Eight characters, a required symbol, a new password every 90 days: SP 800-63B-4 rules out all three for password-only sign-in. Here is what NIST's final standard requires, and a four-part check to run against your live system.
Northflank told customers to assume every environment variable was decrypted. Railway warned some may have been, and Huntress tracked stolen M365 tokens replayed at 79 organizations. What each disclosed, and what to rotate.
Discover how MSPs can enhance their service offerings with managed password management, addressing client security needs while generating recurring revenue.
From policy to practice: who had access to what, with whose approval, for how long, and can you prove it? Five cybersecurity leaders on the access controls that are hardest to operationalize, and the evidence organizations need to demonstrate that they work.
A key leaked in May helped poison a release in October. Five recent incidents, from LiteLLM to Zeabur, show what happens when credentials outlive their purpose.
We have released an updated Passwork Docker image with patched PHP (CVE-2026-109618 and CVE-2026-109619). If you run Passwork 7 or later in Docker, update today.
Warning: critical PHP vulnerabilities. CVE-2026-109618 and CVE-2026-109619 can allow an unauthenticated attacker to run code on a server that runs PHP, PHP-FPM included. Both score 9.2 on CVSS v4.0, and the PHP project says updating is the only complete fix. On-premise Passwork administrators...
Pegnitz, a Bavarian town near Nuremberg, ran municipal IT on a file-based vault that couldn't handle concurrent access, forcing administrators to coordinate every edit verbally. The team moved to Passwork's self-hosted platform for real-time, multi-user credential access.
Auerbach in der Oberpfalz, a Bavarian town of 9,470 residents, ran municipal IT on two file-based password managers prone to sync failures and with no role-based access control. The team moved to Passwork's zero-knowledge platform to close that security gap.
In September, attackers skipped the password: a forged JWT, a device-code approval, an overprivileged Cloudflare API key that exposed 100,000+ sites. See what happened and which token and key controls to fix first.
