Klue breach weaponized OAuth tokens into CRM exfiltration

Klue breach weaponized OAuth tokens into CRM exfiltration

A breach at Klue shows how attackers are shifting away from breaking core systems and instead exploiting trusted integrations. By stealing OAuth tokens, they turned normal API access into a high-speed data exfiltration path inside Salesforce environments. This matters because most organizations do not tightly manage their integrations, token lifecycles, or non-human identities. At the same time, a critical Splunk vulnerability is already being exploited, and AI is now acting directly inside financial systems like QuickBooks. These changes are expanding the attack surface in ways traditional controls are not designed to handle. Also covered: a major law enforcement operation disrupting SocGholish infrastructure, new warnings on FortiGate exposure, and why phishing is becoming more precise even as volume drops. Learn more at https://crestvale.io Support the show [https://www.buzzsprout.com/2602483/support]

Cisco patches critical ISE command-exec flaw

Cisco's latest ISE vulnerability is a reminder that when identity infrastructure breaks, everything behind it is exposed. At the same time, CISA is redefining how quickly organizations are expected to respond to real-world threats, with patch timelines shrinking to days when exploitation is active. This episode breaks down what it means when your network access control layer becomes a pivot point, and why risk-based patching is quickly becoming the standard across both government and enterprise environments. There is also a closer look at how Google's new agent discovery standard could shape machine identity and trust, and why ransomware groups are scaling faster with new incentive models. We also cover Teams-based command and control abuse, third-party data exposure, and shifts in vendor risk. Learn more at https://crestvale.io Support the show [https://www.buzzsprout.com/2602483/support]

FortiBleed breaches 30k–73k Fortinet devices

Credential reuse just turned tens of thousands of edge devices into an attack platform. This episode breaks down how Fortinet systems were accessed without exploits, and why identity at the perimeter is now the real control plane. For security and IT leaders, the pattern is clear. Weak authentication at internet-facing systems is no longer a gap, it is a direct entry point. At the same time, AI platforms are shifting enforcement into runtime, where actions can be stopped before they execute. The combination of human and non-human identity risk is reshaping how security needs to be designed. We also cover Databricks moving AI governance into execution, Tenet Security's approach to preempting agent behavior, regulatory action in Australia tying poor security to financial penalties, and key signals from npm, CISA, and emerging AI-driven attacks. Learn more at https://crestvale.io Support the show [https://www.buzzsprout.com/2602483/support]

GitGuardian scans dev laptops for plaintext secrets

The security boundary is shifting from systems to identities, and endpoints are now at the center of that change. Developer machines are increasingly becoming the easiest path into production environments as credentials leak through logs, caches, and AI tooling. This matters because traditional security models still separate endpoint protection from identity control. That gap is now where most real-world breaches are happening. At the same time, active exploitation of Fortinet vulnerabilities shows how quickly attackers move once patches are released, while new policy from France is forcing organizations to accelerate plans for quantum-safe cryptography. AI agents are adding another layer of risk as untracked identities with real access begin to spread across environments. Also covered: Databricks reframing AI governance, CrowdStrike removing standing privileges for agents, Zscaler mapping AI access relationships, regulatory fines for weak controls, and continued SaaS-driven breach paths. Learn more at https://crestvale.io Support the show [https://www.buzzsprout.com/2602483/support]

NewCore raises $66M for AI agent IDs

AI agents are rapidly becoming first-class actors inside enterprise environments, and identity systems are struggling to keep up. This episode looks at NewCore's $66 million bet on rebuilding identity for a world where agents outnumber employees, and why that shift is already underway. For security and IT leaders, this is not just a tooling change. It is a shift in what identity means. Unmanaged AI agents introduce invisible access, persistent permissions, and new attack paths. At the same time, moves like 1Password acquiring Apono show that the market is pivoting toward real-time access governance, not just credential storage. We also cover a critical Splunk vulnerability that demands immediate patching, and a major phishing network takedown that highlights how industrialized fraud now operates. Learn more at https://crestvale.io Support the show [https://www.buzzsprout.com/2602483/support]