Sophos Urges Rules at Sensitive Uploads Before AI Judges Intent
Endpoint AI can flag unusual access, but a familiar-looking transfer may still be harmful. Put explicit policy at the upload and measure the review queue.
Read article →identity
Authentication, access, credentials, and identity systems.
Latest in identity
Google BoringSSL Fixes Two Certificate Name-Constraint Bypasses
Two legacy BoringSSL name checks were fixed in March; a URI case remains under coordination. Find the validator your product actually uses.
Read article →
FBI Disrupts Laptop Farms Behind North Korean Remote Hires
CrowdStrike says fake employees used U.S. homes to run company laptops remotely. Inspect shipping changes, remote-access tools and hiring records together.
Read article →
Bank Intruder Targets Update Server After Third-Party Gateway Entry
At a European bank, compromised credentials opened a third-party gateway route; months of scanning and password guessing preceded a blocked attempt against WSUS.
Read article →
ConnectWise Backup Credential Opens Graph Access in 162 Tenants
An abused vendor-held Cloud Backup credential obtained app-only Graph tokens. Find the service principal, disable sign-in, then inspect roles and added secrets.
Read article →
ARMORY CASTLE Uses BeyondTrust Zero-Day to Keep Root Access
The actor exploited Remote Support, installed a root backdoor and reached managed endpoints. Patch BT26-05, then investigate appliance persistence and sessions.
Read article →
TLS Libraries Disagree on Which Signed Certificates Pass Name Restrictions
The same signed certificate can pass one validator and fail another. Test the actual TLS path, update affected libraries and keep issued names explicit.
Read article →
Bisheng SSO Issues Admin Tokens Without Checking the Caller
The legacy SSO route issues a JWT for a supplied username and remains unpatched; separate cross-user assistant and workflow flaws have release-specific fixes.
Read article →
YAM Store sells Microsoft and Google cloud access to phishing crews
Microsoft traces a broker reselling cloud tenant access and storage to phishing kits. Examine app credentials, privileged grants and hosted files in affected tenants.
Read article →
Fake WatchGuard VPN download takes passwords before serving the real client
A lookalike download page collects the VPN server and credentials twice, then starts a signed WatchGuard installer. Check browser history and VPN logins.
Read article →
Shopware media uploads expose admin tokens to stored XSS
An uploaded HTML file can run in a Shopware administrator's browser. Restrict media creation or block HTML uploads while checking who can reach existing media.
Read article →
Ivanti VPN Zero-Days Let UTA0576 Reach Root and Steal Credentials
A patched-at-the-time Connect Secure VPN fell to a three-flaw chain. Upgrade affected branches and investigate memory, LDAP traffic and movement from the appliance.
Read article →
Microsoft Tests Post-Quantum Certificates Before Enterprise Rollout
A closed TLS pilot exposes the certificate-chain work ahead. Map issuers and validators, then test ML-DSA certificates across real application paths outside production.
Read article →Showing 1–13 of 65