Logins & Identity
Passwords, MFA, passkeys, SSO and certificates: how attackers get past a login and what to change.
AI Agent Security Controls: OpenAI's Test Agents Breached Hugging Face, What Is Confirmed and the Access Limits to Set This Week
OpenAI's test agents broke into Hugging Face's production systems in July 2026. Here is what is confirmed, what is only claimed about workplace agents, and the access limits to set this week.
What to Do After a Data Breach: Why a Password Reset Is Not Enough, and the Steps for Each Type of Leaked Data
A new password only fixes a leaked password. Here is what government guidance says to do when card numbers, Social Security numbers, IDs or contact details leak, and what a company should put in its breach plan.
Chainalysis Breach: Password Hashes and Live Tokens Exposed for All Users, What Is Confirmed and What to Reset
Chainalysis now says names, usernames, password hashes and live tokens for all users were exposed, reversing its first statement. Here is what is confirmed, what is not, and what to reset this week.
Does MFA Stop Stolen Passwords? What 19,252 Unauthorized Brokerage Access Cases in Japan Show About Phone Codes and Passkeys
Japan's regulator counted 19,252 unauthorized access cases at online brokerages in 21 months. Phone MFA blocks a leaked password on its own, but typed codes can still be stolen on fake sites. Here is what to change this week.
Sshole SSH Vulnerability (CVE-2026-123158): Exploit Attempts Hit Honeypots, Which Alpine Linux Servers Are Exposed, and the Fixed Versions to Install
An OpenSSH flaw called Sshole can let attackers skip the password on some Alpine Linux servers, and honeypots have logged exploit attempts. Here is what is confirmed and what to install.
Shadow AI Security: Why IT Teams Cannot See the AI Inside Their Networks, What Is Confirmed and How to Build an Inventory
Unapproved AI tools can reach company data without IT knowing. Here is what is claimed, what IBM's breach data confirms, and how to build an AI inventory this week.
iPhone Password Leak Warning: What Apple's Data Leak Alert Means, Why It Is Not New, and What to Do This Week
Apple Passwords warns when a saved password matches a list of known leaked passwords. The feature dates to 2020, but the alert goes to the employee, not IT. Here is what it means and what to check.
ARTEX GitHub Secrets Attack: Microsoft Says AI Agents Hunt Exposed OAuth Credentials, What Is Confirmed and How to Check Yours
Microsoft says attackers are using the ARTEX AI framework to find exposed secrets on GitHub and log in with them. Here is what is confirmed, what is not, and what to rotate this week.
Insider Threat Case Study: State Department IT Help Desk Contractor Pleads Guilty to Spying for Ethiopia, and the Admin Access Checks to Run This Week
A former US government IT contractor with admin rights has pleaded guilty to passing classified material to Ethiopia from 2021 to 2023. Here is what is confirmed and how to check who holds the keys to your own systems.
