#authentication

2 articles

Artifactory instances without a join key were given a phantom one. Attackers were minting admin tokens three days after the fix

2026-09-03Security

CVE-2026-82329 lets an unauthenticated attacker forge credentials and mint administrator tokens against JFrog Artifactory, and the vulnerable state is the default one. The patch landed on 28 August; watchTowr saw exploitation from 1 September, including actors creating backdoor users.

Three separate teams found ways around passkeys — and one of them recovers the private key

2026-08-12Security

Black Hat and the weeks around it produced three unrelated results against phishing-resistant authentication: replayable signatures in Windows event logs, a master key pulled from Chrome's memory, and Windows Hello keys used without a PIN prompt.