AWS Puts Elastic Beanstalk on EKS, CrowdSec Supply-Chain Breach, Critical Next.js RCE, Microsoft Disrupts EvilTokens & Why Fixing the Initial Compromise Isn’t Enough

This week on Ship It Weekly: AWS introduced Elastic Beanstalk Cluster Mode, allowing multiple applications to run on shared EKS infrastructure while AWS handles much of the Kubernetes complexity. CrowdSec published how a software supply-chain compromise led to attackers copying roughly 170 private repositories using a stolen OAuth token. A critical Next.js vulnerability in ImageResponse can lead to remote code execution through attacker-controlled SVG data. And Microsoft disrupted EvilTokens, a cybercrime platform linked to more than 12,000 compromised inboxes across 10,000 organizations.The bigger theme this week is what happens after trust has been established. Elastic Beanstalk Cluster Mode puts more infrastructure behind a managed abstraction, but shared infrastructure still means understanding isolation and blast radius. CrowdSec shows how an initial compromise can become a credential problem long after the malicious code is gone. Next.js shows how something as ordinary as generating a social preview image can expose a server-side execution path. And EvilTokens shows how attackers can use valid access to move faster once inside an account.In the lightning round: F5 has a critical BIG-IP APM vulnerability under active exploitation. GitHub Enterprise Cloud can now export an inventory of credentials with enterprise access, including PATs, SSH keys, OAuth tokens, and GitHub App credentials. Zyxel patched a vulnerability affecting GS1900 switches. And Veeam Agent for Microsoft Windows has a privilege-escalation vulnerability that can lead to SYSTEM access.And the human closer comes back to CrowdSec. Removing the malicious package, patching the server, or reimaging the workstation does not necessarily end the incident. If an attacker already stole an OAuth token, cloud credential, SSH key, session, or registry credential, that access can survive long after the original compromise is gone. Containment means understanding not only how the attacker got in, but what they took with themLinksAWS Elastic Beanstalk Cluster Modehttps://tsn.io/1xaV7CrowdSec Supply-Chain Attack Analysishttps://tsn.io/7yq2fNext.js ImageResponse Security Advisoryhttps://tsn.io/8JvHpMicrosoft: Disrupting EvilTokenshttps://tsn.io/DtbC9Microsoft: EvilTokens and Device-Code Phishinghttps://tsn.io/ZzwtDF5 BIG-IP APM CVE-2026-94127https://tsn.io/sFuKWGitHub Enterprise Credential Inventoryhttps://tsn.io/7bpMnZyxel GS1900 Security Advisoryhttps://www.tellerstech.com/go/s-b2595852/Veeam Agent for Microsoft Windows Vulnerabilityhttps://www.tellerstech.com/go/s-166d3119/This Week’s On Call Briefhttps://tsn.io/Nnd8gShip It Weeklyhttps://tsn.io/NqkdPOn Call Briefhttps://tsn.io/Gpz2d