NEWS · INTELLIGENCE
Entra ID passkeys: planning phishing-resistant authentication
Microsoft outlined a shift toward passkeys as a default Entra ID authentication method and a roadmap away from built-in phone-based authentication.
Read article ↗VALUE360 / INSIGHTS
Ideas, updates and technical insight.
Articles, practical guides and perspectives on IT, cloud and cybersecurity.
NEWS · INTELLIGENCE
FortiSandbox: multiple critical flaws reported exploited
Security researchers reported exploitation activity targeting critical FortiSandbox vulnerabilities, prompting urgent patch review.
Read article ↗
NEWS · INTELLIGENCE
IronWorm supply-chain attack spreads through compromised npm packages
The IronWorm campaign affected dozens of npm packages and targeted developer credentials, tokens and environment secrets.
Read article ↗NEWS · INTELLIGENCE
FortiAuthenticator and FortiSandbox critical security fixes
Fortinet issued fixes for serious vulnerabilities affecting authentication and threat-analysis products that could enable unauthorized command execution.
Read article ↗
NEWS · INTELLIGENCE
FortiClient EMS emergency patch for exploited flaw
Fortinet released an emergency fix for CVE-2026-35616 in FortiClient Enterprise Management Server following reports of exploitation.
Read article ↗
NEWS · INTELLIGENCE
Outlook add-in hijack illustrates third-party identity risk
An abandoned Outlook add-in became a phishing vector after attackers gained control over its external web endpoint.
Read article ↗NEWS · INTELLIGENCE
ClickFix campaigns abuse trusted Windows components
A ClickFix variant combines fake CAPTCHA prompts with Windows App-V scripting to induce command execution and deliver infostealer malware.
Read article ↗
NEWS · INTELLIGENCE
FortiSIEM exploitation highlights monitoring platform exposure
Exploitation of CVE-2025-64155 in FortiSIEM highlights the risks when the monitoring platform itself remains vulnerable.
Read article ↗NEWS · INTELLIGENCE
Microsoft 365 device-code phishing: a different path to account access
Phishing campaigns trick users into entering device codes on a legitimate Microsoft page, authorizing an attacker-controlled sign-in flow.
Read article ↗