PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How a startup’s cloud got taken over by a simple form that sends emails

aikido.dev | blog | #cloud | #cloud-security | #aws | #php | #ssrf | #iam | #incident-analysis | #imds | #iam-credentials
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

An SSRF bug in a PHP email form let attackers fetch EC2 IMDSv1 credentials and pivot to S3 buckets and CloudFormation templates with API keys; the walkthrough covers the chain and IMDSv2 mitigation.
Published
Collected

Related coverage

blog · vercel.com
Mitigating Denial of Wallet risks with Vercel
Protect against Denial of Wallet (DoW) attacks with Vercel. DoW exploits cloud scalability to inflate costs. Vercel provides solutions like budget alerts, spend limits, and anomaly detection to safeguard workloads and maintain financial stability.
blog · wiz.io
The many ways to obtain credentials in AWS
A deep dive into how AWS applications obtain IAM credentials—SDK provider chain, environment variables, credentials files, IMDS/IMDSv2, and container endpoints—plus what defenders should watch for.
blog · wiz.io
A security community success story of mitigating a misconfiguration
The story of fixing a common misconfiguration: GitHub Actions OIDC trust policies missing their 'sub' condition let anyone assume AWS roles, until coordinated research pushed defaults to change.
blog · vercel.com
Introducing Vercel Firewall and Vercel Secure Compute
Vercel Secure Compute and Vercel Firewall for enhanced protection of your applications on the frontend cloud
blog · aikido.dev
Ghost in the PHP2Shell: Why coordinated disclosure and patching will start moving faster
If you run PHP anywhere in your stack and did not upgrade, stop reading this and go upgrade to a patched version. More information on this is on our advisory blog, and check out php2shell.aikido.io to see if your service is potentially vulnerable.
blog · aikido.dev
How to patch PHP2Shell with free Aikido Images
PHP2Shell is a pair of critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on CVSS v4.0, and either one can let an unauthenticated attacker run code on a server that handles PHP requests. Cloudflare reports that exploitation has started.
Back