#authentication

OpenSSH 10.6p2, released November 5, works around a password authentication bypass in sshd on Linux systems built with musl libc and PAM disabled. An oversized password can log in to accounts meant to be key-only, including root on Alpine.

Apache OFBiz 24.09.08, announced November 4, fixes a batch of authentication flaws: a hard-coded JWT key giving unauthenticated admin access, a password reset flaw allowing account takeover, a reusable login key not bound to a session and REST operations open by default.

ASOS and Dexcom both traced October breaches to people being talked into access, and India will show a network-asserted caller name on calls from November 1. None of it changes the core problem: an MFA reset issues a new credential, so the help desk decides who gets one. How to verify callers with proof instead of knowledge, and why the passkey migration will test it.

IBM's October 28 bulletin covers four Langflow flaws in every release from 1.0.0 to 1.12.8, including CVE-2026-93680, a 9.8-rated authentication bypass a public Metasploit module already cites, and unauthenticated code execution through MCP tool enumeration. Upgrade to 1.13.0.

Canonical's CVE-2026-112816 let an attacker authenticate to the LXD and MicroCloud HTTPS API as any trusted client by attaching that client's public certificate to their own TLS chain. Fixed in LXD 4.0.15, 5.0.11, 5.21.9 and 6.10.1.

Most people who move into identity and access management land in workforce identity first: employees, contractors and the systems they sign in to. The fastest way to become useful there is to learn the lifecycle end to end, from HR record to the last application, and then the protocols that carry it. A plan for help desk, sysadmin and developer crossovers.

October is Cybersecurity Awareness Month. Instead of another poster, here are seven identity habits for every team, each traced to something that actually happened this month: a phone call to a medical device maker, a fake AI ad portal, a national register allegedly opened with 123456, and a VPN password reused once too often.

Okta published CVE-2026-115547 on October 22: an input validation flaw in the Okta Access Gateway Admin Console lets an authenticated administrator execute system commands as the OAG service account. CVSS 9.1; fixed in 2026.10.2.

FIDO's Passkey Index 2026 says 36% of successful sign-ins at 15 consumer services now use a passkey, and that passkey sign-ins succeed 93% of the time against 78% for passwords and traditional MFA. The finding that should change your rollout plan is smaller: enrolled users still get routed to the password.

The FIDO Alliance's Passkey Index 2026, built on data from 15 consumer services, finds 36% of successful sign-ins use a passkey, up from 26%, with a 93% success rate against 78% for passwords and traditional MFA. FIDO now estimates 7 billion passkeys are in use worldwide.

CVE-2026-97629 lets a forged TLS session resume on NGINX 1.23.2 through 1.31.6 when a shared session cache is set without a ticket key file, which can bypass client-certificate verification. Fixed in 1.30.6 and 1.31.7; no exploitation reported.

Microsoft stops delivering SMS and voice codes in Entra ID on February 1, 2027. The UK has opened passkeys to more than 23 million GOV.UK One Login users, and the new federal front door runs on Login.gov. Here is how to plan the move off SMS without creating a new weak point in recovery.

Amazon reports more than 175 million customers have enabled passkeys, signing in six times faster, with passkeys now the default on mobile for anyone who has set one up. The FIDO Alliance counts five billion passkeys in use industry-wide.

Three research teams broke passkey guarantees in August 2026 without touching WebAuthn. The weak points were event logs, sync key custody, and in-session key reuse. Here is what actually changed for your rollout.

Biometrics are now in nearly every national ID and a growing share of logins, and the law has caught up. BIPA, the EU AI Act, and a wave of US state rules treat biometric identifiers as a special category. Here is what changed and what to do.