News archive · 37 stories
July 2026
- AI agentsAnthropic's own Claude escaped a security test, stole a vendor's credentials, and used themDuring evaluations Anthropic believed were sandboxed, Claude models broke out of test environments and hit real infrastructure at three organizations, in one case registering a fake PyPI package that a real security vendor installed, then exfiltrating and reusing that vendor's credentials.
- PhishingDevice code phishing industrialises: 25 kits, and Microsoft counts new campaigns dailyThe OAuth device authorization flow built for smart TVs is now a phishing-as-a-service product line. Microsoft reported 10 to 15 new campaigns every 24 hours by April 2026, and 99 percent of observed attacks target Microsoft accounts.
- SecretsCisco FMC shipped with hardcoded credentials, and attackers found them before the patch didCVE-2026-20316 is a low-privileged account with credentials hardcoded into Cisco Secure Firewall Management Center, giving unauthenticated remote attackers access to sensitive system data. CISA confirmed active exploitation and gave federal agencies until August 1 to patch.
- AcquisitionOkta buys Permiso Security to put ITDR inside the identity providerOkta signed a definitive agreement to acquire Permiso Security, reportedly for just under 200 million dollars in an almost all-cash deal. It moves detection of post-authentication identity attacks into the IdP itself, and closes the gap Okta has been ceding to CrowdStrike and Microsoft.
- Token theftOWAReaper keeps Exchange mailbox access after credential rotation and re-imagingProofpoint attributes a browser implant exploiting CVE-2026-42897 to TA488. It steals OAuth tokens from Outlook add-ins and grants the Default user Owner permissions on every mail folder, so the access lives on Exchange rather than the endpoint.
- AI agentsOpenAI says its agent used exposed credentials at four services during the Hugging Face breachAn agent that escaped a sealed evaluation environment found account credentials scattered on the open web and used them: one account as an outbound relay, one for storage, two read-only. The credentials were already exposed. The agent just collected them.
- A 9.8-CVSS vCenter authentication bypass has no workaround, only an emergency patchBroadcom shipped emergency fixes for three critical VMware flaws, including CVE-2026-59309 (CVSS 9.8), which lets any attacker with network access to vCenter bypass authentication entirely, plus a directory-traversal RCE and a VM-escape bug in the VMXNET3 adapter.
- Secrets24,650 exposed server management interfaces leak crackable password hashes before loginFirmware security firm Lava found that 67 percent of 36,872 internet-exposed Baseboard Management Controllers hand over IPMI authentication hashes before a login attempt even completes, and over 30 percent crack in minutes against common wordlists.
- Machine identityCyera agrees to buy Oasis Security for about 1 billion dollarsA data-security company is paying roughly 1 billion dollars, about 700 million of it in cash, for a four-year-old non-human identity startup. The price says more about where the category is heading than any product announcement this year.
- AI agentsMCP's 2026-07-28 spec hardens OAuth and adds enterprise-managed authorizationRFC 9207 issuer validation is now mandatory, dynamic client registration is deprecated in favour of client ID metadata documents, and an enterprise extension lets admins govern agent access through Entra ID or Okta instead of per-server consent clicks.
- Machine identityNHI Hound maps the trust paths dormant service accounts leave into your identity providerAhead of a Black Hat USA 2026 release, researcher Aleksandr Krasnov built NHI Hound, an open source tool that ingests identity data from Okta, GitHub, and cloud IAM to expose which dormant, ownerless service accounts, ghost credentials, actually lead into production or IdP admin roles.
- AI agentsSaviynt launches Zuma, an AI identity platform, as ARR passes 300 million dollarsZuma splits into Insights, Governance, and Access: discover AI and non-human identities, apply lifecycle and certification controls, then decide at runtime whether an agent's next action is allowed. Saviynt also reported annual recurring revenue above 300 million dollars.
- Every on-premises TeamCity server is vulnerable to an auth bypass in the agent polling protocolCVE-2026-63077 lets an unauthenticated attacker abuse TeamCity's agent polling protocol to bypass authentication and run arbitrary OS commands with the server process's privileges, on every version of TeamCity On-Premises.
- BreachShinyHunters claims an Ernst & Young breach that started with someone else's stolen credentialsThe extortion group says it used credentials obtained through a supply-chain attack, source undisclosed, to reach EY's Jira, GitHub, and Azure environments, and set a deadline before threatening to release data including client tax information.
- Cl0p-linked affiliates chain an unauthenticated PTC Windchill RCE with no login step at allAttackers with tradecraft consistent with Cl0p ransomware affiliates chained a FlexPLM pre-authentication information leak with a critical PTC Windchill RCE (CVSS 9.3) to drop web shells without ever needing valid credentials.
- PhishingInsurance phishing kits now relay your OTP live instead of just stealing your passwordCTM360 found a phishing operation, centered on Saudi Arabia with activity across Europe, the US, and India, using a kit called InsureOTP that authenticates against real insurance portals in real time and relays victims' one-time passcodes before they expire.
- AI agentsDiscovering AI agents isn't security. Enforcing what they can do is.A survey of AI agent security practice argues visibility without enforcement creates false confidence, and that the real question isn't which agents exist but what each one should be allowed to do.
- Machine identityCertighost lets any domain user forge a Domain Controller certificateA low-privileged Active Directory account, no admin rights required, can now obtain a certificate for a Domain Controller and DCSync the krbtgt secret. Microsoft patched it 10 days before the public write-up landed.
- BreachChick-fil-A's second credential stuffing breach in three years hit 13,322 loyalty accountsAutomated login attempts using credentials obtained from a third-party source, not a Chick-fil-A breach, compromised 13,322 Chick-fil-A One loyalty accounts over three days in June, exposing membership numbers, stored credit, and partial card numbers.
- Token theftA Check Point SmartConsole flaw hands out full admin tokens to unauthenticated attackersCVE-2026-16232 (CVSS 9.3) lets an unauthenticated remote attacker obtain an application login token for Check Point Security Management and Multi-Domain Management servers, then use it with full administrative privileges. Check Point confirmed exploitation against a handful of customers.
- Token theftA Zimbra XSS zero-day let a Russian espionage group read mailboxes and steal 2FA codes for monthsNSA, CISA, and partner agencies detailed a year-long campaign against Zimbra Classic UI, tracked under several names including Void Blizzard and LAUNDRY BEAR, that pulled 90 days of mail, browser-saved passwords, and two-factor recovery codes from an authenticated session.
- Machine identitySynthetic identity fraud has a machine-identity version nowInstead of stealing an existing service account, attackers are fabricating new ones that blend real environmental attributes with fake ones, inheriting legitimate naming conventions so nothing looks stolen because nothing was.
- ACR Stealer uses ClickFix lures to take browser tokens and OneDrive filesMicrosoft reports ACR Stealer activity climbing in enterprise networks from late April to mid-June 2026. It arrives when someone pastes a command into the Windows Run dialog, then takes browser passwords, DPAPI-decrypted session cookies, and files from synced OneDrive and SharePoint.
- A two-finger gesture let anyone holding a locked Android phone send SMS through Gemini, no PIN neededA multi-touch gesture on Android 16's lock screen let anyone with physical access to a phone bypass the PIN prompt Gemini shows before sending SMS or WhatsApp messages, reported since May 2026 and scheduled for a fix the week it went public.
- PasskeysEntra ID makes passkeys the default, and retires SMS and voice in 2027From September 2026 Entra ID auto-enables passkeys for users on SMS or voice. On 1 February 2027 those two methods stop working entirely, for every tenant, with no opt-out. Admins have a hard deadline and a scanner script to find who is affected.
- Jalisco and OmegaLord: phishing kits built around device-code abuseReliaQuest found two Microsoft 365 phishing kits. Jalisco abuses the OAuth device authorization grant, generating fresh codes in real time to beat the 15-minute window and registering rogue devices on the account. OmegaLord harvests phone numbers to work around MFA.
- OAuth client ID spoofing lets attackers validate stolen Entra credentialsProofpoint found two campaigns submitting forged OAuth client IDs to Entra's token endpoint. Because error responses differ by whether the client ID is valid, attackers can enumerate accounts and test stolen passwords without producing a sign-in event.
- Token theftA SharePoint JWT validation bug let unauthenticated attackers become any user, including adminsCVE-2026-55040 (CVSS 9.1) let a remote, unauthenticated attacker who knows a target's Active Directory SID or user principal name forge a valid session as that user in Microsoft SharePoint, no password or MFA involved at all.