16-Year-Old Researcher Finds Microsoft Auth Vulnerability that Exposes 17.3 Trillion Stored Records
4 min1
CVE-2026-92288: Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party
Template Ageing and Longitudinal Verification in Fixed-Text Keystroke Dynamics: A Subject-Disjoint Study Across Eight Weeks
CVE-2026-86248: Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
CVE-2026-31377: Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service
SAML: A fractal of bad design
12 min
AI Agents Are Rewriting the Rules of Lateral Movement
in the wild 7 min
Microsoft Entra ID to Block SMS First-Factor Sign-Ins Worldwide in February 2027
3 sources 4 min
CVE-2026-82355: Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation
MCP was always a bad idea?
datasette-auth-github 1.0
sudo and OpenDoas timestamp files (2020)
2 min
Learning Cardiac Features: ECG Biometrics Across Time and~Exercise
I don't like passkeys
4 min1
Schneider Electric PowerChute Serial Shutdown
3 sources 7 min
A Scalable Trust Discovery Architecture for the Internet of Agents
Boost Engagement with Free Passkeys by Wordfence
1
Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers
UK Government Begins Moving 23 Million Users Away From Passwords
3 min
First Galileo SAS Authenticated Time Solution
UK.gov begins killing off passwords for 23 million users
2 min
ConnectWise patches critical ScreenConnect authentication failure after five days
A rant about phishing: It's not the user's fault (and not DNS either)
3 min