LightNews — News, ranked by scholars

call_user_func

@throwable.bsky.social

📦 faiare/laravel-webauthn 0.3.0

A WebAuthn library for Laravel

🔗 https://github.com/faiare/laravel-webauthn

November 2, 2026 at 3:00 AM

rockslammer

@rockslammer.bsky.social

Public-key authentication, like OpenSSH uses, is the better approach. WebAuthn passkeys bring that security to websites without transmitting passwords. The real obstacle isn't the technology; it's migrating legacy login databases and authentication systems.

November 1, 2026 at 9:07 PM

call_user_func

@throwable.bsky.social

📦 tinect/passkeys 1.2.0

Passkey (WebAuthn) login for storefront customers

🔗 https://github.com/tinect/TinectPasskeys

November 3, 2026 at 7:00 PM

freeCodeCamp.org

@freecodecamp.bsky.social

Passwords are annoying for both users and developers. Luckily, there's another option: passkey authentication. In this article, Roland walks you through setting it up in a project with WebAuthn, Next.js, and NestJS.
www.freecodecamp.org/news/how-to-...

October 30, 2026 at 12:04 PM

call_user_func

@throwable.bsky.social

📦 ez-php/webauthn 2.6.4

WebAuthn / FIDO2 passkey authentication: registration and assertion ceremonies, attestation verification, challenge handling

🔗 https://github.com/ez-php/webauthn

October 30, 2026 at 12:41 AM

call_user_func

@throwable.bsky.social

📦 mattleads/passkeys-bundle v0.1.1

Batteries-included passkeys for Symfony: hybrid passkey/password login flow, conditional-UI autofill, passkey management, last-used tracking and offline recovery codes on top of web-auth/webauthn-s...

🔗 https://github.com/mattleads/passkeys-bundle

November 1, 2026 at 3:11 PM

Deokgon Kim

@deokgonkimdgkim.bsky.social

yubikey webauthn 그냥 쓰면 되는 거라면, 내 사이드 프로젝트에 왕창 쓰고 싶다! ㅋ

October 30, 2026 at 1:48 PM

「色即是空」な「空即是色」blog

@shikisokukusoku.bsky.social

マスターパスワードが消滅する？WebAuthn「PRF拡張」が起こす暗号化革命

https://hubblespacetelescope.blogspot.com/2026/10/webauthnprf_071605606.html

October 31, 2026 at 11:02 AM

The CyberSec Guru

@thecybersecguru.com

phpMyAdmin 5.2.3 WebAuthn 2FA Bypass: How a Missing Signature Check Broke Two-Factor Authentication

A technical breakdown of the phpMyAdmin 5.2.3 WebAuthn bypass. See how the CustomServer fallback skips signature verification,…

https://thecybersecguru.com/exploits/phpmyadmin-webauthn-2fa-bypass/

October 29, 2026 at 2:32 PM

call_user_func

@throwable.bsky.social

📦 tinect/passkeys 1.1.0

Passkey (WebAuthn) login for storefront customers

🔗 https://github.com/tinect/TinectPasskeys

October 30, 2026 at 9:00 AM

call_user_func

@throwable.bsky.social

📦 mkerstner/passkeys v1.1.0

Optional passwordless passkey (WebAuthn/FIDO2) authentication for Roundcube. Each user may enrol one or more passkeys and sign in without a password; the standard username/password login and any 2F...

🔗 https://github.com/mkerstner/roundcube-plugin-passkeys

November 2, 2026 at 5:59 PM

call_user_func

@throwable.bsky.social

📦 tinect/passkeys 1.0.1

Passkey (WebAuthn) login for storefront customers

🔗 https://github.com/tinect/TinectPasskeys

October 29, 2026 at 6:59 PM

call_user_func

@throwable.bsky.social

📦 netresearch/nr-passkeys-be v1.0.3

Passkeys Backend Authentication - Passwordless backend login with Passkeys (WebAuthn/FIDO2): one-click sign-in with Touch ID, Face ID, YubiKey or Windows Hello.

🔗 https://github.com/netresearch/t3x-nr-passkeys-be

November 1, 2026 at 3:18 AM

ひよどりBasist

@visualbasist.bsky.social

秘密鍵を暗号化してCredential IDにしてサーバーに保存するの面白い
www.w3.org/TR/webauthn/...

Web Authentication: An API for accessing Public Key Credentials - Level 4

www.w3.org

October 28, 2026 at 3:25 PM

Commit log of Mastodon

@commitdon.mastodon.social.ap.brid.gy

Update dependency webauthn to v3.5.0 (renovate[bot])
https://github.com/mastodon/mastodon/pull/41323

Update dependency webauthn to v3.5.0 by renovate[bot] · Pull Request #41323 · mastodon/mastodon

This PR contains the following updates: Package Change Age Confidence webauthn (changelog) 3.4.3 → 3.5.0 Release Notes cedarcode/webauthn-ruby (webauthn) v3.5.0 Compare Source Added ...

github.com

October 27, 2026 at 9:49 AM

✨まめも✨ (ダンシャリスト)

@mamemomonga.bsky.social

久々にphpMyAdminの話題をみたら、これだよ。phpMyAdminは昔よくつかったが、油断するとセキュリティーガバガバになるので正直嫌いだ。
x.com/abraxas_null...

abraxas (@abraxas_null) on X

🔐 ⚠️ phpMyAdmin 5.2.3 - 2FA Bypass! 0day++! ⚠️ 🔐 🚨 WebAuthn signatures are parsed but never COSE-verified against credentialPublicKey 🚨 Arbitrary bytes pass the structural checks, so 2FA falls over ...

x.com

October 28, 2026 at 1:19 AM

Commit log of Mastodon

@commitdon.mastodon.social.ap.brid.gy

Add spec for webauthn basics (mjankowski)
https://github.com/mastodon/mastodon/pull/41361

Add spec for webauthn basics by mjankowski · Pull Request #41361 · mastodon/mastodon

In advance of removing @github/webauthn-json package (maybe?!) As a starter here, just two high level specs going through the flow of creating/using a credential.

github.com

October 27, 2026 at 2:08 PM

Wes Fenlon

@wes.readonlymemo.com

It looks like Ghost is moving in a direction to support this via Better Auth but that might not be anytime soon... github.com/TryGhost/Gho...

✨ Added passkey authentication for staff and members by tripox · Pull Request #30368 · TryGhost/Ghost

Summary add WebAuthn passkey registration, credential management, and sign-in for Ghost staff and members keep existing email/password and email-link recovery paths available protect short-lived c...

github.com

October 29, 2026 at 5:44 PM

Best of r/cybersecurity

@cybersecurity.page

New Pass-ta-key research: Google Password Manager's Security Domain Secret can be pulled from CBOR buffers in Chrome process memory. With it, malware on a compromised endpoint can decrypt synced passkeys and forge WebAuthn assertions offline for full account takeover. PoC published.

Pass-ta-key Golden Attack: Stealing Google Password Manager Synced Passkeys for Offline Account Takeover

I just published my research on a new variant of the golden Pass-ta-key attack exploiting an architectural flaw in Google Password Manager (GPM) synced passkeys. Unlike the previous variants that l...

reddit.com

November 3, 2026 at 7:42 PM

CVE Alerts

@cve.skyfleet.blue

CVE-2026-117470 - WebAuthn assertion replay permits second-factor bypass in Psono Server
CVE ID : CVE-2026-117470

Published : Oct. 27, 2026, 5:53 a.m. | 7 minutes ago

Description : Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn ch...

CVE-2026-117470 - WebAuthn assertion replay permits second-factor bypass in Psono Server

Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion could replay that assertion with separate login tokens while the stored challenge remained unchanged, bypassing the …

cvefeed.io

October 27, 2026 at 7:03 AM

Phil “Mr Whiskers” Skents

@phil.thesatelliteoflove.com

I purchased yubikeys for personal use years ago (2019 maybe?) and at the time I really struggled to find a way to use them that wasn't just inconvenient in some way and ultimately they ended up in a drawer.

Fast forward to…

https://starpunk.thesatelliteoflove.com/note/20261101160249

#security

I purchased yubikeys for personal use years ago (2019 maybe?) and at the time I really struggled to find a way to use them that wasn't just inconvenient in some way and ultimately they ended up in a d

I purchased yubikeys for personal use years ago (2019 maybe?) and at the time I really struggled to find a way to use them that wasn't just inconvenient in some way and ultimately they ended up in a drawer. Fast forward to 2026 and it turns out that WebAuthN/Passkeys are the absolutely perfect use

starpunk.thesatelliteoflove.com

November 1, 2026 at 4:02 PM

Promoção, Oferta e Desconto

@pod-oficial.bsky.social

⚠️ Somente 1 em estoque (mais a caminho). ⚠️

🔻 Menor preço já postado 🔻

Chave de Segurança Gertec ePass FIDO, USB-A | Compatível com FIDO2, Passkey ...or R$ 252,55 (-R$ 26,61 (9%) de desconto)

🛒 https://www.amazon.com.br/dp/B0GXCFRMDT?tag=podbsky-20&linkCode=ogi&th=1&psc=1

#publicidade #anuncio