Ten years of nothing, then two days with AI, and a quiet PHP bug became a way into your cloud. PHP2Shell is a pair of critical CVEs in core PHP that let an unauthenticated attacker run code on an exposed server or read credentials straight out of memory. The attacker lands as the PHP worker, with every cloud role and secret it holds. You can’t patch every runtime overnight, but you can remove the access an attacker would use in the first place.

Working alongside AWS and Act Security, HUB moved the local Claude Code experience into cloud-hosted sandboxes in two days: the same terminal and IDE, sessions that survive a closed laptop, no credentials in the agent, and every action attributed to a named developer under central control.

Agent reasoning is inherently unpredictable and vulnerable to manipulation, and no amount of prompt engineering can prevent it from failing. Rather than reacting after a crisis, leadership must establish strict boundaries from day one. AI governance isn't about ensuring an agent always reasons correctly, it's about controlling how much damage it can do the moment its reasoning goes wrong.

Cloud security teams face a list that never ends. Can reducing unnecessary access stop the same problems returning?

Lambda Web Functions launched on 13 October. The endpoint auth type defaults to none, one execution role serves every request, existing lambda:* grants already cover it, and posture scanners can't see it yet.

One deploy puts your Lambda Web Function in three regions behind one domain. The access model is replicated with it: slow revokes, secrets copied to every region, and audit gaps that hide who called.

While nearly every cloud team agrees on the principle of least privilege, very few actually reach it. In our latest piece, Act Security CEO Jonathan Langer breaks down why over-permissioning happens - not because engineers are careless, but because complex cloud logic makes predicting impact nearly impossible. We explore why measuring "effective access" is the missing key to shifting policy management from guesswork to testable engineering, especially as autonomous AI agents enter the environment.

The recognition spotlights Act’s access model that reasons across identity, network, and AI as a single layer and scopes every human, workload, and AI agent down to what it genuinely needs, eliminating potential access paths available for agents or attackers.

A deep dive into how Act runs every Terraform change through a self-hosted Kubernetes platform engineered for zero standing access and seamless developer workflows.