Identity & access
-
Fake WatchGuard VPN site steals credentials before offering genuine installer
Huntress has analysed a fake WatchGuard VPN download page that collects server and account details, then offers a genuine signed installer instead of malware.
-
UK security purchasing shifts towards identity and compliance products
Third-quarter distribution data from Context indicates stronger demand for compliance, training, and identity security products, while industry analysts describe changing customer purchasing priorities.
-
Docker reveals token ownership flaw in Hub account conversions
Docker says a flaw in account-to-organisation conversions reassigned some personal access tokens without rotating their secrets. The issue was fixed in September and disclosed publicly on 12 October.
-
Tenable Identity Exposure fix requires listener reinstall after critical flaw
A command injection vulnerability in Tenable’s identity monitoring software can expose sensitive Active Directory infrastructure unless fully remediated.
-
Meta Muse AI agent appears as ordinary browser traffic, Cequence research finds
Cequence observed traffic matching Meta’s Muse at more than half its sampled customers, including authenticated account activity that conventional browser checks could not distinguish from human use.
-
Microsoft Teams prepares integrations to detect deepfakes and meeting impersonation
Microsoft is developing support for external deepfake-detection providers in Teams, reflecting growing concern about identity verification during enterprise video meetings.
-
GitHub adds contextual AI detection for leaked passwords and developer secrets
GitHub has introduced a specialised model intended to identify credentials that conventional secret-scanning patterns can miss, with different features at different rollout stages.
-
HPE Aruba fixes ClearPass and AOS-Switch security flaws
HPE Aruba has released fixes for vulnerabilities across ClearPass Policy Manager and AOS-Switch that can enable remote code execution, privilege escalation and policy bypass.
-
Elastic security update fixes flaws across search, Kibana and endpoint stack
Elastic has released a broad security update covering Elasticsearch, Kibana and Elastic Agent, with flaws affecting authorisation, availability and sensitive cryptographic material.
-
Revolut to cover document replacement costs after customer data breach
Revolut will reimburse customers who need to replace identity documents after personal information was disclosed through fraudulent requests impersonating an Italian government authority.