Erik Peterson

Jason Soroko and I explain the major news items from the most recent CA/Browser Forum face-to-face meeting in Tokyo on the Root Causes Podcast. Topics include MPIC, 47-day certificate term, and Temporary Restraining Orders. Audio: https://lnkd.in/g-RaJifc Video: https://lnkd.in/gDJuyRAg

34

1 Comment

Existing IAM concepts for agent identity and auth? Are you serious? Autonomous agents work with probabilistic intent and outcomes, shift roles rapidly, cross org boundaries, may exist ephemerally for a single task, but operate at machine speeds and scale. Your existing identity infrastructure was built for humans or machines, not agents that spawn, collaborate, and disappear in seconds. We built an Agent Identity Service powered by AGNTCY | A Linux Foundation Project that delivers: 🫆Cryptographic badge generation for MCP Servers and AI Agents using A2A / MCP / OASF specs 🫆Human-in-the-loop policy authorization for critical actions with real-time mobile approvals 🫆Native integrations with Duo Security, Okta, Ory Corp, plus AGNTCY's DID-based identity provider Tamper-proof badges that prove identity and capabilities. Plugs into whatever identity infrastructure you already run. Free SaaS built on a Linux Foundation project because agent identity standards cannot be vendor-controlled. Code on GitHub. We created a currency exchange demo showing the complete workflow. Financial assistant authenticates with exchange agent, both verify cryptographic badges, human approval required for transfers. Every action traceable to specific agent identity. No more wondering which agent transferred money or called that API. No more forensic investigations when something breaks. Read the blog by Julu Panat & Hervé Muyal for details https://lnkd.in/g_MnVuQ7 Try it. Tell me what works, what doesn't.

148

Is security enough for data protection ? Or do we need a little more ? ISMS, or information security management systems are designed to protect information, confidentiality, integrity, availability. Now, when using SFTP, the files are perfectly secure from a transfer standpoint, but, what about governance ? Audit capability ? Access control ? That's where the gap is. And yes, having an authentication bringing audit capability is also a factor in data governance. 👉 https://gag.gl/2ZxYDE #cybersecurity Kiteworks #governance #SSH #SFTP

17

5 Comments

Two newly disclosed N-able vulnerabilities, CVE-2025-8875 and CVE-2025-8876, have been added to CISA’s KEV Catalog. They affect N-able’s N-central remote monitoring and management (RMM) platform. These flaws allow local code execution and command injection but require authentication to exploit, meaning they are unlikely to be used at the beginning of an exploit chain. Alexander Culafi at Dark Reading covers the details, noting the vulnerabilities impact versions prior to 2025.3.1. The article also features insight from Rapid7's Seth Lazarus: “They require authentication to achieve exploitation, which is much less severe than what we’ve recently seen, and likely why exploitation in the wild doesn’t appear to be widespread.” Read the full breakdown here: https://lnkd.in/eiukB6HM

77

The security industry is currently addressing one of the most significant zero-day incidents of the year: Critical Remote Code Execution (RCE) vulnerabilities in React (CVE-2025-55182) and Next.js (CVE-2025-66478). This is not a routine vulnerability. RCE flaws impacting widely-used, foundational frameworks like these - particularly affecting React Server Components - represent a direct and major threat. The potential for an attacker to execute arbitrary code across countless modern web applications makes the risk to infrastructure, proprietary data, and user trust critical. This event underscores why proactive software supply chain security must be a top priority for every development organization. Our Approach: At Snyk, we have been responding to this zero-day since disclosure. Our teams are actively retesting monitored projects and are in the process of notifying impacted customers. Customers can immediately run manual Snyk tests to obtain the most current vulnerability results. We urge all users to consult Update #2 on our Trust Center for full technical advisory and immediate remediation steps. Read our blog for more details: https://lnkd.in/e8Y6ch3j #ZeroDay #CriticalVulnerability #RCE #ReactJS #NextJS

68

2 Comments

I’m at RSAC all week and we are talking to the largest and most mature security orgs. Why are they prioritizing time with Obsidian Security ? Simply put, SaaS is the new battleground. Not cloud, not data. SaaS. “SaaS has become the default and is often the only format in which software is now delivered, leaving organizations with little choice but to rely heavily on a small set of leading service providers, embedding concentration risk into global critical infrastructure.” -Pat Opet

47

4 Comments

A zero-day vulnerability that is actively being exploited was reported, and patched, by SAP yesterday. The issue, CVE-2025-31324 with a CVSS score of 10, impacts the Metadata Uploader component of SAP NetWeaver Visual Composer. While many organizations may not be using the component, the issue was discovered by security teams conducting incident response activities during the investigation of multiple NetWeaver breaches. Organizations should immediately verify whether their systems are vulnerable and either patch the vulnerability, or implement a workaround, as soon as possible. #cybersecurity #sap #NetWeaver #zeroday SAPinsider Mastering SAP ERP Today

27

2 Comments

Earlier this week, Noma Security uncovered a rather critical vulnerability (CVSS 8.8) in LangChain’s LangSmith platform, a popular unified observability and evaluation suite for LLM-based applications. This discovery should raise flags for anyone building or deploying AI agents. The flaw, called "AgentSmith," revealed how seemingly trustworthy public agents shared via LangSmith’s Prompt Hub could silently exfiltrate API keys, intercept prompts, and tamper with LLM outputs, all by routing traffic through a proxy controlled by the attacker. Nice :) This is yet another wake-up call for anyone betting on AI to boost productivity. The more we delegate to agents, the more we expose ourselves to a new breed of supply chain threats, not from libraries or dependencies, but from the agents themselves. What’s most alarming is how invisible this threat was. These agents weren’t obviously malicious. They didn’t trigger alerts. And traditional product security tools wouldn’t raise an alert in this case. The issue is exacly that - Trust models for AI has to evolve from the basic ProdSec approach. If you're using LangChain, LangSmith, or experimenting with agent-based automation, now is a good time to review what’s running under the hood... Kudos to Gal Moyal and Sasi Levi from the Noma Security research team for surfacing this. Important work. Link to article - https://lnkd.in/e3mh9Jzk

80

6 Comments

The CVE Program — as we know it — just almost expired. MITRE’s contract to run the Common Vulnerabilities and Exposures (CVE) Program was to end April 16, 2025. That’s the system we all rely on to coordinate software vulnerability disclosures. No #CVE means no standardized alerts, no shared language for tracking threats, and a whole lot of chaos for defenders. Over 2,800 CVEs are issued monthly. Without continuity, threat actors get a head start — and defenders are stuck making up names like “That-One-Unpatched-Thing-In-The-Corner.” #CVE #Cybersecurity #OTSecurity #MITRE #CISA #MaxAI #CyberIn60Seconds #Resilience #mikeechols Leslie EcholsChuck BrooksChloe BurkeLes McCollum II, MPS-CRMCalvin Nobles, Ph.D.Danyetta Fleming Magana, CISSP, F. ISRMLaszlo Gonc, CISSP, QTESean C. Robert CraneLester Lewis, MBA#CISAntonio "T" ScurlockRoy White, MBA, PMPHoward TsaiTamika McCree ElhilaliJeffrey M. Vinson, Sr CISSP, CCISO, CIPP, NSA IAM-IEMGuy WaltonGotham ArtistsMatthew DimmickTim CooganJohn B MooreDeborah PageAdam Mohamed#aws #informationsharing #mikeechols

37

3 Comments

Common Vulnerabilities and Exposures (CVE) program that helps engineers identify how bad an exploit is and how to prioritize applying patches or other mitigations. So there goes all the VAPT startups and solutions 😂 Opportunity: Silver lining we can maybe start looking into a new solution that finally takes into account configuration weakness into account as well. News Link: https://lnkd.in/ddGcxChm #vulnerability #vulnerabilitymanagement #vapt #cve #infosec #security #engineering #technology #boredtoolbox

14