Digital identity can increase privacy rather than erode it, if it uses the right cryptography: you prove one attribute, for example that you are over 18, without revealing your identity. What selective disclosure is, how the EUDI wallet works (mandatory across the EU and Romania by the end of 2026) and where it is not magic: SD-JWT is not unlinkability.
Read the article
An attacker is selling 3.64 million employee records "stolen from Azure" belonging to McDonald's, Vodafone, TCS and others. But it is not a breach of the Microsoft platform: it is credential theft (password spray + MFA fatigue + infostealers) against customers' tenants. That is why Microsoft stays silent, and why push-only MFA is the weak link.
Read the article
A Russian group exploits an XSS zero-day in Outlook Web Access (CVE-2026-42897) via a "half-click" and installs the OWAReaper backdoor, which grants itself server-side mailbox permissions that a password reset does not revoke. What to check.
Read the article
CertiGhost — a critical AD CS flaw (CVE-2026-54121) that lets a low-privileged user impersonate a domain controller and take over the whole domain. A public PoC exists. What to do now.
Read the article
The facts on CVE-2026-48294 — how a flaw in the Adobe Acrobat Chrome extension let any website read private WhatsApp Web conversations with no user click.
Read the article
Using a password protection system such as 1Password is essential for companies for several important reasons.
Read the article
Companies should use two-factor authentication (2FA) and, in particular, 2FA from DUO Security for several reasons
Read the article