{
    "componentChunkName": "component---src-templates-blog-blog-list-template-blog-list-template-js",
    "path": "/articles",
    "result": {"data":{"allContentfulSecOktaComBlogPost":{"nodes":[{"updatedAt":"2026-11-12T13:44:26.129Z","slug":"/articles/2026/11/openssh-sshole-vulnerability-cve-2026-123158","node_locale":"en","date":"2026-11-12T00:00","secAuthor":[{"name":"Okta","slug":"okta","jobTitle":"","id":"1e934185-d220-5cf6-915f-afe21369ab6b","bio":{"bio":""},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=15&h=15&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=29&h=29&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=116&h=116&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=15&h=15&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=29&h=29&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=116&h=116&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#f8f8f8","width":58,"height":58}}}],"title":"OpenSSH \"SSHole\" Vulnerability (CVE-2026-123158)","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":null,"body":{"raw":"{\"nodeType\":\"document\",\"data\":{},\"content\":[{\"nodeType\":\"heading-4\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta’s Response\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Our security team has reviewed the recent OpenSSH advisory and confirmed that our platform is not affected. Exploitation relies on specific configurations that are not present in our environment, and administrative access is not exposed to the public internet. \",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\\n\",\"marks\":[],\"data\":{}}]}]}"}},{"updatedAt":"2026-11-11T20:03:24.370Z","slug":"/articles/2026/11/node.js-project-november-11-security-releases","node_locale":"en","date":"2026-11-11T00:00","secAuthor":[{"name":"Okta","slug":"okta","jobTitle":"","id":"1e934185-d220-5cf6-915f-afe21369ab6b","bio":{"bio":""},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=15&h=15&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=29&h=29&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=116&h=116&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=15&h=15&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=29&h=29&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=116&h=116&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#f8f8f8","width":58,"height":58}}}],"title":"Node.js Project: November 11 Security Releases","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":{"summary":"On November 11, 2026, the Node.js project released security updates addressing multiple vulnerabilities across core modules. Read on for Okta's response and customer recommendations."},"body":{"raw":"{\"nodeType\":\"document\",\"data\":{},\"content\":[{\"nodeType\":\"heading-4\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"What happened?\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"On November 11, 2026, the \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Node.js\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" project released security updates addressing multiple vulnerabilities across core modules, including authentication bypasses in TLS certificate handling, memory-safety defects in HTTP request parsing and HTTP/2 session handling, denial-of-service conditions, and information disclosure in proxy configuration, 8.0.5 (CVE-2026-123863, CVE-2026-123864, CVE-2026-123865, CVE-2026-123866, CVE-2026-123867, CVE-2026-123868, CVE-2026-123871, CVE-2026-123872, CVE-2026-123874, CVE-2026-123875, CVE-2026-123877, CVE-2026-123828, CVE-2026-123829, CVE-2026-123862, CVE-2026-123873, CVE-2026-126051)\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-4\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta's response\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"No Evidence of Exploitation:\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" Our assessment identified no exploitable exposure in Okta or Auth0 production environments.\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"heading-4\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Do I need to do anything?\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Customers using the Auth0 AD/LDAP connector\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\": We recommend downloading and installing the \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://github.com/auth0/ad-ldap-connector/releases\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"latest version\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\", v8.0.5.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Customers using Auth0 Actions: \",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"We recommend updating the runtime to Node 22 and deploying your changes. Customers already on Node 22 do not need to redeploy.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Customers using Okta or Auth0 \",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"Node.js\",\"marks\":[{\"type\":\"underline\"},{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" SDKs: \",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"We recommend updating your \",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"Node.js\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" runtime to the latest patched version across:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"node-auth0\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"nextjs-auth0\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"express-openid-connect\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"passport-auth0\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"node-jsonwebtoken\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"okta-sdk-nodejs\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"okta-oidc-middleware\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"okta-jwt-verifier-js.\",\"marks\":[],\"data\":{}}]}]}]}]}]},{\"nodeType\":\"heading-4\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"References\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Node.js November 2026 Security Advisory\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://nodejs.org/en/blog/release/v26.13.1/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Node.js 26.13.1 \",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]}]}"}},{"updatedAt":"2026-10-31T15:48:53.638Z","slug":"/articles/2026/10/node2shell-node.js-brotli-flaw-cve-2026-111497","node_locale":"en","date":"2026-10-23T00:00","secAuthor":[{"name":"Okta","slug":"okta","jobTitle":"","id":"1e934185-d220-5cf6-915f-afe21369ab6b","bio":{"bio":""},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=15&h=15&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=29&h=29&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=116&h=116&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=15&h=15&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=29&h=29&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=116&h=116&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#f8f8f8","width":58,"height":58}}}],"title":"Node2Shell: Node.js Brotli flaw (CVE-2026-111497)","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":{"summary":"On October 21, 2026, the Node.js project released fixes for a Brotli decompression flaw (CVE-2026-111497, \"Node2Shell\"). Read on for Okta's response."},"body":{"raw":"{\"nodeType\":\"document\",\"data\":{},\"content\":[{\"nodeType\":\"heading-4\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"What happened?\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"On October 21, 2026, the Node.js project released fixes for a Brotli decompression flaw (\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://nvd.nist.gov/vuln/detail/cve-2026-111497\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"CVE-2026-111497\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\", \\\"Node2Shell\\\"). The flaw is an out-of-bounds write that can crash a process or allow remote code execution (RCE).\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-4\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta's response\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Security Patching Services: \",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"The change has been deployed across the production environments of both Okta and Auth0. \",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"No Evidence of Exploitation: \",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"To date, Okta and Auth0 have observed no evidence of exploitation.\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"heading-4\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Do I need to do anything?\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Customers using Auth0: \",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"We recommend updating the runtime version in your Auth0 tenant settings or in your Action configuration to Node 22, then deploying your changes. Customers already on Node 22 do not need to redeploy.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Customers using Auth0 SDKs with \",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"http://node.js\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Node.js\",\"marks\":[{\"type\":\"underline\"},{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\": \",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"We recommend downloading and installing the \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#downloads-and-release-details\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"latest version\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\".\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Customers using the ad-ldap connector:\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" We recommend downloading and installing the \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://github.com/auth0/ad-ldap-connector/releases/tag/v8.0.4\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"latest version\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\". \",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"heading-4\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Reference\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Aikido Security, Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]}]}"}},{"updatedAt":"2026-10-31T15:48:50.671Z","slug":"/articles/2026/10/okta-and-auth0-removing-trust-in-emudhra-emsign-ecc-root-ca–g3","node_locale":"en","date":"2026-10-23T00:00","secAuthor":[{"name":"Okta","slug":"okta","jobTitle":"","id":"1e934185-d220-5cf6-915f-afe21369ab6b","bio":{"bio":""},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=15&h=15&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=29&h=29&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=116&h=116&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=15&h=15&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=29&h=29&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=116&h=116&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#f8f8f8","width":58,"height":58}}}],"title":"Okta and Auth0 are removing trust in the eMudhra emSign ECC Root CA – G3","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":{"summary":"On October 17, 2026, a researcher reported that the private keys of eight intermediate eMudhra certificate authorities were generated with insufficient entropy and could be derived from their public certificates. Read on for Okta's response."},"body":{"raw":"{\"nodeType\":\"document\",\"data\":{},\"content\":[{\"nodeType\":\"heading-4\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"What happened?\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"On October 17, 2026, a researcher reported that the private keys of eight intermediate eMudhra certificate authorities were generated with insufficient entropy and could be derived from their public certificates. The derived private keys can be used to issue certificates for any domain, and software that trusts the eMudhra root will accept them.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Mozilla, Google, Apple, and Cloudflare have blocked the affected intermediates. Mozilla has removed the emSign ECC Root CA – G3 from its trust store, and Chrome will remove it on October 27, 2026. eMudhra has revoked the intermediates.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-4\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta’s response\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta and Auth0 are removing trust in emSign ECC Root CA – G3 and the eight affected intermediates across our services.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Security Patching Services:\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" The change has been deployed across the production environments of both Okta and Auth0. \",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"No Evidence of Exploitation:\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" To date, Okta and Auth0 have observed no evidence of exploitation.\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"heading-4\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Do I need to do anything?\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Only if Okta or Auth0 connects to a server you control and that server's certificate chain includes the eMudhra emSign ECC Root CA – G3. Inbound access to Okta and Auth0, including sign-in, is not affected.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The case to check is a non-browser connection or webhook that calls your own API, such as an Okta\",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" \",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"Inline Hook or Event Hook, or Auth0 Action, Custom Database connection, or Auth0 Federated Connection. \",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"These connections may not have shown you any error before now. Run \",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"openssl s_client -showcerts -connect <your-host>:443\",\"marks\":[{\"type\":\"code\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" and look for \\\"emSign\\\" in the chain. If you find it, replace the certificate with one from another trusted CA. Connections to that endpoint will fail once our change is applied to your tenant.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-4\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"References\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://emudhra.com/en/press-release/emudhra-statement-distrust-global-tls-intermediate-root-ca\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"eMudhra Statement on distrust of select Global TLS Intermediate and one Root CA\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" \",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Google - Protecting Chrome and Android Users from Compromised eMudhra Intermediate CA Certificates\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Mozilla - Protecting Firefox users following the compromise of eMudhra intermediate certificates\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]}]}"}},{"updatedAt":"2026-10-23T03:13:04.963Z","slug":"/articles/2026/10/okta-response-to-php2shell","node_locale":"en","date":"2026-10-22T00:00","secAuthor":[{"name":"Okta","slug":"okta","jobTitle":"","id":"1e934185-d220-5cf6-915f-afe21369ab6b","bio":{"bio":""},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=15&h=15&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=29&h=29&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=116&h=116&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=15&h=15&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=29&h=29&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=116&h=116&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#f8f8f8","width":58,"height":58}}}],"title":"Okta's Response to PHP2Shell","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":{"summary":"Okta's response to the industry-wide third-party PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619)."},"body":{"raw":"{\"nodeType\":\"document\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"On October 21, 2026, industry-wide third-party critical PHP pre-authentication remote code execution (RCE) vulnerabilities (\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://nvd.nist.gov/vuln/detail/cve-2026-109618\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"CVE-2026-109618\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" and \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://nvd.nist.gov/vuln/detail/cve-2026-109619\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"CVE-2026-109619\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\") were disclosed, both with CVSS scores of 9.2.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta tested the publicly available proof-of-concept (PoC) exploits against Okta Access Gateway in its default configuration, and none achieved code execution. \",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-4\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta’s Response\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Cloud services: Not affected. Okta and Auth0 cloud service platforms are not affected by these vulnerabilities.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"On-premise software: Okta Access Gateway (OAG) requires a patch. Customers should upgrade to Okta Access Gateway version 2026.44.0.\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"heading-4\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Action for Okta Access Gateway (OAG) Customers\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Customers running Okta Access Gateway appliance versions prior to 2026.44.0 should upgrade to version 2026.44.0. For complete vulnerability details and remediation guidance, refer to the Security Advisory:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://trust-okta.login.adsbillinghub.com/security-advisories/php-runtime-vulnerabilities-affecting-okta-access-gateway-cve-2026-109618-cve-2026-109619\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"PHP Runtime Vulnerabilities Affecting Okta Access Gateway CVE-2026-109618 / CVE-2026-109619\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"heading-4\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Action for Auth0 and Okta SDKs users\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"For actions required and developer guidance, please refer to the appropriate KnowledgeBase article:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://support.auth0.com/center/s/article/php-critical-vulnerabilities-cve-2026-109618-and-cve-2026-109619\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"PHP Critical Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]}]}"}},{"updatedAt":"2026-09-08T20:58:58.464Z","slug":"/articles/2026/09/hunting-vulnerabilities-using-frontier-models","node_locale":"en","date":"2026-09-08T00:00","secAuthor":[{"name":"Esteban Guillardoy","slug":"/hackers/esteban-guillardoy","jobTitle":"Director, AI Security Engineering","id":"938360d5-b9f7-5a6a-92c7-bba3c8a802fe","bio":{"bio":"<p>Esteban Guillardoy is the Director of AI Security Engineering at Okta. He brings more than 18 years of experience combining hands-on offensive security with strategic risk reduction. Esteban applies his offensive background to help engineers build secure products and push the boundaries of how AI can augment, automate, and scale Okta's security practices. His work has included vulnerability research, source code auditing, exploit development, penetration testing, as well as tool development. Esteban has taught Java exploitation training courses and has presented at conferences like Ekoparty and Infiltrate. </p>"},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/4XwlrKxQAdZeEo0RBhpqIY/55875ff75e5adc674b5ad6ef4bfd8f0e/Esteban_profile_cropped_original.jpg?w=15&h=17&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4XwlrKxQAdZeEo0RBhpqIY/55875ff75e5adc674b5ad6ef4bfd8f0e/Esteban_profile_cropped_original.jpg?w=29&h=33&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4XwlrKxQAdZeEo0RBhpqIY/55875ff75e5adc674b5ad6ef4bfd8f0e/Esteban_profile_cropped_original.jpg?w=58&h=65&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4XwlrKxQAdZeEo0RBhpqIY/55875ff75e5adc674b5ad6ef4bfd8f0e/Esteban_profile_cropped_original.jpg?w=116&h=130&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/4XwlrKxQAdZeEo0RBhpqIY/55875ff75e5adc674b5ad6ef4bfd8f0e/Esteban_profile_cropped_original.jpg?w=58&h=65&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/4XwlrKxQAdZeEo0RBhpqIY/55875ff75e5adc674b5ad6ef4bfd8f0e/Esteban_profile_cropped_original.jpg?w=15&h=17&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4XwlrKxQAdZeEo0RBhpqIY/55875ff75e5adc674b5ad6ef4bfd8f0e/Esteban_profile_cropped_original.jpg?w=29&h=33&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4XwlrKxQAdZeEo0RBhpqIY/55875ff75e5adc674b5ad6ef4bfd8f0e/Esteban_profile_cropped_original.jpg?w=58&h=65&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4XwlrKxQAdZeEo0RBhpqIY/55875ff75e5adc674b5ad6ef4bfd8f0e/Esteban_profile_cropped_original.jpg?w=116&h=130&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#e8e8e8","width":58,"height":65}}},{"name":"Katie Nickels","slug":"/hackers/katie-nickels","jobTitle":"Director, Okta Threat Intelligence","id":"5f58df42-2815-5150-828e-87b6abdd339b","bio":{"bio":"<p> Katie Nickels is a Director of Threat Intelligence, where she brings a passion for educating as she provides actionable insights on identity-based threats. With over a decade of experience in the cybersecurity industry, she previously led intelligence, research, and hunting teams at Red Canary, and also served as the Threat Intelligence Lead for the MITRE ATT&CK team. Outside of Okta, Katie teaches FOR578: Cyber Threat Intelligence for the SANS Institute and acts as a Nonresident Senior Fellow at the Atlantic Council.</p>"},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/7sI9lcD8JnTnFa1D4MBTY/cd51421a30089398735c4bfda0a7ec7f/1000014906.jpeg?w=15&h=14&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/7sI9lcD8JnTnFa1D4MBTY/cd51421a30089398735c4bfda0a7ec7f/1000014906.jpeg?w=29&h=28&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/7sI9lcD8JnTnFa1D4MBTY/cd51421a30089398735c4bfda0a7ec7f/1000014906.jpeg?w=58&h=56&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/7sI9lcD8JnTnFa1D4MBTY/cd51421a30089398735c4bfda0a7ec7f/1000014906.jpeg?w=116&h=112&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/7sI9lcD8JnTnFa1D4MBTY/cd51421a30089398735c4bfda0a7ec7f/1000014906.jpeg?w=58&h=56&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/7sI9lcD8JnTnFa1D4MBTY/cd51421a30089398735c4bfda0a7ec7f/1000014906.jpeg?w=15&h=14&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/7sI9lcD8JnTnFa1D4MBTY/cd51421a30089398735c4bfda0a7ec7f/1000014906.jpeg?w=29&h=28&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/7sI9lcD8JnTnFa1D4MBTY/cd51421a30089398735c4bfda0a7ec7f/1000014906.jpeg?w=58&h=56&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/7sI9lcD8JnTnFa1D4MBTY/cd51421a30089398735c4bfda0a7ec7f/1000014906.jpeg?w=116&h=112&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#181818","width":58,"height":55.99999999999999}}}],"title":"Hunting Vulnerabilities Using Frontier Models","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":{"summary":"Okta used early access to GPT 5.5 Cyber Preview and Anthropic's Mythos Preview to hunt vulnerabilities in our own codebase. The big lesson: agents alone generate noisy leads, but pairing them with human experts who steer investigations produces real, high-confidence findings, plus a reusable pipeline architecture for future AI-driven security work."},"body":{"raw":"{\"data\":{},\"content\":[{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Executive Summary\",\"nodeType\":\"text\"}],\"nodeType\":\"heading-2\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Over several months, Okta has used frontier AI models to proactively hunt for vulnerabilities and secure Okta’s products as part of \",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://openai.com/daybreak/\"},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"underline\"}],\"value\":\"OpenAI’s Daybreak Cyber Partner Program\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[],\"value\":\" and \",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://www.anthropic.com/glasswing\"},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"underline\"}],\"value\":\"Anthropic's Project Glasswing\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[],\"value\":\". \",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"These partnerships allowed us to access the frontier models GPT 5.5 Cyber Preview (TAC) as well as Mythos Preview to scan millions of lines of code in multiple languages and across very different tech stacks. \",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"We set out to achieve two goals: the first was to use these frontier models to find vulnerabilities so we can better protect our customers, and the second was to learn from the experience to inform our future AI-driven security work.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"This blog post aims to add new insights to an emerging body of work from those organizations who have accessed these frontier capabilities ahead of any public release. We expect many Okta customers, especially those in technology and financial services, are now in the process of planning for their own adoption of these capabilities. Throughout this post, we share how we built our pipeline, how we conducted the scanning, and what we learned, in the hopes that others can find value from our experience. \",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Our key finding was that we achieved the best results when human experts and AI agents worked together and taught each other.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"What We Built\",\"nodeType\":\"text\"}],\"nodeType\":\"heading-1\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"We started by looking at the excellent work already published in the community around using AI for vulnerability scanning, bringing together the best ideas that would work for our goals. (See the \",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://github.com/okta/customer-detections/blob/f7c7bceecc6b4a7b704fbdd03b34010fd13ff683/references/frontier-model-vuln-hunting/appendix.md#research-references\"},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"appendix\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[],\"value\":\" for key references we used as inspiration.)\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"This research inspired the design and implementation of a new system from scratch to be able to conduct this type of scanning. We decided to create an architecture that is flexible enough to evolve and isn’t locked to a single vendor. We also wanted a system that could be repurposed for tasks beyond vulnerability discovery. \",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Here’s what we built based on our core architectural goals:\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"content\":[{\"data\":{},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"Secure: \",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\"Using inspiration from many orchestration projects (listed in the \",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://github.com/okta/customer-detections/blob/f7c7bceecc6b4a7b704fbdd03b34010fd13ff683/references/frontier-model-vuln-hunting/appendix.md#orchestration--multi-agent-coordination\"},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"appendix\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[],\"value\":\"), we chose to build a custom lightweight orchestrator in Python. We designed it to have strong isolation to reduce the attack surface.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"}],\"nodeType\":\"list-item\"},{\"data\":{},\"content\":[{\"data\":{},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"Flexible and extensible: \",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\"We designed our system so it could use any model, with any coding harness or any agentic SDK, with minimal development effort. We also built it to allow us to quickly deploy new workflows using configuration files, similar to a Directed Acyclic Graph (DAG) system.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"}],\"nodeType\":\"list-item\"},{\"data\":{},\"content\":[{\"data\":{},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"Inspectable: \",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\"We created real-time tracking, allowing human reviewers to follow what happened from a dashboard. We also captured the full sessions of each pipeline step and agent.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"}],\"nodeType\":\"list-item\"}],\"nodeType\":\"unordered-list\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Scanning Pipelines\",\"nodeType\":\"text\"}],\"nodeType\":\"heading-2\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"A key design decision is how to build our scanning pipelines - that is, the sequence of steps and loops we used to find vulnerabilities. \",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Instead of telling our agent to “go find vulnerabilities” and allow it to wander off, we took a graph-engineering approach. We defined complex steps and sequences with iterations, loops, and branching, without losing control of the agent. \",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Each step is executed as a full isolated Codex or Claude Code session using progressive context loading - this means that we carefully controlled what files each step gave to the next one (though the agent could intentionally decide it needed to read additional findings from a previous step). We did this to reduce so-called “context bloat,” where an agent starts to make poorer decisions because it has too much information in its context window. \",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"We also chose to develop four different pipelines to scan our code. While running different pipelines resulted in more work, we wanted to use the opportunity to improve our approach to using AI models as part of vulnerability discovery. \",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{\"target\":{\"sys\":{\"id\":\"44YxuZOeuXRuE7jSesuRVT\",\"type\":\"Link\",\"linkType\":\"Asset\"}}},\"content\":[],\"nodeType\":\"embedded-asset-block\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"italic\"}],\"value\":\"Figure 1: Madara-Scorecard pipeline is a linear 8-step flow with a feedback loop that re-hunts coverage gaps up to three times before consolidating findings. Each step is executed as a full isolated Codex or Claude Code session using progressive context loading.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Using four distinct pipelines allowed us to analyze which steps worked better, providing feedback on how we could create new, specialized pipelines based on product type, tech stack, or a specific type of vulnerability we needed to find. Our research demonstrated that a different sequence of steps is more likely to find a different type of vulnerability.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{\"target\":{\"sys\":{\"id\":\"5uvJOnwGbMjP8YsSCGxqVo\",\"type\":\"Link\",\"linkType\":\"Asset\"}}},\"content\":[],\"nodeType\":\"embedded-asset-block\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"italic\"}],\"value\":\"Figure 2: Using the Sink-Thorough pipeline, dual parallel scanners feed into a linear analysis chain, then fan out to four parallel revalidation chunk loops before merging and consolidating results. \",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Of course, having four different pipelines scan hundreds of repositories with both models (GPT Cyber and Mythos) came with a tradeoff - we accepted that this would result in duplicate findings, a potentially higher false positive rate, and a more burdensome triage process. \",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"How We Scanned\",\"nodeType\":\"text\"}],\"nodeType\":\"heading-2\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Before we could unleash the agents, we had to decide exactly what we wanted to scan. To ensure we delivered the greatest impact in the shortest amount of time, we started by scanning the code that matters most to protect: the software our customers install themselves. We deployed our agents across the entire code base, letting them go “wide” first. Even though we knew this approach would generate many results (including false positives), we accepted this trade-off because we felt that even false positives could be valuable to provide ideas for future research.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"We had both humans and AI agents perform scanning in various ways. We took two main approaches, which happened in parallel: allowing AI agents to autonomously scan across our code repositories, and pairing human experts with AI agents to direct them to investigate an area or idea they had. The goal was to see if the expert could help the agent get to better or more novel results.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"A Novel Approach to Capturing Sessions\",\"nodeType\":\"text\"}],\"nodeType\":\"heading-2\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"We chose to capture all of the executed step sessions. This allowed human experts to go back at any point in time to review what an agent did. Even though the pipeline was complex, if the experts observed that the model did something interesting at a certain point in the pipeline, they could go back and explore that further. This also allowed us to fully validate what happened in the pipeline. This approach challenges the commonly-held view that autonomous AI is an opaque system - we wanted to have a way to inspect it, even interactively.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"This concept might sound familiar if you’ve done exploit development, forensics, or malware analysis. Going back to a specific moment of analysis is helpful, and that’s the concept we applied. One of our engineers was inspired by the idea of “time travel debugging” in exploit development - meaning a developer can record a program's execution and move both forward and backward through its operational history. If you’ve ever taken a snapshot of a virtual machine to look at a system before and after malware executed, it’s a similar concept. Though the concept isn’t novel, our application of it was.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"To do this, we identified the minimum information we needed to capture to reconstruct a session, since Codex and Claude Code collected a lot of extra information we didn’t need. We implemented logic in our orchestration system to keep only what was essential. Once a step in a pipeline was complete and the session was captured, the expert could launch Codex or Claude Code and load it as an interactive session for that specific step and then “guide” the model on what to do next. We used session viewer tools to help with this task, allowing experts to look at the traces in an HTML viewer to inspect what the model did. Since the pipeline has independent steps, this approach allowed us to change different steps in the process to explore how that changed our result.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"This approach unlocked a lot of value for us. If human experts observed something interesting in the middle of the model conducting the scanning, they could load it. \",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"We learned that when you pair the model with someone who can steer it, you get a great result.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"How We Triaged\",\"nodeType\":\"text\"}],\"nodeType\":\"heading-2\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"After we scanned using the four pipelines and our collaborative human-agent approach, we were left with many findings from the models, including duplicates. We tackled the task of triaging those investigative leads and validating if they were true exploitable vulnerabilities, and we needed to do it quickly. As we’ve done throughout the project, we paired our human experts with our AI agents to complete this as effectively as possible.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"We prioritized triaging the highest severity findings from our scans as well as any findings that could potentially be assigned a CVE, since any true positives would have the greatest impact. Any potential CVE findings were only triaged manually by humans, since it was crucial to validate this as quickly and accurately as possible. As we triaged, we observed that the models regularly over-estimated the importance of findings, and we downgraded the criticality due to the real-world conditions being different than the model assumed. For example, a model might have assumed the code would be directly exposed to the Internet, but in reality it was not configured that way. \",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"After our agents did their triaging work, humans verified whether the results and verdicts were accurate. When findings were false positives, those human experts investigated to figure out why, so they could make improvements to our pipelines to reduce similar false positives in the future.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"What We Learned\",\"nodeType\":\"text\"}],\"nodeType\":\"heading-2\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Partner humans and agents for the best results\",\"nodeType\":\"text\"}],\"nodeType\":\"heading-3\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Throughout the project, our best results paired human experts with AI agents. The scanning process was an exercise in reciprocal mentoring between us and our agents. We first allowed agents to scan the code without additional context so they could teach us new approaches and techniques, and we then taught the agents how to focus using our institutional knowledge around the codebase. For example, we tried giving the models “hints” about previous vulnerabilities as additional context.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"We had experts in that codebase work together with the agent, pushing it more into exploring a specific attack surface, product area, or complexity. We found that our results were more impactful when an expert guided the agents, and we were able to uncover findings that the autonomous agent may have missed. For example, a human expert might know certain areas of code containing high risk functionality such as complex authentication flows or cryptographic primitives. Instead of the agent wandering the code base trying to find these on its own, the agents performed better when guided as close to the potential vulnerability as possible.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Agents were sometimes like hunting dogs getting us close to a vulnerability. The agents often reported findings that weren’t true vulnerabilities as-is, but the human expert took that as an investigative lead, pushed the agent further, connected additional context, and ultimately found additional vulnerabilities.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"This project would not have been possible without the hard work of our Product Security engineers. Before reporting any vulnerabilities found by these models, it required a major effort to triage, reproduce, and report these vulnerabilities over the course of many weeks.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Experiment and iterate to continuously improve\",\"nodeType\":\"text\"}],\"nodeType\":\"heading-3\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"We intentionally set out with the goal to use this project as a learning experience. It would have been simpler to use one pipeline, but instead we used four. It would have been simpler and cheaper if we hadn’t captured sessions, or insisted on collaboration between agents with human expertise. If an experiment didn’t work the first time, we iterated and tried it again. This iterative approach didn’t just help us learn, it also led to better results because we didn’t just scan once and declare victory.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Our work doesn’t stop here. We’ve captured a rich data set and we have a plethora of ideas for what to do next and how we can improve. We will keep iterating and learning as we continue this critical work to find gaps and close them before threats can exploit them.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"}],\"nodeType\":\"document\"}"}},{"updatedAt":"2026-09-21T14:01:47.268Z","slug":"/articles/2026/08/dos-in-http2-flow-control/","node_locale":"en","date":"2026-08-03T00:00","secAuthor":[{"name":"Okta Red Team","slug":"/okta-red-team","jobTitle":null,"id":"3b613a44-b34a-5cbd-ad7f-cd6e205ed54a","bio":{"bio":"<p> </p>"},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=15&h=15&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=29&h=29&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=116&h=116&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=15&h=15&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=29&h=29&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=116&h=116&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#f8f8f8","width":58,"height":58}}}],"title":"HTTP2Crash: A Denial of Service (DoS) in HTTP/2 Flow Control","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":{"summary":"The Okta Red Team discovered a Denial of Service (DoS) vulnerability in HTTP/2 Flow Control."},"body":{"raw":"{\"nodeType\":\"document\",\"data\":{},\"content\":[{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"At a glance\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"On April 7, 2026, the Okta Red Team reported a \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://kb.cert.org/vuls/id/885548\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"denial-of-service condition in HTTP/2 flow control\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" via VINCE that could allow a remote, unauthenticated threat actor to exhaust server memory and disrupt service. This attack uses a setting that is valid under the HTTP/2 specification, where no malformed frames or protocol violations are required.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"When the server can’t send\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"HTTP/2 allows a client to tell a server how much response data it is ready to receive. By setting SETTINGS_INITIAL_WINDOW_SIZE to zero, a threat actor can prevent the server from sending response data while continuing to issue requests.\\n\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The server must honor that instruction. It can continue processing requests, but it cannot transmit the resulting response data until the client opens the flow-control window. If the server does not impose its own limits or timeouts, those responses remain in memory while the threat actor keeps the connection open.\\n\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"By requesting large resources across many streams, a threat actor can make response data accumulate rapidly while using very little bandwidth. In testing, a single machine was able to create significant memory and swap pressure. When the connection closed, releasing the blocked data also caused sharp CPU and I/O spikes, potentially resulting in a complete service outage.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"A protocol-level consideration\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Recent HTTP/2 denial-of-service vulnerabilities have often been addressed with implementation-level safeguards, such as stricter timeouts or stream limits. This issue is different: the behavior follows the protocol as written.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"RFC 9113 permits a zero-sized flow-control window but does not require a memory cap, timeout, or maximum lifetime for streams whose responses cannot be sent. HTTP/2-enabled application servers, proxies, and load balancers may therefore need to account for this condition independently.\\n\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"It’s recommended that operators assess HTTP/2 implementations for memory growth when response data is flow-control blocked. Relevant safeguards may include connection, stream, buffering, and timeout limits, along with monitoring for unusual zero-window connections.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"For more background, see \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www.rfc-editor.org/rfc/rfc9113.html\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"RFC 9113\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\", including its sections on \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www.rfc-editor.org/rfc/rfc9113.html#section-5.2\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"flow control\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" and \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www.rfc-editor.org/rfc/rfc9113.html#section-6.5.2\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"HTTP/2 settings\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\". For vulnerability-related details, see the related CVE records:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www.cve.org/CVERecord?id=CVE-2026-59762\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"CVE-2026-59762\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www.cve.org/CVERecord?id=CVE-2026-59173\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"CVE-2026-59173\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www.cve.org/CVERecord?id=CVE-2026-44909\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"CVE-2026-44909\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www.ibm.com/support/pages/security-bulletin-ibm-websphere-application-server-liberty-affected-denial-service-vulnerability-http2-cve-2026-11897\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"CVE-2026-11897\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"CVE-2026-13474\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\".\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Advancing security through collaboration\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"This research was conducted to explore an emerging security challenge and help strengthen the resilience of the broader cyber community, as part of Okta’s broader commitment to secure identity. Through the \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www-okta.login.adsbillinghub.com/en-ca/secure-identity-commitment/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta Secure Identity Commitment\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" (OSIC), we’re raising the bar for the industry by investing in stronger protections, greater transparency, and collaboration across the security community.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta also participates in the broader ethical security community through its \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://bugcrowd.com/engagements/okta\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Bugcrowd\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" security research engagement, and welcomes collaboration with security researchers and supports disclosure reporting through its \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://auth0.com/docs/troubleshoot/customer-support/responsible-disclosure-program-security-support-tickets\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Responsible Disclosure Program\",\"marks\":[{\"type\":\"underline\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\".\",\"marks\":[],\"data\":{}}]}]}"}},{"updatedAt":"2026-07-16T17:42:20.545Z","slug":"/articles/2026/06/openssl-hollowbtye-a-dos-hiding-in-11-bytes","node_locale":"en","date":"2026-07-16T01:00","secAuthor":[{"name":"Okta Red Team","slug":"/okta-red-team","jobTitle":null,"id":"3b613a44-b34a-5cbd-ad7f-cd6e205ed54a","bio":{"bio":"<p> </p>"},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=15&h=15&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=29&h=29&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=116&h=116&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=15&h=15&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=29&h=29&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=116&h=116&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#f8f8f8","width":58,"height":58}}}],"title":"OpenSSL HollowByte: A DoS Hiding in 11 Bytes","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":{"summary":"The Okta Red Team discovered HollowByte, a Denial of Service (DoS) vulnerability in OpenSSL."},"body":{"raw":"{\"data\":{},\"content\":[{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Every so often, a vulnerability reminds us how deeply our digital infrastructure relies on foundational libraries. Recently, the Okta Red Team discovered \",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"HollowByte\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\", a Denial of Service (DoS) vulnerability in OpenSSL. By sending a malicious payload of just 11 bytes, a remote, unauthenticated attacker can force a server to allocate disproportionate chunks of memory before any security handshake even begins.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Here is the breakdown of how it works.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"Trusting the Header\",\"nodeType\":\"text\"}],\"nodeType\":\"heading-2\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"The TLS handshake begins with a ClientHello message wrapped in a record. Each handshake message carries a 4-byte header that declares how large the incoming message body will be.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Older versions of OpenSSL allocate a receive buffer based on that attacker-declared length before any data has actually arrived.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"When a rogue header lands, the state machine triggers an unvalidated allocation. When the malicious 11-byte payload arrives, the TLS state machine reads the 4-byte handshake header and triggers an unvalidated pre-allocation based on the header's 3-byte length declaration:\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Read Header⟶grow_init_buf()⟶OPENSSL_clear_realloc()⟶malloc(attacker_size)\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Because there is no payload validation at this early stage, malloc() allocates up to 131 KB based solely on the untrusted packet's claims. The worker thread then blocks, waiting indefinitely for data that will never arrive.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"Permanent Memory Fragmentation\",\"nodeType\":\"text\"}],\"nodeType\":\"heading-2\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Holding connections open to exhaust threads is a classic trick (like \",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://en.wikipedia.org/wiki/Slowloris_(cyber_attack)\"},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"underline\"}],\"value\":\"Slowloris\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[],\"value\":\"). HollowByte introduces a nastier compounding effect due to how the GNU C Library (glibc) handles memory.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"When an attacking connection drops, OpenSSL frees the buffer. However, glibc does not immediately return small-to-medium allocations to the operating system; it keeps them for potential reuse.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"By launching waves of connections with randomized claimed sizes, an attacker prevents the allocator from reusing those freed chunks. The heap fragments heavily, causing the server’s Resident Set Size (RSS) to climb continuously.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Even after the attacker disconnects, the server remains permanently bloated. The only way to reclaim that memory is to terminate the process.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"Real-World Testing & Ecosystem Impact\",\"nodeType\":\"text\"}],\"nodeType\":\"heading-2\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"To measure the threat, we tested unpatched and patched OpenSSL instances running NGINX under various load conditions.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"In a standard 1 GB RAM environment, the unpatched server was OOM-killed at 547 MB of frozen, fragmented memory. In higher-spec testing (16 GB RAM), the attack successfully locked up 25% of the system's total memory while staying safely \",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[{\"type\":\"italic\"}],\"value\":\"under\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\" the connection ceiling, meaning standard connection-limiting defenses won't stop it.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Because OpenSSL is widely used and embedded, this vulnerability affects a variety of software, including web servers (Apache, NGINX), language runtimes (Node.js, Python, Ruby, PHP), and databases (MySQL, PostgreSQL).\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"The Fix and Next Steps\",\"nodeType\":\"text\"}],\"nodeType\":\"heading-2\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"The OpenSSL team resolved this by moving to incremental buffer growth (merged in PRs #\",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://github.com/openssl/openssl/pull/30792\"},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"underline\"}],\"value\":\"30792\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[],\"value\":\", #\",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://github.com/openssl/openssl/pull/30793\"},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"underline\"}],\"value\":\"30793\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[],\"value\":\", and #\",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://github.com/openssl/openssl/pull/30794\"},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"underline\"}],\"value\":\"30794\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[],\"value\":\"). This fix was silently included as part of the OpenSSL v4.0.1 release, with silent backports to release versions 3.6.3, 3.5.7, 3.4.6, and 3.0.21. Instead of trusting the header outright, OpenSSL now grows the buffer only as bytes actually land on the wire. A claim with no follow-through now costs the server nothing.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"While OpenSSL handled this as a hardening fix rather than a CVE security advisory, we recommend upgrading your distribution's OpenSSL packages immediately.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"}],\"nodeType\":\"document\"}"}},{"updatedAt":"2026-03-11T13:00:15.369Z","slug":"/articles/2026/03/datadog-okta-collaboration","node_locale":"en","date":"2026-03-07T12:00","secAuthor":[{"name":"Okta","slug":"okta","jobTitle":"","id":"1e934185-d220-5cf6-915f-afe21369ab6b","bio":{"bio":""},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=15&h=15&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=29&h=29&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=116&h=116&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=15&h=15&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=29&h=29&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=116&h=116&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#f8f8f8","width":58,"height":58}}},{"name":"Tom Simpson","slug":"tom-simpson","jobTitle":"Staff Detection and Response Engineer","id":"9f195fb3-2707-5759-a818-4a417280f582","bio":{"bio":"<p> Tom is a Staff Detection and Response Engineer within Okta’s Defensive Cyber Operations team. Tom has spent two decades in the  security industry and is an expert at intrusion research, incident response and engineering secure systems, which he’s demonstrated at Okta, TikTok, CrowdStrike, and in the Australian Defence industry. Tom currently holds the GSEC, GCIH and GREM, previously volunteering as a SANS teaching assistant. He enjoys researching the latest trends in adversary tactics and sharing his findings through security research blogs and conference talks.</p>"},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/il6yytExKSSeXHdwvwkpR/b957a8aaf8f9fa7ec963bb62b6d9e289/tom.png?w=15&h=15&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/il6yytExKSSeXHdwvwkpR/b957a8aaf8f9fa7ec963bb62b6d9e289/tom.png?w=29&h=29&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/il6yytExKSSeXHdwvwkpR/b957a8aaf8f9fa7ec963bb62b6d9e289/tom.png?w=58&h=58&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/il6yytExKSSeXHdwvwkpR/b957a8aaf8f9fa7ec963bb62b6d9e289/tom.png?w=116&h=116&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/il6yytExKSSeXHdwvwkpR/b957a8aaf8f9fa7ec963bb62b6d9e289/tom.png?w=58&h=58&q=50&fm=png","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/il6yytExKSSeXHdwvwkpR/b957a8aaf8f9fa7ec963bb62b6d9e289/tom.png?w=15&h=15&q=50&fm=png 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/il6yytExKSSeXHdwvwkpR/b957a8aaf8f9fa7ec963bb62b6d9e289/tom.png?w=29&h=29&q=50&fm=png 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/il6yytExKSSeXHdwvwkpR/b957a8aaf8f9fa7ec963bb62b6d9e289/tom.png?w=58&h=58&q=50&fm=png 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/il6yytExKSSeXHdwvwkpR/b957a8aaf8f9fa7ec963bb62b6d9e289/tom.png?w=116&h=116&q=50&fm=png 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#080808","width":58,"height":58}}},{"name":"Jordan Ruocco","slug":"jordan-ruocco","jobTitle":"Senior Manager, Okta Cyber Defense Team","id":"cdd9fb32-226d-558d-a986-4084b4f3dc5a","bio":{"bio":"<p> Jordan is a cybersecurity leader specialising in security operations, threat intelligence, and security engineering. With a career in technology that began as a teen, Jordan brings nearly two decades of experience to his role as a Senior Manager within Okta’s Cyber Defense team. He leads an expert group of engineers dedicated to building the defenses and response capabilities required to promptly identify, contain, and evict advanced persistent threats from Okta’s environment.</p>"},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/4LyCQIOujOjDJDzFjU7aSW/c09849ac8281c32a39dd5d30d58078b2/jordan.jpg?w=15&h=17&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4LyCQIOujOjDJDzFjU7aSW/c09849ac8281c32a39dd5d30d58078b2/jordan.jpg?w=29&h=34&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4LyCQIOujOjDJDzFjU7aSW/c09849ac8281c32a39dd5d30d58078b2/jordan.jpg?w=58&h=67&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4LyCQIOujOjDJDzFjU7aSW/c09849ac8281c32a39dd5d30d58078b2/jordan.jpg?w=116&h=134&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/4LyCQIOujOjDJDzFjU7aSW/c09849ac8281c32a39dd5d30d58078b2/jordan.jpg?w=58&h=67&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/4LyCQIOujOjDJDzFjU7aSW/c09849ac8281c32a39dd5d30d58078b2/jordan.jpg?w=15&h=17&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4LyCQIOujOjDJDzFjU7aSW/c09849ac8281c32a39dd5d30d58078b2/jordan.jpg?w=29&h=34&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4LyCQIOujOjDJDzFjU7aSW/c09849ac8281c32a39dd5d30d58078b2/jordan.jpg?w=58&h=67&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4LyCQIOujOjDJDzFjU7aSW/c09849ac8281c32a39dd5d30d58078b2/jordan.jpg?w=116&h=134&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#d8c8a8","width":58,"height":67}}},{"name":"Julie Agnes Sparks","slug":"julie-agnes-sparks","jobTitle":"Senior Security Engineer, Security Research, Datadog","id":"95387d00-f345-53e4-b163-89443cfea8d0","bio":{"bio":"<p> Julie Agnes Sparks is a Senior Security Engineer in the Security Research organization at Datadog. Julie has previous experience on detection and response teams at Brex and Cloudflare with a focus on how to identify attacks, help the organization stay on top of emerging threats, and mature detection processes. She prioritizes involvement and connection in the security community and mentoring women who are entering the field.</p>"},"image":null},{"name":"Greg Foss","slug":"greg-foss","jobTitle":"Engineering Manager, Threat Detection Engineering, Datadog","id":"060f5c6d-61f5-53b8-b144-1da729bb97cb","bio":{"bio":"<p> Greg Foss is a cybersecurity leader with over 15 years of experience spanning threat research, security operations, and offensive security. As the Engineering Manager of Threat Detection Engineering at Datadog, he leads a team of elite threat hunters and detection engineers, developing cutting-edge defenses against sophisticated cloud-native intrusions by nation-state and criminally motivated adversaries.</p>"},"image":null}],"title":"Datadog and Okta Combine for New Customer Detections","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":{"summary":"Okta and Datadog have collaborated to enhance the Out-of-the-Box (OotB) detection capabilities of Datadog’s Cloud SIEM by including rules from the Okta Security Detection Catalog. These rules have been engineered to enable the identification of identity-related threats with minimal configuration. "},"body":{"raw":"{\"data\":{},\"content\":[{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Comprehensive monitoring of identity activity is crucial to the security of any organization. A compromised identity can lead to widespread data breaches and significant financial loss. However, the challenge for many security teams is that effective detection engineering has historically required significant manual effort and dedicated resources. Analysts are required to observe techniques used for identity-based attacks and then write, test and optimize detections for their Security Information Event Management (SIEM) or logging platforms.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Okta’s Cyber Defense team is at the forefront of identity attacks, observing and developing new detections and reducing customers’ operational burden. This work is also powering security product innovations such as Okta \",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://www-okta.login.adsbillinghub.com/en-au/products/identity-threat-protection/\"},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"underline\"}],\"value\":\"Identity Threat Protection\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[],\"value\":\" (ITP), which continually assesses user sessions using the \",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://www-okta.login.adsbillinghub.com/blog/identity-security/oktas-commitment-to-caep-and-ssf-pioneering-secure-interoperable-identity-standards/\"},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"underline\"}],\"value\":\"Continuous Access Evaluation Profile (CAEP)\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[],\"value\":\" standard and enabling new security automation capabilities. \",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"To further assist Okta customers, in May 2025 we took a foundational step and released the \",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://github.com/okta/customer-detections\"},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"underline\"}],\"value\":\"Okta Security Detection Catalog\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[],\"value\":\", a repository of detection queries and preventative configurations designed to empower Okta customers to proactively identify and prevent potential security threats.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Today we are announcing a collaboration with the \",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://securitylabs.datadoghq.com/\"},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"underline\"}],\"value\":\"Security Research team at Datadog\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[],\"value\":\" to make it even easier to implement these detections.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Together, we have enhanced the Out-of-the-Box (OotB) detection capabilities of \",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://www.datadoghq.com/product/cloud-siem/\"},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"underline\"}],\"value\":\"Datadog’s Cloud SIEM\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[],\"value\":\" by including rules from the Okta Security Detection Catalog. These rules have been engineered to enable the identification of identity-related threats with minimal configuration. \",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Crucially, this partnership is bi-directional. The enhanced logic developed by Datadog’s own Security Research team during this collaboration has been contributed back to the public \",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://github.com/okta/customer-detections\"},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"underline\"}],\"value\":\"Okta Security Detection Catalog\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[],\"value\":\", ensuring that the broader security community benefits from this joint research regardless of their tooling. \",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"This integration goes beyond simple logging; it utilizes signal correlation, combining multiple signals from Okta’s system log, Identity Threat Protection, and \",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/en-us/content/topics/security/threat-insight/about-threatinsight.htm\"},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"underline\"}],\"value\":\"ThreatInsights\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[],\"value\":\", to provide higher fidelity detections and reduce false positives.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Getting Started\",\"nodeType\":\"text\"}],\"nodeType\":\"heading-2\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"These new detection rules are available now in Datadog Cloud SIEM, with plans to add new rules over time. Developed in collaboration between the Okta Detection and Response team and Datadog Security Engineers, these rules can be configured and run directly within the Datadog platform for any organization that ingests Okta System Log events.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"For those who are not Datadog customers, we have ensured this collaboration benefits the wider community as well. All foundational logic developed during this partnership has been contributed back to the public Okta Security Detection Catalog. This allows security teams using other SIEM platforms to review, adapt, and deploy these high-value detections within their own environments.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"content\":[{\"data\":{},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"Preview The New Detections:\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\" View Datadog’s Out-of-the-Box Default Rules for Okta here.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"}],\"nodeType\":\"list-item\"},{\"data\":{},\"content\":[{\"data\":{},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"Ingest Okta System Logs:\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\" Follow the instructions here to integrate Okta with your Datadog instance.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"}],\"nodeType\":\"list-item\"},{\"data\":{},\"content\":[{\"data\":{},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"Enable the New Detections:\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\" Ensure the Okta customer detections are active within your Datadog environment.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"}],\"nodeType\":\"list-item\"},{\"data\":{},\"content\":[{\"data\":{},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"Review Alerting Policies:\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\" Customize alerting thresholds and notification channels to fit your organisation's needs.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"}],\"nodeType\":\"list-item\"}],\"nodeType\":\"unordered-list\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"New Detection Rule Highlights\",\"nodeType\":\"text\"}],\"nodeType\":\"heading-2\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"To give you an idea of the capabilities now available, here are a few examples of the new rules and the specific identity threats they help detect:\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"Okta OAuth mismatched URI\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\" \\n\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"Tactic:\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\" Credential Access\\n\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"Technique:\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\" Steal Application Access Token (\",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://attack.mitre.org/techniques/T1528/\"},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"underline\"}],\"value\":\"T1528\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[],\"value\":\")\\n\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"Description: \",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\"This rule monitors failed OAuth access token grant activity where the provided reason is \",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[{\"type\":\"italic\"}],\"value\":\"mismatched_redirect_uri.\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\" Alert severity is increased if Okta’s provided \\\"threat suspected\\\" field evaluates to true. This is critical for detecting adversaries leveraging phishing infrastructure; they may attempt to compromise users by issuing redirects to a phishing domain during the OAuth flow.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"Okta policy rule modified to downgrade MFA\\nTactic: \",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\"Defense Evasion\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"\\nTechnique: \",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\"Modify Authentication Process: Multi-Factor Authentication (\",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://attack.mitre.org/techniques/T1556/006/\"},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"underline\"}],\"value\":\"T1556.006\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[],\"value\":\")\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"\\nDescription: \",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\"This rule monitors when an administrator updates an Okta policy rule (indicated by a policy.rule.update event). When the previous policy logic did not contain 1FA but the updated logic does, an alert will trigger. A higher‑severity alert is generated when the source IP address has been classified as suspicious or malicious. Downgrading multi-factor authentication (MFA) requirements reduces security posture and can be used by an attacker to maintain persistence or facilitate account compromise via social engineering.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"Okta phone number assigned to multiple users\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\" \\n\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"Tactic:\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\" Persistence\\n\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"Technique:\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\" Account Manipulation: Device Registration (\",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://attack.mitre.org/techniques/T1098/005/\"},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"underline\"}],\"value\":\"T1098.005\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[],\"value\":\")\\n\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"Description: \",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\"This rule monitors phone number enrollment verification by SMS within a short period. The reuse of a single phone number across multiple user accounts is a strong indicator of an attacker trying to maintain persistence or enroll a controlled device across compromised accounts.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"Okta temporary password granted and MFA reset\\nTactic: \",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\"Persistence\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"\\nTechnique: \",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\"Account Manipulation (\",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://attack.mitre.org/techniques/T1098/\"},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"underline\"}],\"value\":\"T1098\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[],\"value\":\") \\n\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\"Description: \",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\"This rule monitors Okta account recovery and factor administration events, alerting when both user.account.expire_password and user.mfa.factor.reset_all succeed for the same account. When an administrator expires a user password, they may generate a temporary password which an attacker can use to login and set their own. If factors are also reset, the attacker can register their own MFA devices. This behavior is a strong signal of account takeover, especially when stemming from uncommon locations or hosting provider IP addresses.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Conclusion\",\"nodeType\":\"text\"}],\"nodeType\":\"heading-2\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"In a decentralized cloud environment, identity sprawl can quickly lead to chaos. Okta brings structure to this landscape by centralizing access, provisioning, and governance across an organization’s entire application stack.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Because Okta is the chosen platform for protecting access to these critical resources, administrative access to Okta must be treated as highly privileged. Just as you monitor your most sensitive infrastructure, monitoring the platform that governs access to it is a fundamental security practice.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Together, Okta and Datadog enable organizations to safeguard this centralized control point, arming security teams with the high-fidelity signals and pre-built intelligence needed to detect and respond to threats at scale in real-time.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Resources:\",\"nodeType\":\"text\"}],\"nodeType\":\"heading-2\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Okta Security Detection Catalog:\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\" \",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://github.com/okta/customer-detections\"},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"underline\"},{\"type\":\"bold\"}],\"value\":\"https://github.com/okta/customer-detections\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\" \\n\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\"Okta Identity Threat Protection:\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\" \",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://www-okta.login.adsbillinghub.com/en-au/products/identity-threat-protection/\"},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"underline\"},{\"type\":\"bold\"}],\"value\":\"https://www-okta.login.adsbillinghub.com/en-au/products/identity-threat-protection/\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\" \\n\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[],\"value\":\"Datadog Default Rules for Okta:\",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\" \",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://docs.datadoghq.com/security/default_rules/?search=okta\"},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"underline\"},{\"type\":\"bold\"}],\"value\":\"https://docs.datadoghq.com/security/default_rules/?search=okta\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[],\"value\":\"\\nDatadog Cloud SIEM: \",\"nodeType\":\"text\"},{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\" \",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://www.datadoghq.com/product/cloud-siem/\"},\"content\":[{\"data\":{},\"marks\":[{\"type\":\"underline\"},{\"type\":\"bold\"}],\"value\":\"https://www.datadoghq.com/product/cloud-siem/\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[{\"type\":\"bold\"}],\"value\":\" \",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"}],\"nodeType\":\"document\"}"}},{"updatedAt":"2026-02-11T04:22:55.937Z","slug":"/articles/2026/02/st-detecting-openclaw","node_locale":"en","date":"2026-02-11T00:00","secAuthor":[{"name":"Okta","slug":"okta","jobTitle":"","id":"1e934185-d220-5cf6-915f-afe21369ab6b","bio":{"bio":""},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=15&h=15&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=29&h=29&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=116&h=116&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=15&h=15&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=29&h=29&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=58&h=58&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2mSwf13fQ5aH31DZNddqtd/0855adabe0c07ddc9ceaa460ebd1d935/Okta_Aura_CMYK_Black.jpg?w=116&h=116&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#f8f8f8","width":58,"height":58}}}],"title":"Detecting OpenClaw at Sign-In","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":{"summary":"Okta Verify has a neat trick under the hood that can help you identify the use of personal AI assistants and other \"not just yet\" software."},"body":{"raw":"{\"data\":{},\"content\":[{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"If like most organizations you are still coming to grips with the implications of what personal AI assistants like OpenClaw mean for your security posture, you might need to at least identify where they are being used.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Turns out Okta Verify can do that for you.\\n\\nAdvanced posture checks is an early access feature in the Okta Verify client that gives administrators the ability to  write custom rules that evaluate device hygiene at sign-in. \",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Administrators can write simple osquery checks that evaluate, for example:\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"content\":[{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Persistant services and installed apps\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"}],\"nodeType\":\"list-item\"},{\"data\":{},\"content\":[{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Currently running processes\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"}],\"nodeType\":\"list-item\"},{\"data\":{},\"content\":[{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"The presence of configuration files and binaries in common installation paths.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"}],\"nodeType\":\"list-item\"},{\"data\":{},\"content\":[{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Installs of Homebrew or npm packages\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"}],\"nodeType\":\"list-item\"},{\"data\":{},\"content\":[{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Listening ports\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"}],\"nodeType\":\"list-item\"},{\"data\":{},\"content\":[{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"Docker images and artifacts \",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"}],\"nodeType\":\"list-item\"}],\"nodeType\":\"unordered-list\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"There are multiple ways you can apply this to something like OpenClaw, and lots of good reasons to do it.\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"},{\"data\":{},\"content\":[{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"A personal AI assistant doesn’t need to be malicious or vulnerable for you to want to wrap some policy around its use on corporate-issued devices. \",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"}],\"nodeType\":\"blockquote\"},{\"data\":{},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"For a list of sample queries relevant to OpenClaw, head over to the Okta Threat Intelligence blog:\\n\",\"nodeType\":\"text\"},{\"data\":{\"uri\":\"https://www-okta.login.adsbillinghub.com/blog/threat-intelligence/detecting-openclaw-advanced-posture-checks/\"},\"content\":[{\"data\":{},\"marks\":[],\"value\":\"https://www-okta.login.adsbillinghub.com/blog/threat-intelligence/detecting-openclaw-advanced-posture-checks/\",\"nodeType\":\"text\"}],\"nodeType\":\"hyperlink\"},{\"data\":{},\"marks\":[],\"value\":\"\",\"nodeType\":\"text\"}],\"nodeType\":\"paragraph\"}],\"nodeType\":\"document\"}"}}]}},"pageContext":{"limit":10,"skip":0,"numBlogPages":10,"currentPage":1}},
    "staticQueryHashes": []}