Do Son CVE-2026-16347 lets attackers brute-force MikroTik RouterOS logins for unauthorized system access. Rated CVSS 8.8, with no fix yet. Apply mitigations.
authentication
Discover how the upcoming Microsoft Edge Google account login feature will simplify authentication without directly syncing your data back to Chrome.
Microsoft is integrating Entra ID (formerly Azure AD) into WebView2, enabling seamless, modern authentication like passkey and Conditional Access for embedded web apps.
Telegram is developing passkey authentication to replace unreliable SMS codes. The move promises a far more secure login, leveraging biometrics (Face ID/fingerprint).
Windows 11 now supports a new API allowing password managers (like 1Password, Bitwarden) to handle passkey authentication directly, simplifying cross-platform sign-in.
Edge v142.0 introduces cross-platform passkey sync, letting users reuse passkeys securely across devices with a PIN, enhancing passwordless authentication.
A critical Windows 11 update bug is causing Kerberos and NTLM authentication to fail due to a new, strict SID verification mechanism.
Microsoft will begin enforcing mandatory MFA for all Azure resource management operations starting October 1, 2025, to enhance cloud security.
New research from Proofpoint shows that attackers can bypass FIDO passkeys using a downgrade attack, forcing a fallback to less secure authentication methods.
GitHub now allows users to sign in and create new accounts using their Google credentials, offering a streamlined login experience for developers.
Windows 11 25H2 Dev Build introduces deeper password manager integration, starting with 1Password, allowing Windows Security to use and save passkeys in 1Password vaults.
Microsoft 365 Boosts Security: Legacy File Access Protocols RPS & FrontPage RPC Phased Out July 2025
Microsoft 365 Boosts Security: Legacy File Access Protocols RPS & FrontPage RPC Phased Out July 2025
Microsoft will disable outdated RPS and FrontPage RPC protocols for file access in Microsoft 365, Office, SharePoint, and OneDrive starting July 2025 to enhance security.
A critical Windows SMB client flaw (CVE-2025-33073, CVSS 8.8) allows remote SYSTEM privilege escalation via Kerberos authentication. PoC available.
Samba vulnerability (CVE-2025-0620) exposes stale group data in Kerberos SMB sessions. Learn how this impacts security and mitigation.
GitLab released urgent updates (18.0.1+) fixing high-severity flaws, including a DoS vulnerability (CVE-2025-0993) and a 2FA bypass (CVE-2024-12093).
Critical vulnerability (CVSS 9.9) in samlify! This flaw puts many SSO implementations at risk, affecting a library with 768,000+ monthly downloads.
RAGFlow is vulnerable to account takeover. This article details the brute-force exploit and the urgent security risk (CVE-2025-48187, No Patch)
Cisco Talos reports on AiTM attacks that bypass MFA by using reverse proxies to steal credentials and session cookies, leading to account takeover.
Microsoft will soon default new accounts to passwordless login with passkeys & MFA. Existing users can still choose passwords. Learn more!
A security flaw in Apache's mod_auth_openidc module can expose protected web content to unauthenticated users. Patch or mitigate to secure your server
Siemens security advisories detail a critical authentication vulnerability (CVE-2024-54092) in Industrial Edge Devices, allowing for potential impersonation