Identity & access · News & analysis
AWS puts individual sign-in at the entrance to new cloud projects
A small team can invite a colleague to a project that has its own account and budget. The permissions its application uses follow a separate path.
NEWS · ALERTS · RESEARCH
Identity & access
Original cybersecurity reporting and practical analysis, alongside headlines from trusted publications, agencies and researchers.
Original reporting & analysis
Identity & access · News & analysis
Tailscale gives an agent its own device record under the user who authorized it
The Grok Bot integration shows how a private network can distinguish a person’s laptop from software acting with that person’s consent.
Identity & access · News & analysis
Yubico Authenticator 7.5 changes which PIV management keys its app can use
The November release removes PIN-derived management-key support while retaining the separate PIN-protected option, a distinction that matters for certificate maintenance.
Identity & access · News & analysis
Okta release retires legacy cross-app connections as production rollout approaches
October 28 preview notes warn that early-access connection configurations stop working in version 2026.44.0.
Identity & access · News & analysis
Mendix SAML fix closes replay route in identity-provider-initiated sign-ins
Siemens identifies affected module branches and a mitigation for applications using the exposed authentication flow.
Identity & access · News & analysis
Microsoft 365 Token-Replay Cases Show Why Password Resets Leave Cleanup Unfinished
Huntress’s investigation connects stolen sessions with rogue devices, altered MFA methods and hidden mailbox rules.
Identity & access · News & analysis
Netwrix Fixes Dashboard-Link Exposure in Identity Manager
The vendor describes a limited authorization flaw affecting certain configurations and says its SaaS environment was patched before disclosure.
Identity & access · News & analysis
Auth0.js Fix Restores a Check on How Recently a User Signed In
The October advisory concerns applications that request a fresh authentication event, with implications for sensitive account actions.
Identity & access · News & analysis
Okta Sets Zendesk Provisioning Migration Dates as OAuth Replaces Basic Authentication
The change affects account provisioning rather than single sign-on, making lifecycle testing the important acceptance check.
Identity & access · News & analysis
Okta Event-Hook Postmortem Highlights a Blind Spot in Identity Automation
An October postmortem reports delayed and dropped events, showing why access workflows need verification beyond successful sign-ins.
Identity & access · News & analysis
The Passkey Gap Starts With the Credentials Employers Issue
An Okta and Yubico survey points to onboarding defaults and fragmented sign-in as obstacles to stronger authentication.
Identity & access · News & analysis
Auth0’s PrivateLink Gateway Pattern Puts Environment Boundaries in Focus
Auth0’s new architecture guidance routes a private connection to multiple environments, placing gateway rules at the center of the security review.
Identity & access · News & analysis
Entra’s October Sign-In Change Calls for a Browser-Extension Check
Microsoft plans tighter script controls on browser sign-in pages; businesses should test tools that modify the authentication experience.
Identity & access · News & analysis
Blueprint Alliance Puts AI Agent Ownership at the Center of Identity Security
A cross-vendor initiative proposes a shared architecture for agents, while implementation and interoperability remain the tests ahead.
Identity & access · News & analysis
A Real Sign-In Page Can Still Be Part of a Phishing Attack
Microsoft’s EvilTokens research puts device-code authorization and post-compromise mailbox access in the spotlight.
Headlines from our sources
294 sourced updates · Publication dates or labeled coverage weeks shown · Read full coverage at the source
Microsoft Security Research
SCKit abuses ScreenConnect to deploy remote access and target technician sessions ↗
ResearchAWS Security Blog
Amazon Threat Intelligence observes threat actors running cybercrime campaigns with ARTEX AI agents ↗
ResearchYubico
YubiNation 2026 takeaways: Customers and partners shaping the future of digital trust ↗
ResearchSOCRadar
4EverAble2Shell: N-central Zero-Day Exploited ↗
ResearchIndustrial Cyber
SANS 2026 survey finds sharp rise in ICS/OT cyber incidents, slower detection, more severe operational impacts ↗
Industry newsSecurityWeek
Hackers Exploit New N-central Zero-Day Hours After PoC Publication ↗
Industry newsHelp Net Security
Suspected North Korean IT workers reached onboarding at companies with open data ↗
Industry news
The Hacker News
Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2 ↗
Industry newsOkta Security
Linux Kernel TCP Flaw (CVE-2026-98432) ↗
ResearchOkta Security
Apache HTTP Server's HTTP/2 Vulnerability (CVE-2026-119618) ↗
ResearchAuth0 Identity Blog
Absicherung des agentenbasierten Handels ↗
ResearchThe Hacker News
Webinar: See How Identity Blind Spots Put Your SOC at Risk and How to Close Them ↗
Industry newsHelp Net Security
Self-hosted Claude Managed Agents keeps agent credentials in your environment ↗
Industry newsInfosecurity Magazine
Weak Passwords Expose SQL Servers to Cryptominer and Gh0st RAT ↗
Industry newsThe Hacker News
Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass ↗
Industry newsWIRED Security
Apple’s HomeView Tries Face Authentication Without FaceID ↗
Industry newsSecurityWeek
Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign ↗
Industry newsThe Record
Kazakhstan-linked hackers used AI agent to spy on Central Asian governments ↗
Industry newsSANS Internet Storm Center
Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895), (Thu, Nov 12th) ↗
ResearchThe Hacker News
New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access ↗
Industry newsHelp Net Security
Microsoft Entra adds a seven-day safeguard against irreversible identity deletion ↗
Industry newsSecurityWeek
Hackers Target N-central Zero-Days as N-able Rushes Patches ↗
Industry newsHelp Net Security
Who collects the keys when an AI agent retires? ↗
Industry newsCrowdStrike Research
CrowdStrike Named a Leader in the 2026 IDC MarketScape for Worldwide Augmented Identity Security Solutions ↗
ResearchCisco Duo
Unlocking identity visibility for Microsoft environments ↗
ResearchOkta Security
OpenSSH "SSHole" Vulnerability (CVE-2026-123158) ↗
ResearchOkta Identity Engine Preview Releases
Okta Identity Engine - Version 2026.46.0. Deployed on November 12, 2026. ↗
ResearchDark Reading
N-able Takes N-central Platform Offline After Discovery of 33 Flaws ↗
Industry newsAWS Security Blog
Ease of use and secure defaults in the new AWS experience ↗
ResearchAWS Security Blog