From policy to practice: who had access to what, with whose approval, for how long, and can you prove it? Five cybersecurity leaders on the access controls that are hardest to operationalize, and the evidence organizations need to demonstrate that they work.
A key leaked in May helped poison a release in October. Five recent incidents, from LiteLLM to Zeabur, show what happens when credentials outlive their purpose.
The White House told federal agencies to say "Super Intelligence" instead of "AI." Your agents didn't notice. They still hold live OAuth tokens and API keys that nobody owns, and a forgotten pilot token exposed Klue's customers. Here is how to govern them.
We have released an updated Passwork Docker image with patched PHP (CVE-2026-109618 and CVE-2026-109619). If you run Passwork 7 or later in Docker, update today.
Warning: critical PHP vulnerabilities. CVE-2026-109618 and CVE-2026-109619 can allow an unauthenticated attacker to run code on a server that runs PHP, PHP-FPM included. Both score 9.2 on CVSS v4.0, and the PHP project says updating is the only complete fix. On-premise Passwork administrators...
For the third consecutive quarter, Passwork has earned SourceForge's Top Performer badge — this time for Fall 2026. Here's what verified reviewers are saying, and the numbers behind the award.
NIST says never rotate. PCI DSS can still say every 90 days. This guide maps nine frameworks and passkeys to vault controls and shows how to resolve the conflict by scope.
A KeePass export is a plaintext file waiting to leak. Here's how to move every credential into Passwork, prove the migration actually worked with a 6-control acceptance test, and retire the old vault without losing anything.
Pegnitz, a Bavarian town near Nuremberg, ran municipal IT on a file-based vault that couldn't handle concurrent access, forcing administrators to coordinate every edit verbally. The team moved to Passwork's self-hosted platform for real-time, multi-user credential access.
Auerbach in der Oberpfalz, a Bavarian town of 9,470 residents, ran municipal IT on two file-based password managers prone to sync failures and with no role-based access control. The team moved to Passwork's zero-knowledge platform to close that security gap.
