Netcrook
#Authentication
Leak-Site Extortion Turns a Small Email Count Into Big Pressure
A MedusaLocker-branded publication listing a named victim and 11 alleged email records shows how ransomware crews use even limited data claims to raise the cost of ignoring them.
When Firewall Logins Turn Into Ransomware Fuel
A Fortinet credential-harvesting campaign known as FortiBleed highlights how stolen perimeter access can matter more than a new exploit.
81 Million Login Attempts, 78 Accounts: The Quiet Machinery Behind a Microsoft 365 Spray Campaign
A two-week wave of password spraying against Microsoft 365 shows how weak credentials and permissive sign-in controls can turn identity into the softest layer of cloud security.
When Nearby Sharing Turns Into a Nearby Threat
A fresh look at AirDrop and Quick Share shows how short-range convenience can become a pre-authentication attack surface, even when no user taps accept.
Oblivion Remastered’s Switch 2 Debut Is a Release Date With a Bigger Digital Footprint
Bethesda has set The Elder Scrolls IV: Oblivion Remastered for Nintendo Switch 2 on August 11, 2026, and any high-profile launch now moves through a chain of stores, accounts, downloads, and update checks.
When a Token Check Fails, the Control Plane Wobbles
CISA’s KEV listing for a SimpleHelp flaw turns a niche authentication bug into a reminder that privileged remote-access tools can become high-value targets fast.
The Small Bonus That Opens a Bigger Security Conversation in Mobile Banking
A seasonal HYPE offer for new customers is less interesting for the euro amount than for what it reveals about app-based finance: eligibility logic, device-linked security, and the fraud patterns that trail every limited-time promotion.
Critical Flowise Flaw Raises the Specter of Forged Sessions
A newly disclosed weakness in the AI workflow builder could let an attacker present a trusted session cookie and act as another user, even though the exact root cause has not been made public.
Remote Support at the Edge: CISA Flags a SimpleHelp Bypass Already in the Wild
A SimpleHelp authentication flaw has landed in CISA’s exploited-vulnerability catalog, a reminder that remote administration tools can become high-value targets long before most defenders finish patching.
81 Million Login Shots Fired at Azure CLI - and Identity Teams Take the Hit
A huge password-spray wave against Microsoft’s command-line cloud tooling shows why authentication, not code, is often the real battleground in modern cloud attacks.
Citrix’s NetScaler Fix Lands at the Edge of the Network
A six-flaw patch round for NetScaler ADC and Gateway shows how small bugs in perimeter appliances can ripple into authentication trouble and service outages.
Tomcat’s Gatekeeper Split: Two Flaws, Two Broken Checks
Apache Tomcat has disclosed one bug that can weaken authentication and another that can weaken servlet-level access control, a reminder that identity and authorization fail in different ways.
Two Tomcat CVEs Cut at the Trust Layer Behind Java Web Apps
Apache has disclosed flaws in Tomcat’s authentication and access-control paths, a reminder that container-level mistakes can ripple through every application sitting on top of them.
Leak-Site Listing Puts a Disability Law Practice in the Extortion Spotlight
A newly posted victim entry tied to Pear may point to data-extortion pressure, but no public evidence here confirms a breach, stolen files, or encryption.
A Portal, Not Just a Leak: Why the Aflac Japan Incident Matters
Repeated unauthorized access to an insurance policy portal shows how ordinary customer logins can become high-value targets for identity theft, fraud, and downstream abuse.
X Puts MCP in Front of Its API, and AI Clients Get a Cleaner On-Ramp
The launch of hosted Model Context Protocol servers makes X easier for AI tools to reach, but it also puts authentication scope and tool boundaries at the center of the conversation.
When an Edge Appliance Talks Too Much: The LoadMaster API Flaw That Could Turn Admin Access into Shell Access
A critical pre-authentication bug tied to CVE-2026-8037 shows how a single management API mistake can threaten the control plane of a network edge device.
Apache Tomcat Alert Puts the Front Door of Java Apps Under Scrutiny
A security notice flags multiple Apache Tomcat vulnerabilities, including one critical flaw that could let a malicious user bypass authentication on affected systems.
When an iPhone Chat App Becomes a Billing Shortcut
A large mobile app review points to a familiar but dangerous pattern: AI features are only as safe as the secrets and authentication behind them.
How Underground Forums Reveal the Machinery Behind BEC
Business Email Compromise is best understood as coordinated fraud, built from compromised access, financial research, and cash-out networks rather than a simple inbox trick.