Beat
Trust & Security
A forged token signed with the real key is not a break-in. It is a credential. The mechanism behind AD FS token forgery, what the DKM container protects, and what the October hardening can and cannot fix.
◆ Heath Callahan
Trust & Security
October's security update auto-remediates the ACL protecting AD FS token-signing key material. Windows Server 2012 shops are on their own, and the registry opt-out leads with a warning.
◆ Heath Callahan
Trust & Security
Amazon blocked Muse on Sept. 20, alleging the agent hides its identity and captures customer credentials. Meta denies it. 22 days on, a Terms of Use clause is doing the adjudicating – and no one outside the two companies can check either claim.
◆ Heath Callahan
Trust & Security
CISA's October 11 patch deadline arrives alongside FBI seizures of seven domains used by China-linked Integrity Technology Group and a seven-nation advisory warning of persistent critical infrastructure positioning.
◆ Heath Callahan
Trust & Security
CrowdStrike attributes late-September intrusions at nine South Korean banks to ARTEX, an open-source autonomous pentesting agent from China — the first publicly attributed use of AI-powered pentesting tools in a real financial-sector breach. The developer closed-sourced the tool after disclosure.
◆ Heath Callahan
Trust & Security
Zenity Labs disclosed AgentCorruption at SecTor 2026 — a chained exploit where a single prompt to one public-facing Bedrock AgentCore agent compromises every agent in the same AWS account and region. AWS called it expected behavior, then shipped hardening anyway.
◆ Heath Callahan
Trust & Security
Previdian honeypot data shows CVE-2026-102255 exploitation attempts began almost immediately after SonicWall's advisory said there was no evidence of in-the-wild activity.
◆ Heath Callahan
Trust & Security
Missing authentication at the layer that holds blast radius is not four bugs in one quarter. It is one failure mode, and one of the four sat patched for two months before anyone was told.
◆ Heath Callahan
Trust & Security
SNWLID-2026-0017 ships four CVEs on the same architecture: a CVSS 10.0 confused-deputy SSRF at the edge, an execution trio behind it, and no workaround in between. Third disclosure on the line with the same opening shape.
◆ Heath Callahan
Trust & Security
The SIEM platform enterprises deploy to monitor security events has a missing-authentication RCE in the PostgreSQL sidecar that powers its search head clusters. When the monitoring platform needs monitoring, the trust model collapses.
◆ Heath Callahan
