grep -rl "identity" ./articles
Two flaws in FreeIPA and 389 Directory Server are unremarkable on their own. Together they let an unauthenticated client write a token entry with blank ownership, satisfy the check for whether it owns that entry, and attach a Kerberos identity with administrative group membership. Nobody has published how to tell whether it already happened to you.
A dark web service called Nexus advertised more than 153 million US and Canadian driver's licence scans, six image files each. Brian Krebs found his own licence in it, and his mother's, timestamped seconds apart on a day they both rented a car. The infrared and ultraviolet frames are the detail that says where the images came from.
A weakness in Lenovo's email verification let an attacker claim an address they did not control. Dropbox's account linking accepted Lenovo's word for it without asking for the Dropbox login. About 5,000 accounts were reachable that way between 4 and 21 August.
Three new Compliance API endpoints expose Claude Code local session metadata and full transcripts: prompts, bash commands, file reads and writes, MCP calls. It closes a real visibility gap. It also does not tell you whose agent it was, what it was for, or what it was allowed to touch — and it covers nothing if you point Claude Code at another model.
ShinyHunters registered a fake ReliaQuest SSO page and rang staff one by one, each time impersonating a named colleague from the security team. One person typed their password and approved the push. ReliaQuest says the attackers got view-only access to an Okta dashboard and nothing else — and the interesting part is which controls held.
Abnormal found iAuthFlow V2 selling for $10,000 on Russian-language forums. During the phishing flow it silently registers an attacker-controlled passkey on the victim's account. Passkeys are independent of the password, so the standard remediation — reset, revoke sessions — leaves the intruder logged in.
CVE-2026-69836 is a real maximum-severity flaw in Entra ID, and Microsoft fixed it cloud-side with nothing for customers to do. For most of 21 August its own bulletin marked it exploited in the wild. Microsoft corrected that field to No after a reporter asked. The correction has not travelled the way the original did.
Huntress reports password spraying up 155x in the first half of 2026, driven by a campaign against Azure CLI that abuses ROPC, a deprecated OAuth grant which posts your username and password straight to the token endpoint with no interactive MFA prompt. In two weeks it made 81 million login attempts.
The viral advice is recovery codes and a backup email. That covers losing your own account. It does nothing about someone buying your dead employer's domain and inheriting your Slack, or about accounts an admin cannot deprovision at all.
UNC6671 runs four extortion brands off one set of domains. The pretext is a security upgrade — FIDO2 enrolment, MFA migration — and the payoff is an adversary-in-the-middle portal. Average settled payment: $750,000.
The technique needs SYSTEM on the ADFS host and touches neither LSASS nor the running service. It works because manual certificate rotation leaves the database pointing at a ghost while the real key sits in the machine DPAPI store.
Silent Push counts roughly three million dangling DNS records worldwide. In one exercise across 12,500 apex domains they isolated 16,000 dangling subdomains and automated the takeover of 4,000 of them. The worst outcome isn't defacement — it's session cookies.
Sophos tracked STAC4749 across dozens of North American organisations between February and June 2026. Attackers used external Teams accounts and IT-themed personas to talk their way into remote access, then deployed a modular backdoor and, in at least three cases, Chaos ransomware.
Explore the latest cybersecurity threats in 2026 including AI-powered attacks, advanced ransomware, phishing 2.0, and identity-based breaches. Stay ahead with deep research insights.