The Capital One Breach, Seven Years Later: The Blast Radius Problem That Won't Go Away

In 2019, a single SSRF vulnerability turned into 106 million stolen records. AWS shipped IMDSv2. Seven years later, half of EC2 instances still don't enforce it, and attackers have industrialized the technique.