Entra ID Drops SMS Login - Feb 2027 Deadline
Microsoft retires Entra ID SMS first-factor by Feb 2027. Plus CVE-2026-58138 Orkes Conductor pre-auth RCE exploited in the wild and Gemini AI breached thre.
Posts tagged: Nhi
Fake EDR Scam Burns Revolut - OAuth Token Theft
Revolut disclosed customer data to fraudsters via fake Emergency Data Requests. CVE-2026-85706 GitLab CVSS 10 hits KEV. OAuth tokens stolen from 31K users.
39 Passkey Bypass Methods - FIDO2 Trust-Boundary Gaps
Token researchers map 39 passkey bypass methods exploiting enrollment and recovery flows. CrowdStrike Falcon zero-day PoC public.
Dropbox Breached via Lenovo SSO - OAuth Trust Chains Fail
Dropbox accounts breached through Lenovo SSO trust-chain flaw. Plus CVE-2026-83548 SonicWall CVSS 10 pre-auth RCE and 153M stolen driver's licenses.
Snowflake Kills Service-Account Passwords - CVE-2026-18963
Snowflake forces NHI migration exposing ownership gaps. Keycloak CVE-2026-18963 CVSS 9.1 RCE. NVIDIA NemoClaw AI agent model poisoning via webpage.