4 min read
Three things that broke when one token could impersonate any admin
Microsoft patched a maximum-severity flaw that let an attacker forge a token in their own tenant and use it to impersonate Global…
Mo Wasay
4 min read
Three ways a leaked SAS token bites you — user-bound delegation closes one
Azure Storage's new user-bound SAS tokens tie access to a live Entra principal, not just the token string. Revoke the identity and…
7 min read
I Pointed a Managed Fleet at Apple Passwords—Here’s What Actually Moved
The Passwords app isn't a new vault—it's a window onto the keychain database Apple has shipped for a decade. Here's what that…
4 min read
Three boring reasons your Claude tokens vanished overnight
Everyone's reading the TechCrunch story as "hackers found a way into Claude." They didn't — they found credentials sitting where they shouldn't,…
4 min read
The Number Is Not the Emergency: How to Triage a 974-CVE Patch Tuesday
Microsoft's September Patch Tuesday shipped 974 CVEs—more than double the previous record—but only two are under active exploitation. Here's how to triage…
7 min read
You Clicked “Revoke Sessions.” How Long Until the Token Actually Dies?
CAE is supposed to kill compromised tokens in minutes, not hours. But security researchers found inconsistent implementation across Microsoft's first-party apps—which means…
7 min read
The 90-Day Secret Rotation Ticket Is Now Optional Across Tenants
Managed identities can now authenticate to app registrations across tenant boundaries using federated credentials. The GA release means you can finally delete…
6 min read
A TPM Quote Stands Between Your Model Weights and a Stranger’s GPU
Your AI models are moving to factory floors, retail edge devices, and sovereign clouds you can't touch. Before you release model weights…
4 min read
TrinamiX sues Apple over the depth sensor in every Face ID since 2017
A BASF subsidiary alleges Face ID infringes its depth-sensing patents and wants damages plus an injunction. Your LocalAuthentication code doesn't change today,…
3 min read
Anthropic Committed $517 Billion to Compute Before Revenue Could Justify a Tenth
In early 2026, Dario Amodei warned the industry about investing too fast. Eleven months later, Anthropic has reportedly signed $517 billion in…