The problem with trusting tokens

# The problem with trusting tokens It's evening here on Wednesday 2 September 2026, and the wire has been loud. We've seen 396 data breach stories this week alone, which tells you that the "secure by design" movement is still mostly a marketing slide deck. When I look at the CISA KEV additions from today, specifically the JFrog and SonicWall entries, I don't see a failure of encryption. I see a failure of basic logic. I've spent the last few hours going through the mailbag. Here are three that deserve an answer. **Sarah from Des Moines: "I saw the news about the 153 million driver's licenses being sold on the dark web. Does this mean I need to go to the DMV and get a new physical ID card?"** Sarah, please don't spend your afternoon in a government waiting room. The problem isn't the piece of plastic in your wallet; it's the digital scan of it stored on a server. The Nexus service is selling images of IDs, including those of high-profile targets like US Secretary of Defense Pete Hegseth. If an attacker has a high-resolution scan of your license, they aren't going to walk into a bank and pretend to be you—they're going to use it for "synthetic identity fraud." They combine your real ID with a fake address or a different phone number to open credit lines or bypass "Know Your Customer" (KYC) checks on crypto exchanges. The fix isn't a new card; it's freezing your credit and monitoring your accounts. The plastic is irrelevant once the pixels are in the wild. **Marcus from Berlin: "I'm seeing reports about CVE-2026-82329 in JFrog Artifactory allowing 'admin token forgery.' My boss thinks we just need to rotate our keys. Is this a key management issue?"** No, it isn't. This is where I have to be clear: there is a world of difference between a leaked key and a forged token. If you lose your private key, that's a key-management flaw. You left the house keys under the mat. But "token forgery" is a protocol-level failure. To understand this, think of a JSON Web Token (JWT). Normally, a server issues a token signed with a secret key. When you present that token back to the server, it checks the signature to verify it hasn't been tampered with. A forgery flaw usually happens because the server can be tricked into accepting a token that wasn't signed by the legitimate authority—perhaps by switching the algorithm to "none" or using a public key as a symmetric secret. It's like someone showing up to your office with a badge they printed at home, and your security guard letting them in because he forgot how to check the holographic seal. George Boole taught us that logic is binary; it either holds or it doesn't. Here, the logic failed. Because Artifactory sits at the center of the software supply chain, the second-order effect is terrifying. If an attacker forges an admin token, they don't just steal data—they can replace a legitimate library with a backdoored one. Every developer in your company who runs `npm install` or `pip install` tomorrow morning could be pulling a poisoned binary directly from your "trusted" internal repo. **Jim from Chicago: "Our current VPN vendor keeps using the term 'military-grade encryption' to justify their price, but I see two SonicWall SMA 1000 zero-days (CVE-2026-83548 and CVE-2026-83549) hitting the CISA list today. Which one should I trust?"** Trust the CISA list. Ignore any vendor who uses the phrase "military-grade." "Military-grade" is a ghost. It's a term used by salespeople to distract you from the fact that the software was written in a rush and hasn't been audited by anyone who doesn't work for the company. The encryption (the math) is almost always fine—AES isn't the problem here. The problem is the implementation. The SonicWall situation is a classic example of an attack chain. You have one vulnerability that might allow an attacker to probe the system (SSRF) and another that allows them to execute commands on the OS. When you chain these together, "military-grade" encryption doesn't matter because the attacker isn't trying to break the lock—they've found a way to convince the door to open itself. These patches have a federal deadline of September 5. That gives you exactly three days to get this sorted. The actual cost of fixing this? For JFrog and SonicWall, the patch is free. The real cost is the labor hours required for your team to audit every single artifact in your repository to ensure nothing was swapped out while the door was open. That's a bill that can easily run into the tens of thousands of dollars in lost productivity and forensics.