AWS Puts Elastic Beanstalk on EKS, CrowdSec Supply-Chain Breach, Critical Next.js RCE, Microsoft Disrupts EvilTokens & Why Fixing the Initial Compromise Isn’t Enough

This week on Ship It Weekly: AWS introduced Elastic Beanstalk Cluster Mode, allowing multiple applications to run on shared EKS infrastructure while AWS handles much of the Kubernetes complexity. CrowdSec published how a software supply-chain compromise led to attackers copying roughly 170 private repositories using a stolen OAuth token. A critical Next.js vulnerability in ImageResponse can lead to remote code execution through attacker-controlled SVG data. And Microsoft disrupted EvilTokens, a cybercrime platform linked to more than 12,000 compromised inboxes across 10,000 organizations. The bigger theme this week is what happens after trust has been established. Elastic Beanstalk Cluster Mode puts more infrastructure behind a managed abstraction, but shared infrastructure still means understanding isolation and blast radius. CrowdSec shows how an initial compromise can become a credential problem long after the malicious code is gone. Next.js shows how something as ordinary as generating a social preview image can expose a server-side execution path. And EvilTokens shows how attackers can use valid access to move faster once inside an account. In the lightning round: F5 has a critical BIG-IP APM vulnerability under active exploitation. GitHub Enterprise Cloud can now export an inventory of credentials with enterprise access, including PATs, SSH keys, OAuth tokens, and GitHub App credentials. Zyxel patched a vulnerability affecting GS1900 switches. And Veeam Agent for Microsoft Windows has a privilege-escalation vulnerability that can lead to SYSTEM access. And the human closer comes back to CrowdSec. Removing the malicious package, patching the server, or reimaging the workstation does not necessarily end the incident. If an attacker already stole an OAuth token, cloud credential, SSH key, session, or registry credential, that access can survive long after the original compromise is gone. Containment means understanding not only how the attacker got in, but what they took with them Links AWS Elastic Beanstalk Cluster Mode https://tsn.io/1xaV7 CrowdSec Supply-Chain Attack Analysis https://tsn.io/7yq2f Next.js ImageResponse Security Advisory https://tsn.io/8JvHp Microsoft: Disrupting EvilTokens https://tsn.io/DtbC9 Microsoft: EvilTokens and Device-Code Phishing https://tsn.io/ZzwtD F5 BIG-IP APM CVE-2026-94127 https://tsn.io/sFuKW GitHub Enterprise Credential Inventory https://tsn.io/7bpMn Zyxel GS1900 Security Advisory https://www.tellerstech.com/go/s-b2595852/ Veeam Agent for Microsoft Windows Vulnerability https://www.tellerstech.com/go/s-166d3119/ This Week’s On Call Brief https://tsn.io/Nnd8g Ship It Weekly https://tsn.io/NqkdP On Call Brief https://tsn.io/Gpz2d