Microsoft is warning that attackers are using fake passkey and SSO updates to compromise Microsoft 365 identities, then quietly map tenants and collect files and email for hours or days. The campaign, active since May 2026, combines help-desk impersonation, device-code or adversary-in-the-middle phishing, unauthorized MFA enrollment, and automated Microsoft Graph activity.

Source

Entra ID administrators have two deadlines to prepare for: passkeys will become the default sign-in method beginning September 1, 2026, and Microsoft-provided SMS and voice authentication will retire on February 1, 2027. Organizations should identify affected users now and move them to phishing-resistant authentication before phone-based sign-ins stop working.

Source

Hardcoded MCP credentials are exposing AI coding agents’ connections to GitHub, databases, Slack, Notion, and other services. Hush Security’s analysis of about 82,000 public GitHub configuration files found that 12% of credential slots contained literal secrets, while more than half were difficult for conventional scanners to recognize.

Source

Cisco is urging immediate patching for a CVSS 10.0 authentication-bypass zero-day in Identity Services Engine (ISE) and ISE-PIC after confirming that attackers are exploiting it in the wild. CVE-2026-76460 can let unauthenticated remote attackers reach the web management interface through a vulnerable API, with no workaround available.

Source

Microsoft is outlining a practical route for replacing traditional VPN access with Microsoft Entra Private Access, using identity, device health, and application-level policies instead of broad network tunnels. The phased approach starts with discovering VPN-dependent resources and ends with incremental decommissioning, helping administrators modernize remote access without disrupting critical applications.

Source

Get a free, read-only audit tool to scan your Active Directory for password vulnerabilities and receive an easy-to-understand interactive report - your first step to stronger password security!

Source

Microsoft’s emergency out-of-band updates KB5129195 and KB5129242 have failed to resolve secure domain login problems triggered by Windows 11 KB5124008. The unresolved authentication issue follows KB5124008’s earlier authentication and connectivity problems, leaving administrators without a confirmed Microsoft fix.

Source

Microsoft is retiring NTLM (NT LAN Manager), a legacy challenge-response authentication protocol, in favor of Kerberos, a ticket-based protocol that verifies both the client and the server. NTLM will be disabled by default in the next major Windows Server and client release, but you can start preparing now with enhanced auditing and Kerberos fixes. This article summarizes Microsoft's new FAQ about the upcoming retirement of NTLM.

Source