. 14 stories, about 4 minutes.
Editor's take
Three of today’s incidents turn on credentials held by tools rather than people. A tampered coding extension planted SSH keys on developer machines, a kaniko flaw can send a build’s Entra ID token to an attacker, and Northflank told customers to treat every stored secret, AI API keys included, as exposed. If your non-human identity inventory stops at service accounts, it is missing where these keys actually live.
Agent and non-human identity
CSO Online: AI coding assistant config files need named owners and enforced review
An opinion piece argues that repo files such as hooks, skills and allowed-tools settings can grant AI coding agents execution rights, citing a June Miasma campaign that planted config in a Microsoft repo. It recommends CODEOWNERS with required reviews covering invoked scripts, and testing the approval path.
CSO Online
KloudStax CTO outlines identity, credential and network controls for AI coding agents
In a Help Net Security interview, KloudStax CTO Vinay Thakker advises giving agents their own identity with the requesting person's attached, and brokering short-lived credentials via proxy. He also advocates allowlisted commands and denied-by-default networking, enforced outside the agent.
Help Net Security
Equifax CISO Puts Identity Controls at Center of 2027 Security Strategy
Equifax CISO Jeremy Koppen says AI agents, bots and automated workflows get the same verification as people, and static credentials are on their way out. Equifax dropped passwords for 22,000 employees and contractors and is extending passwordless to B2B customers.
CSO Online
Breaches and incidents
kaniko before 1.25.20 can leak Microsoft Entra ID access tokens (CVE-2026-105769)
CVE-2026-105769 (CVSS 9.3) is a flawed regex in kaniko's credential helper that sends Entra ID access tokens from the build's workload identity to attacker-controlled hosts, enabling ARM access and ACR credential exchange. Builds on kaniko before 1.25.20 are exposed; no user interaction is needed.
NVD CVEs
Microsoft details Teams help desk impersonation leading to AD CS ESC1 and ESC8 abuse
Microsoft Threat Intelligence investigated two intrusions where fake IT support in Teams yielded Quick Assist access, then certificate abuse via an ESC1-vulnerable template and a PetitPotam relay to AD CS Web Enrollment. Issued certificates outlive password resets, and one privileged identity excluded from automated containment stayed usable and enabled data exfiltration.
Microsoft Security Blog
Perl Google::Auth 0.11-0.12 accepts OAuth authorization codes from any source (CVE-2026-74760)
CVE-2026-74760 affects Google::Auth versions 0.11 through 0.12 for Perl, which skip an OAuth state check and let a local attacker plant their own authorization code. Victims' tools then run under the attacker's Google account, so check CLI-based cloud logins that use this library.
NVD CVEs
CVE-2026-118394: OAuth2 userinfo endpoint leaks private group memberships
CVE-2026-118394 describes an OAuth2 userinfo endpoint at /login/oauth/userinfo where the transport method of the credential bypassed the token-scope check, exposing private organization and team memberships in the groups claim. The article does not name the affected product; verify that claim filtering derives from the authenticating credential's scope.
NVD CVEs
Chainalysis discloses breach of internal tools exposing customer user IDs, names and emails
Vendor moves
JumpCloud adds native Access Certification for user access reviews to its platform
JumpCloud introduced Access Certification, an IGA feature for SSO application and user group reviews, with manager or owner reviewers, Revoke-triggered remediation, and PDF audit reports. Directory Insights governance events are kept 90 days, so audit evidence must be exported before then.
JumpCloud Blog
Okta named a Leader in Gartner Magic Quadrant for CIAM
Okta announced via the Auth0 blog that Gartner named it a Leader in the Magic Quadrant for Customer Identity and Access Management. The post mostly restates existing Auth0 capabilities, including agentic identity features, so it adds no new product facts.
Auth0 Blog
Worth your time
OWASP Top 10 2025 renames A07 Authentication Failures, expands to 36 CWEs
OWASP's 2025 list keeps authentication failures at #7, renames the category, grows it from 22 to 36 CWEs, and adds weaknesses covering hybrid password spray, breached-credential signups, weak MFA fallbacks, and unchecked credential audience. Teams can audit passwords, MFA, recovery, sessions, and token validation against these items.
WorkOS Blog
Get the week by email
One email on Fridays with the week's top stories. No sponsors.