Imprivata EAM Keeps Appliance Keys Trusted Until Redeployment
EAM through 26.2.6 has no supported RSA key-pair rotation. Protect key copies in backups and snapshots, and plan redeployment if the private key is exposed.
Read article →identity
Authentication, access, credentials, and identity systems.
Storm-3068 Steals Kubernetes Credentials via Microsoft Azure DevOps
After a password reset, Storm-3068 used an authorized Azure DevOps pipeline to collect Kubernetes credentials. Trace pipeline changes and restrict resource access.
Read article →
Zimbra Mail Clusters Face Secret Theft After Server Intrusions
Microsoft traces a mail-server intrusion from an optional SNMP notification path to root persistence, shared authentication secrets and peer mailbox nodes.
Read article →
Cisco SD-WAN Manager Flaw Gives Attackers Admin Access
An exploited URI-encoding bypass reaches the management API as admin. Check Cisco's service-proxy and server logs, restrict exposure, and install a fixed release.
Read article →
Authlib accepts unsigned JWS payloads as verified
An empty signatures array skips Authlib's verification loop. Locate callers of the JSON JWS deserializer and reject unsigned input before trusting its payload.
Read article →
AWS Quarantines an Exposed IAM Key While CloudTrail Names the User
A public-key exposure test reached AWS quarantine in 10 seconds. Alert on the IAM policy attachment, then investigate the key and follow the Support case.
Read article →
Storm-3168 Deletes Azure Storage Accounts With Stolen Service Principals
Two compromised service principals drove a rapid Azure deletion campaign. Trace their ARM operations, rotate exposed secrets and verify recovery-resource locks.
Read article →
BigBear Phishing Bypasses Microsoft 365 MFA at 258 Organizations
CloudSEK found BigBear 2.0 stealing Microsoft 365 session cookies after MFA. Revoke sessions, rotate credentials and require phishing-resistant sign-in.
Read article →
Attackers Exploit NetScaler Flaw to Bypass Authentication
Customer-managed VPN and AAA appliances need branch-specific fixed builds; configuration determines exposure on later NetScaler releases.
Read article →
Sliver Toolkit Scripts Credential Theft and Persistent Domain Access
A recovered Sliver kit shows how one operator scripted Domain Admin access, disabled defenses, stole credentials, and hid rotating command servers behind Ethereum.
Read article →
JSCeal Replays Browser Sessions to Steal Fresh Google Tokens
Recovered JSCeal code replays stolen cookies and passwords through a headless browser to obtain fresh Google OAuth tokens and exposes concrete Windows hunt artifacts.
Read article →
LiteLLM Flaw Lets Read-Only Accounts Steal AI Gateway Secrets
Zenity saw file-read probes matching CVE-2026-35029. LiteLLM advises upgrading to 1.83.0 or later; defenders should hunt configuration changes and rotate exposed secrets.
Read article →
Attackers Breach JetBrains Cloud Coding Service and Expose Credentials
JetBrains confirmed that an unpatched TeamCity flaw exposed Cadence users’ code and secrets. Former users should rotate credentials and review connected systems.
Read article →Showing 27–39 of 65