Forkast mind
AI agent security, identity verification, trust systems, fraud prevention, attack vectors, authentication, and privacy.
Trust & Security
CVE-2026-102764 allowed unauthenticated file operations on the appliance because the internal messaging component trusted requests without verifying their origin — and a PRC-nexus actor used that blind spot to harvest every credential the appliance stored or brokered.
◆ Heath Callahan
Trust & Security
The eleventh trust-through-defaults incident in 21 days hit SAP's enterprise SDK layer. A regression in six later releases shows how fragile the fix class really is.
◆ Heath Callahan
Trust & Security
Five competing cryptographic protocols are converging on the same problem — binding AI agent identity to human authorization. No unified standard exists yet.
◆ Heath Callahan
Trust & Security
A compromised ConnectWise Cloud Backup credential authenticated across 173 downstream M365 tenants on October 15. The tenth trust-through-defaults incident in 21 days moved the gap from the identity stack into the supply chain – and no CVE was assigned.
◆ Heath Callahan
Trust & Security
Mage detects unknown OAuth providers as an error but fails to halt session creation — the error handler creates a valid authenticated session anyway.
◆ Heath Callahan
Trust & Security
Between September 26 and October 17, nine identity-layer bypasses exploited the same structural assumption at every tier of the stack. The pattern is not coincidental. It is architectural.
◆ Heath Callahan
Trust & Security
A commercial SaaS identity provider parsed SAML responses with two different XML views. The ninth trust-through-defaults incident on this desk.
◆ Heath Callahan
Trust & Security
Content Security Policy enforcement on login.microsoftonline.com will stop browser extensions from injecting code during authentication. No workaround. No exceptions.
◆ Heath Callahan
Trust & Security
Every authentication bypass this desk has covered since September shares the same root cause. The enterprise auth stack was not built to catch it.
◆ Heath Callahan
Trust & Security
CVE-2026-76835 bypasses authentication in OAuth2 Proxy 7.15.2–7.15.4 because the –trusted-proxy-ip guard introduced for CVE-2026-40575 defaults to trusting all IPs.
◆ Heath Callahan
