Tagged “identity”
7 posts
Storm-0558: When a Stolen Signing Key Forges Any Token
A single stolen token-signing key let attackers mint valid cloud identities and read email in about 25 organizations. Root cause, blast radius, and what to do about your own keys.
CircleCI Breach: Stolen Session Cookies and Your CI Secrets
One infected engineer laptop, one stolen SSO session, and every customer secret in CircleCI was in play. What failed, the blast radius, and how to make CI secrets cheap to rotate.
The chalk/debug npm Compromise: Anatomy of a Package Hijack
One phished maintainer turned 18 ubiquitous npm packages into a crypto-stealing payload in about two hours. Here is how it worked and the build-pipeline controls that blunt it.
Snowflake Customer Breaches: Why Passwords Without MFA Still Lose
The 2024 Snowflake customer data thefts needed no exploit, just stolen credentials and no MFA. Root cause, blast radius, and a phishing-resistant MFA rollout plan.
Browser Extension Supply Chain Attacks: Trusted Update, Hostile Code
The Cyberhaven extension compromise showed how one phished developer account turns a trusted browser extension into a session-token thief — and how to defend against it.
SharePoint's JWT bug let anyone forge an admin, no password needed
CVE-2026-55040 chained four separate JWT validation failures into unauthenticated admin impersonation on any on-prem SharePoint farm — here's the root cause and what to check now.
The Okta breach that hit BeyondTrust, 1Password, and Cloudflare
A stolen support-system session cookie let attackers pull HAR files full of live session tokens from Okta, turning a single compromise into breaches at at least four downstream customers.