Tag
Lambda full IAM resource-based policies shipped on 25 August 2026 at no extra charge. The launch adds three APIs on a new 2026-07-09 path, keeps the old 20 KB ceiling, and leaves two AWS pages in conflict.
Manu Shukla 
Azure Application Gateway WAF can now return a custom status code and body instead of a bare 403. The announcement claims parity with Front Door, but only Front Door publishes the five permitted codes.
Manu Shukla 
AWS added a task-hours cap to Security Agent on 19 August 2026. The smallest allowed value is 20 hours, and the Price List API rates pen testing at $50.00 per hour, so the floor is $1,000 a test.
Manu Shukla 
DynamoDB Streams ABAC went live 19 August 2026: 50 tags per stream, a 10 KB cap, existing accounts disabled by default, and a seven-calendar-day opt-out window.
Manu Shukla 
AWS Network Firewall added stateful rule hit counts on 17 August 2026. The visualization reads alert logs, and alert logs never record a pass rule, which is the rule most likely to be shadowing your policy.
Manu Shukla 
AWS added the denying policy ARN to S3 403 messages on 13 August 2026. It appears only on explicit deny, covers five policy types, and skips bucket policies, VPC endpoint policies and directory buckets.
Manu Shukla 
Three IEEE S&P 2026 papers turned GPU Rowhammer into a privilege-escalation problem. GPUBreach reached a root shell with the IOMMU on. Which cards flip, what ECC costs, what to change now.
Manu Shukla 
Azure's first Rust client capability for Shared Access Signatures landed in July 2026 as azure_storage_sas 0.1.0. It builds user-delegation SAS signed by Entra ID, with no account keys in your code. Here is how it
Manu Shukla 
On July 14, 2026 AWS made Security Hub scan Microsoft Azure resources next to AWS, at the same per-resource price. Here is what it covers, what it costs, how it compares to Microsoft Defender for Cloud and Wiz, and when
Manu Shukla 