SHADOWFIREWALL
Adaptive Defense Architect
Professional Profile
ShadowFirewall creates behavioral firewalls based on hostile-pattern models. Background in AI and embedded systems, designs reactive defenses that learn from traffic.
Key Skills
Adaptive firewalls; Hostile-behavior modeling; Anomaly detection; Micro-segmentation; OT/SCADA security
Major Achievements
Designed the first behavioral firewall of a European smart factory.
Articles by SHADOWFIREWALL
When the Root Login Becomes the Target: AWS Accounts Face a Password-Spray Wave
A password-spraying campaign aimed at AWS root user accounts across more than 150 organizations shows how cloud attackers keep pressing on the most privileged identity in the stack.
Root of the Problem: A Month of Password Spraying Put AWS’s Most Privileged Login in the Crosshairs
A sustained attempt against AWS root accounts shows how low-rate credential attacks still matter when the target is the one identity that can reach everything.
When a Session Cookie Becomes the Skeleton Key to an AI Account
A credential-stealing campaign aimed at Claude accounts shows why modern account security is no longer just about passwords - it is about revoking live sessions before an attacker can replay them.
Stolen Claude Sessions Turn a User PC Into a Billing Weapon
Anthropic’s warning points to a familiar but still underappreciated threat: endpoint malware can steal live SaaS sessions and let an attacker act as the authenticated user without ever learning the password.
Okta’s Rally Points to a Bigger Cyber Bet: Identity for AI Agents
The earnings pop is only part of the story. The deeper signal is that buyers are treating machine identities and AI agents as security objects, not just automation tools.
Snowflake’s password lockout exposes a deeper cloud problem: nobody knows what the service accounts still do
Ending passwords for legacy machine identities is only the visible move; the harder task is finding every hidden integration, its owner, and the access it still deserves.
Why MFA Can Let the Wrong Person In
The security lesson is not that multi-factor authentication fails, but that it can succeed at the wrong job if identity proofing and monitoring are treated as afterthoughts.
WhatsApp Hardens the Front Door: Passkeys, Stronger Recovery, and Call Clues
A new security update adds multiple passkeys, longer alphanumeric passwords, and caller context - a small set of changes that could matter a lot in a platform where trust is often tested before a message is even opened.
WhatsApp Pushes Passkeys Past a Billion Users, Then Hardens the Weak Links Around Them
The login story is only half the picture: WhatsApp is pairing passkeys with a stronger second-step secret and caller-context cues aimed at lowering phishing, recovery abuse, and scam pressure.
WhatsApp Tightens the Lock: Passkeys, Stronger Recovery, and a New Layer Against Scam Calls
WhatsApp is pushing account security toward device-bound login, tougher two-step verification, and more caller context on Android, a small interface shift with real anti-phishing value.
WhatsApp Tightens Account Security With Stronger Two-Step Verification and Multiple Passkeys
The messaging app is rolling out new account controls that lean more heavily on cryptographic sign-in and harder-to-guess recovery secrets.
A Trusted Login Path Turned Into an Admin Shortcut
Two critical flaws in a WordPress SAML single sign-on plugin show how brittle identity trust can become when assertion handling goes wrong.
When SSO Turns Rogue: Two Critical miniOrange Flaws Put WordPress Trust at Risk
A pair of severe bugs in a WordPress SAML login plugin show how a single verification failure can turn federated identity into unauthorized access.
When a Real Microsoft Login Becomes the Attack
A phishing-as-a-service kit built around device-code abuse shows how attackers can turn a legitimate sign-in and MFA challenge into a valid cloud session.
When AWS Keys Escape, the Account Boundary Can Start to Disappear
A large set of publicly exposed AWS access keys underscores how cloud risk can hinge on identity, privilege, and how long a credential stays valid after it leaves private control.
VPN or Zero Trust: Why 2026 Remote Access Is Becoming an Architecture Decision
Business VPNs still matter, but the real security question is whether a company needs broad network access or narrower, policy-driven access to specific apps and services.
Cloud Keys That Would Not Die: Why Active AWS Secrets Are a Standing Risk
More than 9,300 publicly exposed AWS access keys are still active and valid, turning old leaks into live authentication material that defenders must revoke, rotate, and monitor.
Microsoft’s Entra ID Patch Exposes a Hard Truth: When Identity Breaks, Everything Feels It
A maximum-severity Entra ID vulnerability patched by Microsoft reinforces how fragile cloud trust becomes when the identity layer is under attack.
Identity Management Faces Its Next Test: When Non-Human Accounts Start Acting Like Operators
Non-human identities are already more numerous than human ones inside many enterprises, and the arrival of AI agents pushes identity control beyond static access lists toward governance of purpose, action, responsibility, and autonomy.
From Build Pipeline to SaaS Exposure: How a GitHub Actions Flaw Could Have Exposed Internal Credentials
A public workflow issue in Snowflake’s snowflake-connector-net repository illustrates how CI/CD script injection can turn routine automation into a secret-harvesting opportunity.