GitLab’s Claude Agent Read User-Controlled Configuration. Developer Access Reached Arbitrary CI Commands.
GitLab patched a Duo Claude flaw that let a Developer turn user-controlled configuration into arbitrary commands inside a CI job.
Identity security
McKesson Confirmed the Data Left. ShinyHunters Claims 284 Million Patient-Data Rows.
McKesson confirmed unauthorised access to third-party applications and data exfiltration. ShinyHunters claims 284 million patient-related data rows, but the scale and data types remain unverified.
The Password and MFA Push Were Accepted. Device Trust Still Stopped the Attack.
ReliaQuest says a stolen password and approved MFA push produced a valid session, but device trust blocked every attempt to reach company applications.
NetScaler’s Authentication Bypass Is Now Drawing Live Attack Traffic
A public proof of concept for CVE-2026-19490 is now drawing exploit-matching traffic. The evidence shows active targeting, not confirmed compromise.
They Did Not Steal Passwords. They Stole the Map of Who to Attack Next.
Alleged Entra directory theft exposed organisational maps rather than passwords. Treat bulk directory reads as a high-impact identity event.
The Fake Lock Screen Stole the Password. The Proxy Made the Login Look Internal.
SynkLoader used a fake Teams help desk, an Azure-hosted installer, a counterfeit Windows lock screen and an internal proxy to turn one user action into hands-on-keyboard corporate access.
France Thought It Had a Staff-Data Breach. The Same Incident May Have Reached Millions of Students.
France’s Education Ministry is testing whether a breach first described as staff-only reached student records across a fragmented national data estate.
US Charges Say Iran’s Academic Espionage Contractors Also Sold the Data They Stole.
US prosecutors allege Mabna Institute hackers served Iranian state clients while selling stolen research and university access through commercial sites.
The Password-Reset Link Was Never Opened. The Account Was Still Taken Over.
A password-reset email is meant to be the point where an identity system proves that the person changing a credential controls the account. A critical Keycloak flaw allowed an unauthenticated attacker to bypass that step and set a new password…
Microsoft Is Making Phishing-Resistant MFA the Default. Your Exceptions Become the Risk.
Microsoft will retire its Entra SMS and voice authentication service in February 2027, making passkey migration and exception governance urgent.