strong & smooth authentication and authorisation.
Riga, Latvia
Joined November 2015
- Tweets198
- Following126
- Followers158
- Likes141
4,800 hijacked GitHub accounts probed 61k repos and pushed credential-stealing malware. No exploit needed: the accounts were valid. bleepingcomputer.com/news/se…
13
Maersk: intrusion reached a legacy system inherited via acquisition. Acquired systems come with access paths rarely re-audited.
bleepingcomputer.com/news/se…
15
Railway: infrastructure flaws let attackers steal customer auth secrets and run up $740k in AI charges. Replayable secrets set the blast radius.
bleepingcomputer.com/news/ap…
5
CISA's new KEV entry: SonicWall SSLVPN single-factor auth, actively exploited. The flaw is passwords alone. Attackers log in; they don't break in. cisa.gov/news-events/alerts/…
23
OpenSSH fixed a flaw letting overlong passwords log into key-only Alpine servers. Your auth config is only as good as the code that enforces it. Patch now. thehackernews.com/2026/11/op…
16
LLMjacking is credential theft in a cloud-bill costume: stolen API keys are bearer credentials with no second factor, no approval, no expiry. Secrets are identity too.
thehackernews.com/2026/11/go…
16
Microsoft patched an Android Authenticator flaw that could let malicious apps steal work account access tokens with zero permissions. Authenticators are still software, not magic. cybersecuritynews.com/micros…
SilverStripe's MFA plugin had a bypass in its own password-reset flow. Worth remembering: recovery paths are part of the authentication surface. A second factor a reset can sidestep is decorative. vulners.com/github/GHSA-68WQ…
11
Northflank breach: customers' AI API keys abused. A static key is a password with no second factor — rotation is cleanup, not control. bleepingcomputer.com/news/se…
1
1
28
Ransomware usually logs in. This one broke in — attackers hit Synology NAS devices through two known DSM flaws. No second factor stops an exploited flaw; patching does. biz.chosun.com/en/en-it/2026…
47
CISA: Siemens' Mendix SAML module let an unauthenticated attacker replay a valid assertion and gain access. Your SSO's token validation is attack surface — patch it. cisa.gov/news-events/ics-adv…
18
Microsoft is retiring SMS and voice sign-in in Entra ID in February 2027. Codes sent to a phone number were never phishing-resistant.
bleepingcomputer.com/news/mi…
Ransomware rarely breaks in — it logs in. The Teams 'IT support' scam impersonates the people users are trained to trust. If support contacts you first, verify before you act. thehackernews.com/2026/10/at…
21
Phishing kits don't break MFA — they relay it. The IdP sees a normal login: right password, right code, real approval. What can't be relayed is a factor bound to the real origin. nousec.com/blog/phishing-as-…
FBI counts 600+ SafePay victims since 2024 — fallout reaches Medicaid and child support. Ransomware's cost lands downstream. The chokepoint is the first login. therecord.media/fbi-says-saf…
20
Qilin and INC ransomware crews exploited a now-patched PAN-OS auth-bypass flaw for unauthorized VPN access. Ransomware rarely breaks in — it logs in. Patch the VPN edge. thehackernews.com/2026/10/qi…
41
Deepfakes, forged IDs, live stand-ins: a service economy for beating KYC checks. A fraudulent onboarding owns every factor after it.
bleepingcomputer.com/news/se…
Attackers used ConnectWise's app identities to reach customer Microsoft 365 tenants. Non-human identities hold standing access, face no MFA, and rarely get audited.
thehackernews.com/2026/10/co…
19
Exploited auth bypass in BeyondTrust Remote Support. Patch first — MFA can't fix broken code. Remote access is the front door. cisa.gov/news-events/alerts/…
11
Keycloak's CIBA login flow can be bypassed (CVE-2026-109082). Your identity provider is code too — it needs patch cycles like everything else you run. vulners.com/rapid7/RAPID7:CV…
39