authentication

GitHub says all newly minted App installation tokens are now stateless JWTs of about 520 characters; the opt-out header ends November 30, 2026.

JetBrains patched three critical Hub and YouTrack flaws enabling account takeover and authentication bypass, alongside code-execution fixes across IntelliJ, GoLand, and TeamCity.

Salt Security and KushoAI release dueling reports on the same day showing API security has become the critical blind spot of the agentic AI era, with nearly all attacks now originating from authenticated sources.

India's Reserve Bank enforces mandatory two-factor authentication for all digital payments from April 1, while NIST's updated identity guidelines and Microsoft's passwordless-by-default accounts mark a coordinated global shift toward phishing-resistant authentication.

The UAE mandates all banks abandon SMS OTP by March 31 while Microsoft auto-enables passkey profiles across Entra ID, as FIDO Alliance data shows 87 percent of enterprises now deploying passkeys.