Oauth on microsegment.io

The Platform Was Not Breached. The Delegated Key Was.

Tue, 22 Sep 2026 00:00:00 +0000

The SaaS platform can remain intact while a trusted application identity becomes the attack path.

That is the important distinction in the recent BigCommerce and Ribon incident. BigCommerce told BleepingComputer that credentials belonging to the third-party Ribon and Ribon 1.5 applications were compromised. According to the statement, the credentials were used to inject malicious scripts into a small number of merchant storefronts. The reporting also says attackers accessed shopper data between September 13 and September 17, 2026.

Non-Human Identities Need Containment, Not Just Rotation

Tue, 30 Jun 2026 00:00:00 +0000

Most Zero Trust programs still talk about identity as if the identity is a person.

That is no longer enough.

Modern environments are full of identities that do not show up in HR systems, do not sit in security awareness training, and do not leave the company when an employee changes jobs. Service accounts. API keys. OAuth apps. CI/CD tokens. Workload roles. SaaS connectors. Kubernetes service accounts. Agent runtimes. Automation jobs.

Weekly Security Landscape: April 18 - 25, 2026

Sat, 25 Apr 2026 00:00:00 +0000

The Week at a Glance

This week was not defined by one giant breach.

It was defined by repeated proof that attackers do not need exotic tradecraft when trust is already overextended. Management planes, collaboration paths, developer tooling, and edge infrastructure kept turning into the fastest route from access to impact.

Cisco SD-WAN Manager, Apache ActiveMQ, SharePoint, Teams helpdesk impersonation, Vercel’s OAuth-linked exposure, Forest Blizzard’s router-to-token collection, and the Checkmarx KICS and Bitwarden CLI supply-chain chain all pointed to the same operational truth. The attack surface that matters most right now is the layer that connects systems to each other - admin consoles, brokers, package channels, OAuth grants, remote support paths, and poorly governed edge devices.