Cloud & Identity Security Writer
Aisha covers identity providers, SaaS security posture and the long tail of cloud misconfiguration. She maintains our hardening guide series.
366 articles
Threat IntelWiz Research caught threat actors chaining two JFrog Artifactory flaws (CVE-2026-42018 & CVE-2026-42016) to forge admin tokens and compromise enterprise software repositories.
MicrosoftMicrosoft retires SMS and voice MFA on 1 February 2027 with a blocking passkey prompt and no opt-out. Here is a dated plan for service accounts, break-glass and phoneless users.
Deep DiveWiz Research discovered that 10% of internet-facing LiteLLM AI proxy gateways accepted the default documentation admin key sk-1234, leaking upstream model keys and cloud IAM tokens.
VulnerabilityTwo of this year’s fastest CISA remediation deadlines hit devices that cannot run EDR. A practical checklist for the class attackers reach for first.
Deep DiveWith 99% of SaaS compromises originating at the identity provider, MFA is no longer the control organisations think they bought. Here is what changed.
Adversary-in-the-middle phishing now defeats standard MFA at industrial scale. Microsoft tracked a single April 2026 campaign spanning 26 countries in 72 hours.