Topic
Who can log in to what, and how attackers get past passwords and MFA to do it anyway.
SonicWall SSLVPN flaw CVE-2026-19868 lets a user with credentials for another login method bypass SAML and its MFA. CISA added it to the exploited list on 6 November.
Chainalysis says an external actor used offensive agentic techniques to get into its systems in October and accessed user IDs, names, emails and role labels. It says the breach isn't linked to Binance.
A People's Party MP, citing NCSA figures, says 1,246 of 14,828 Thai government systems support multi-factor authentication, two months after leaked passwords forced a clean-up.
Apple confirms curl, git and python3 on macOS still accept the compromised eMudhra certificates. What Apple, Microsoft, Cisco and Google tell admins to do.
Browsers have distrusted the eight CAs. Servers, Go, Node.js and Linux need updated certificate stores, and macOS command-line tools still trust them.
CyberArk research finds 95% of Asia Pacific and Japan organisations suffered two or more identity breaches, with machine identities the least protected.
Jumio surveyed 8,055 consumers in the UK, US, Singapore and Mexico: 52% believe they could detect a deepfake video, and 68% are open to a digital identity.
Synthetic identity fraud blends real and invented personal details into a new person. Why banks in Southeast Asia struggle to spot it and what detection relies on.
Jumio's Frederic Ho argues that biometrics alone won't stop bank fraud in Malaysia without liveness checks and risk scoring on each login.
Security leaders from Bugcrowd, ForgeRock, CrowdStrike, HID, SailPoint, Palo Alto Networks and HashiCorp explain why IAM matters and how to deploy it.
Attivo Networks' new ADSecure-DC detects identity-based attacks on Active Directory domain controllers from Windows, Mac, Linux, IoT/OT and unmanaged devices.
GBG has partnered with BioCatch to bring behavioural biometric fraud detection to financial institutions in Asia Pacific through the GBG Intelligence Centre.
.webp)
