Microsoft's Digital Crimes Unit, working with Health-ISAC, law enforcement, and SpyCloud, dismantled the infrastructure behind EvilTokens, a phishing-as-a-service platform that had compromised over 12,000 Microsoft accounts across more than 10,000 organizations. The UK's Metropolitan Police arrested two men, aged 32 and 38, suspected of administering the site, following raids in Canary Wharf and Nine Elms; both were released on bail.
bleepingcomputer.com
· 2026-09-22
Microsoft has told IT administrators to move Entra ID users off SMS and voice-based first-factor sign-in before it shuts the option down in February 2027. Alternatives include passkeys, QR code authentication, and FIDO2 security keys, and the change applies even to organizations using their own telephony providers for multifactor authentication. The retirement covers only workforce tenant scenarios, not customer identity products like Entra External ID.
bleepingcomputer.com
· 2026-09-21
Google is rolling out a new 'Copy code' shortcut in Gmail that appears beneath the subject line of verification emails, letting users copy a 2FA code straight to their clipboard without opening the message. The feature is live on Gmail for Android version 2026.09.07.x and iOS version 6.0.260907, though it hasn't reached the web version yet.
androidauthority.com
· 2026-09-21
Cisco disclosed and fixed several critical vulnerabilities in its Identity Services Engine and ISE-PIC products, including CVE-2026-76460, a maximum-severity authentication bypass that attackers are already exploiting in the wild. The flaw lets an attacker send a crafted request to an unguarded API endpoint and slip past ISE's web management interface entirely. CISA added the bug to its Known Exploited Vulnerabilities catalog the same day the patch shipped.
darkreading.com
· 2026-09-18
A tech commentator argues that while Big Tech companies like Google and Microsoft are aggressively pushing users toward passkeys, the technology trades one security risk for another. Passkeys eliminate phishing by binding logins to a specific site, but because they can't be backed up or transferred between hardware keys, users face a higher chance of losing access entirely if devices are lost or accounts are banned.
hawksley.dev
· 2026-09-18
Scry is a new search-over-the-web service built for AI agents, exposed through the Model Context Protocol as well as a direct HTTP API. Developers connect tools like Claude Code, Codex, or Cursor to a single MCP endpoint, authenticate via OAuth or an API key, and query a rolling crawl of high-information web pages using a SQL-like interface. The service also introduces congestion-based pricing tied to usage load.
scry.io
· 2026-09-17
A Hacker News user described being locked out of Google, banking, email and Drive accounts after their phone was stolen, since 2FA and account recovery relied on that device and an old email they could no longer access. The poster noted Google's automated recovery flow offers only options tied to the lost phone or an outdated backup email, leaving no clear path to a human for help.
news.ycombinator.com
· 2026-09-17
Cisco has issued patches for a maximum-severity flaw in its Identity Services Engine and ISE-PIC products that allows attackers to bypass authentication on an API endpoint and gain unauthorized administrative access, regardless of configuration. Cisco's security team confirmed the vulnerability, tracked as CVE-2026-76460, is being actively exploited and there are no workarounds available, making immediate patching the only defense.
bleepingcomputer.com
· 2026-09-17
Apple has introduced an opt-in feature called Apple Reference Image on the iPhone 18 Pro and Pro Max that signs pixel data straight off the camera sensor before any software processing occurs, creating what Apple calls a 'secure digital negative.' To turn this file into a usable photo, the device sends it to Apple's Private Cloud Compute, which verifies sensor and Secure Enclave signatures and device identity before producing a JPEG with a composite RSA-3072 and post-quantum ML-DSA-87 signature.
techspot.com
· 2026-09-16
The IEEE Computer Society is partnering with theIPregistry.org to overhaul how institutional subscribers verify access to its digital library. Starting 15 September 2026, the integration will automate the management and verification of IP address updates instead of relying on manual processes.
wpcms.computer.org
· 2026-09-12
Wiz researchers found multiple threat actors exploiting two Artifactory vulnerabilities, CVE-2026-42018 and CVE-2026-42016, to escalate from a low-privileged anonymous session to full administrator access in under five minutes in some cases. Once inside, attackers installed malicious Groovy plugins to run commands and deployed a custom Rust-based backdoor with command-and-control capabilities, alongside webshells and stolen configuration data. A separate critical flaw, CVE-2026-82329, has also been used by other attackers to mint admin tokens on unpatched instances.
bleepingcomputer.com
· 2026-09-11
Cisco has verified that attackers are actively exploiting CVE-2026-20079, a maximum-severity (CVSS 10.0) flaw in its Secure Firewall Management Center software that lets unauthenticated remote attackers bypass login and run commands as root. The company first disclosed the bug in March without evidence of exploitation, but updated its advisory this week to acknowledge PSIRT detected active attacks in August, though it hasn't shared attacker identity or attack timeline details. CISA has since added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies until September 12 to patch.
bleepingcomputer.com
· 2026-09-09
GoKawiil