementing ethical frameworks, and aligning AI adoption with business objectives. With the right guardrails and purpose, AI can strengthen our defenses, enhance decision making, and ultimately help us build a more resilient and secure digital future. #CybersecurityLeadership #ArtificialIntelligence #DailySecurityHabits #TechStrategy #CISO #ITLeadership #Myriad360 Caly Oliveira Jocelyn S. Alexander Haycock Madison Rocha Ki-Jin Yoon Ryan DuPre Sergio Tagliapietra Noam Perel Whitney Coleman Will Brown Neeraj M. Ben Flemming Myriad360 Irving Chan Christopher Iannacchino

52

5 Comments

2 lines of code to detect audio, video, and still image deep fakes, via a seamless, high-scale API 2 lines of code to save your business or government agency from disaster 👇

9

New from SimpleFunctions: query-gov. Ask a policy question, get the legislative record and the market odds. One call searches Congress.gov, Kalshi, Open States, and 143 legislation-market pairs we maintain. ~3 seconds, no auth. Free and open. https://lnkd.in/g8dkdbes

1

In a moment of dramatic change in the way software is written, it is important to remember the security lessons we've learned over the past 20 years - Christoph Kern of Google captures those comprehensively here: https://lnkd.in/gHu3A7zx

42

4 Comments

🚀 Introducing Fleet Hound: Graph Security Analysis for Fleet I’m excited to open-source "Fleet Hound", a new high-performance tool designed to visualize and analyze relationships within your infrastructure using Fleet Device Management. Inspired by tools like BloodHound and Cartography, Fleet Hound takes a graph-first approach to inventory. Instead of viewing flat lists, it ingests Fleet data into Memgraph to map the hidden connections between your assets. 🔍 What it does: Visualization: Maps Hosts, Users, and Software as interactive graph nodes. Relationship Analysis: Automatically identifies links (e.g., (:User)-[:USES]->(:Host)). Granular Control: Supports filtering by specific Teams for targeted analysis. Performance: Built with parallel processing to handle thousands of assets in seconds. It’s fully Dockerized and ready to deploy. Check it out on GitHub: https://lnkd.in/gkNpaSTH #FleetDM #GraphDatabase #SecurityEngineering #DevSecOps #OpenSource

237

4 Comments

<<As we consider program correctness, it is natural to focus on well-illuminated topics such as memory safety, but the full tapestry of software-related risks is much larger. This article considers the implications of defined versus undefined program states, as well as actions taken in light of those implications and in light of the certainty that the value of the world's online estate and therefore the cost of digital mistakes will never again be as low as it is today.>> (me, March 13 2026) https://lnkd.in/guZz5Bjr

14