The common thread in this week's cybersecurity news is identity. A breached certificate authority, service-desk social engineering, a venture raise aimed at the sector's AI-driven growth, and a switch zero-day used to steal credentials all describe the same failure mode: trust placed in identities that were never designed to withstand determined attackers. The lesson for US technology companies is that perimeter defense keeps losing to a quieter problem - proving that a person, device, or system is who it claims to be.
The certificate authority as a trust chokepoint
DigiCert's disclosure, reported by BleepingComputer, is the most structural of the four stories. A server migration mistakenly exposed an internal business system to the internet, and unauthorized parties reached customer information and identity documents. The details matter less than the category: a company whose business is vouching for the identity of websites and devices lost control of its own internal exposure through an operational mistake. Certificate authorities sit at the center of machine identity on the web, and any organization relying on their certificates inherits a dependency it cannot audit from the outside. For US enterprises, the practical question is not whether DigiCert remediates, but how many other migrations have quietly opened internal systems that hold identity documents - the raw material for impersonation and account takeover.
Service desks are the bypass route around MFA
Specops Software's analysis, also via BleepingComputer, describes the attack path that makes the DigiCert exposure worse. Attackers impersonate employees to IT service desks and persuade staff to reset passwords or register new authentication devices. Multi-factor authentication is only as strong as the recovery process behind it, and a help-desk agent under time pressure is a soft target. This is not a theoretical risk; it is the standard way around controls that otherwise look robust on a compliance checklist. US companies have spent years rolling out MFA, and the return on that spending erodes every time a reset is granted on the strength of a caller's voice and a few personal details.
Credentials remain the prize in network attacks
Zyxel's patch for a zero-day in its GS1900 series switches, per BleepingComputer, closes a vulnerability exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. The scale is modest by ransomware standards, but the target is instructive. Network switches are infrastructure - unglamorous, widely deployed, and often outside the view of security teams focused on endpoints and cloud accounts. Configuration files and credentials pulled from that layer give attackers a foothold that is hard to detect and easy to reuse. For US buyers of networking gear, the story is a reminder that the security of the network fabric depends on vendors shipping patches for devices that may sit unmanaged for years.
