On October 17, 2026, a researcher reported that the private keys of eight intermediate eMudhra certificate authorities were generated with insufficient entropy and could be derived from their public certificates. Read on for Okta's response.

Okta's response to the industry-wide third-party PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

Okta used early access to GPT 5.5 Cyber Preview and Anthropic's Mythos Preview to hunt vulnerabilities in our own codebase. The big lesson: agents alone generate noisy leads, but pairing them with human experts who steer investigations produces real, high-confidence findings, plus a reusable pipeline architecture for future AI-driven security work.

The Okta Red Team discovered a Denial of Service (DoS) vulnerability in HTTP/2 Flow Control.

The Okta Red Team discovered HollowByte, a Denial of Service (DoS) vulnerability in OpenSSL.

Okta and Datadog have collaborated to enhance the Out-of-the-Box (OotB) detection capabilities of Datadog’s Cloud SIEM by including rules from the Okta Security Detection Catalog. These rules have been engineered to enable the identification of identity-related threats with minimal configuration.

Okta Verify has a neat trick under the hood that can help you identify the use of personal AI assistants and other "not just yet" software.

Version 1.1 of the Okta Security Technical Implementation Guide (STIG) provides U.S. government agencies additional hardening recommendations related to network security and non-human identities.

Okta and its customers are benefitting from "pooled" security audits.

Temporary Access Codes provide an opportunity to constrain the ability of help desk staff to reset user passwords and MFA factors.