Cloud Privilege Escalation Paths in AWS IAM
Web app tests miss the IAM privilege escalation chains that actually compromise AWS.
Soren Halvardsen
Senior Contributing Editor
Soren Halvardsen
Soren spent eight years on red teams at two Fortune 500 financial institutions before transitioning to full-time security journalism and research writing. He specializes in breaking down complex exploitation chains into reproducible technical narratives.
5 stories
XXE Injection Against Modern XML Parsers
Default XML parsers enable dangerous entity resolution without developers realizing the risk.
Soren Halvardsen
Prototype Pollution to Remote Code Execution in Node.js
A flaw in how JavaScript handles object inheritance can let attackers execute arbitrary code.
Soren Halvardsen
Multi-Tenant Data Isolation Bypass in SaaS Applications
A single architectural flaw in multi-tenant systems can expose every customer's data at once.
Soren Halvardsen
SQL Injection in ORM-Backed SaaS Endpoints
Modern ORMs don't eliminate SQL injection—developers do when they bypass protections.
Soren Halvardsen