#machine-identity

Public TLS certificates are already capped at 200 days. On March 15, 2027 the cap falls to 100 days, and Chrome's root program stops accepting new public certificates that also carry client authentication, which quietly breaks mTLS setups built on public CAs. Why that date, not 2029, is the one to plan around, and the order to automate in.

A researcher reported on October 17 that the private keys of eight eMudhra (emSign) intermediate CAs, six for TLS and two for code signing, were exposed (later found to be trivially weak). Chrome and Firefox blocked them within hours; Apple, Microsoft and Go followed, and Mozilla is removing the emSign ECC root.

CVE-2026-97629 lets a forged TLS session resume on NGINX 1.23.2 through 1.31.6 when a shared session cache is set without a ticket key file, which can bypass client-certificate verification. Fixed in 1.30.6 and 1.31.7; no exploitation reported.

Okta shipped Agent SSO and got Cross App Access adopted into MCP the same month a GitHub issue was shown to reach CI secrets in Claude Code and Gemini CLI. The delegation standard is arriving faster than the governance around it.

A data-security company is paying roughly 1 billion dollars, about 700 million of it in cash, for a four-year-old non-human identity startup. The price says more about where the category is heading than any product announcement this year.

Ahead of a Black Hat USA 2026 release, researcher Aleksandr Krasnov built NHI Hound, an open source tool that ingests identity data from Okta, GitHub, and cloud IAM to expose which dormant, ownerless service accounts, ghost credentials, actually lead into production or IdP admin roles.

A low-privileged Active Directory account, no admin rights required, can now obtain a certificate for a Domain Controller and DCSync the krbtgt secret. Microsoft patched it 10 days before the public write-up landed.

Instead of stealing an existing service account, attackers are fabricating new ones that blend real environmental attributes with fake ones, inheriting legitimate naming conventions so nothing looks stolen because nothing was.

npm 12 stops running dependency lifecycle scripts unless you allow them. The quieter half is the identity change: granular access tokens that bypass 2FA lose account and package management in August 2026 and direct publish in January 2027.

Two weeks from announcement to close. Entro brings discovery and lifecycle management for more than 1,200 kinds of secret, token, and certificate into SailPoint's Agentic Fabric, aimed at the machine identities that outnumber staff by an order of magnitude.

AI agents now act on behalf of users, call APIs, and chain tools together. They need identities, scopes, and audit trails, and almost no existing IAM stack was designed for them.

Astrix goes into Duo, Splunk, and Cisco Identity Intelligence. The pitch is extending zero-trust principles to an agentic workforce, which in practice means governing the OAuth tokens and service accounts nobody owns.