↓ Skip to main content
Juan Carlos Munera
  1. Categories/

Identity and Access

The Four Awareness Month Habits, Tested Against 2026 Tradecraft

·1817 words·9 mins
Security Awareness Identity and Access Cybersecurity Awareness Month Phishing-Resistant MFA Device Code Phishing ClickFix Vishing RMM Abuse KEV Catalog BOD 26-04
The National Cybersecurity Alliance’s four habits for 2026 are sound advice. Checked against this year’s vishing, device code phishing, ClickFix, and fake update lures, each one shows where the attack has moved and which control has to hold when the user can’t see it coming.

When the Control Isn't the Boundary: Unsigned Tokens and Leaky File Watchers

·1296 words·7 mins
Identity and Access Vulnerability Research JWT API Security Side-Channel Attacks Bug Bounty Linux Windows Android Endpoint Hardening
Two late-September 2026 disclosures, an unsigned-token flaw in Microsoft’s internal Titan analytics service and cross-user leakage through OS file-notification APIs, show how easily the control you point to can differ from the control that actually enforces access.