Passkeys Go Multi-Device

WhatsApp has quietly changed how you prove who you are when logging in. The Meta-owned messaging app announced Tuesday that it now supports multiple passkeys per account — a shift that matters more than it might sound.

Until now, you were stuck with a single passkey tied to one device. That was a headache for anyone juggling an iPhone and an Android phone, or switching devices regularly. Now you can register more than one passkey, so logging in from either platform works without friction.

The company says over 1 billion people already use a passkey to access their WhatsApp account. That’s a staggering number, and it shows how quickly the industry has moved away from traditional SMS-based authentication.

For those unfamiliar: a passkey replaces passwords with a cryptographic key stored on your device. You verify with your fingerprint, face scan, or PIN. No more typing in codes from text messages that can be intercepted or phished.

Two-Step Verification Grows Up

The bigger change is in two-step verification (2SV). Previously, WhatsApp locked your account behind a six-digit PIN. Simple, sure, but also predictable. Six digits offer only a million combinations — trivial for a determined attacker to brute-force.

That PIN is now being upgraded to a full password. You can make it longer, and it can include alphanumeric characters and special symbols. In other words, you can finally use something like Tr0ub4dor&3 instead of 123456.

This is a meaningful upgrade. A longer password with mixed characters exponentially increases the difficulty of guessing or cracking it. It also aligns WhatsApp with best practices that security professionals have been pushing for years.

One thing to note: this doesn’t replace your passkey. It’s an additional layer. If someone gets your phone, or you lose it, the 2SV password is still there as a backstop when you re-register your number.

Caller Context: A New Weapon Against Spam

The third feature is Android-only for now, and it’s aimed squarely at the scourge of spam calls.

When an Android user receives a call from someone not in their contacts, WhatsApp will now display additional information about the caller. You’ll see their country of origin and whether they share any WhatsApp groups with you. That’s a small detail that can tell you a lot before you pick up.

If a call comes from a random number in a different country, and you have no mutual groups, you know it’s probably not worth answering. But if you see that the caller is in a group with you — say, a neighborhood association or a work channel — it’s more likely to be legitimate.

“Scammers rely on urgency – now you can take a beat with some more info before answering,” WhatsApp said in its announcement.

That’s the right framing. Spam callers thrive on the moment of panic when the phone rings. A second of context can deflate that urgency entirely.

Building on Scam Alert

This update lands just a couple of weeks after WhatsApp rolled out WhatsApp Scam Alert, an optional feature that uses AI to flag suspicious messages from non-contacts. Together, the two features form a more coherent defense against social engineering.

Scam Alert works by analyzing incoming messages for patterns commonly used in scams — urgency, requests for money, suspicious links — and then warning you before you engage. Caller context extends that protection to voice calls.

It’s a sensible one-two punch. Messaging scams and voice scams often come from the same criminal networks. Blocking both channels makes the platform a harder target.

What This Means for Your Privacy

Some users might wonder whether caller context compromises privacy. Showing your country and mutual groups to a stranger who calls you — isn’t that a data leak?

Not quite. The information is shown only to the person receiving the call, and only when the caller is not in their contacts. It’s a one-way disclosure designed to help the recipient make an informed decision. Your phone number remains hidden unless you choose to reveal it.

WhatsApp has also been pushing WhatsApp username feature to bolster phone number privacy, so users can interact without exposing their digits at all. The two features complement each other: usernames hide your number, and caller context gives you more signal about who’s on the other end.

Security Beyond the Headlines

It’s worth remembering that WhatsApp’s security posture has had its ups and downs. Earlier this year, the company disclosed WhatsApp file spoofing and URL scheme vulnerabilities. Those were patched, but they serve as a reminder that no platform is bulletproof.

The new passkey and 2SV features are steps in the right direction, but they only work if you actually enable them. Passkeys are on by default in many cases, but the 2SV password — the upgrade from the old PIN — requires you to set it up.

Here’s what you should do right now:

• Open WhatsApp Settings and check your passkey registration. If you use multiple devices, register a passkey on each one.
• Update your two-step verification to a full password. Make it long, unique, and not reused anywhere else.
• Turn on Scam Alert if you haven’t already. It’s optional, but it’s free protection.
• If you’re on Android, pay attention to the new caller context screen. It could save you from a scam call.

Security is a process, not a product. WhatsApp’s latest update gives you better tools — but the final layer of protection is still you.

The Patch Is a Confession

Every patch is a confession. The moment a vendor ships a security fix, the diff between the old code and the new code tells anyone watching exactly what was broken and where. Turn that diff back into a working exploit, and you can hit every system that hasn’t updated yet.

This is N-day exploitation, and it’s always been a race. The vendor patches, the clock starts, and defenders try to deploy before attackers reverse-engineer the fix. But here’s the uncomfortable truth: the race is getting shorter. What used to be an N-day window—days of relative safety—is now shrinking to N-hour. Sometimes even N-minute.

Why the Window Is Collapsing

Attackers aren’t waiting around. Automated tooling can now analyze a patch and produce a working exploit in hours, not weeks. The barrier to entry has dropped dramatically. You don’t need to be a reverse-engineering wizard anymore; you just need the right scripts and a bit of patience.

Meanwhile, the average enterprise takes weeks to patch critical systems. Not because teams are lazy—but because patching production environments is risky. A bad update can break applications, cause downtime, and cost more than the vulnerability itself. So defenders are stuck between a rock and a hard place: patch fast and risk stability, or patch slow and risk compromise.

It’s a lose-lose scenario, and it’s only getting worse.

The False Comfort of ‘We Patch Within 48 Hours’

Many security teams pride themselves on patching within 48 hours. That’s admirable, but it’s not enough anymore. If the exploit is weaponized within six hours of the patch release, your 48-hour SLA leaves you exposed for a full two days.

Let’s put some numbers on this. Research from the Kaspersky threat research team shows that the median time between a patch release and a working exploit appearing in the wild has dropped to under 24 hours for some high-profile vulnerabilities. For critical CVEs, that window can be even tighter.

The Problem With Patching Everything

You can’t just patch everything faster. That’s a recipe for chaos. Instead, you need to triage. Not all vulnerabilities are created equal, and not all systems are equally exposed. A vulnerability in an internet-facing web server is a much bigger deal than one in an internal tool with limited access.

So what do you do? You prioritize. You focus on the vulnerabilities that are both exploitable and reachable. You patch those first, even if it means breaking your normal change management process.

What Actually Works: A Three-Layer Defense

Relying on patch speed alone is a losing strategy. Here’s what security teams should be doing instead.

• Know your attack surface. You can’t protect what you don’t know about. Maintain an up-to-date asset inventory, and understand which systems are exposed to the internet, which hold sensitive data, and which are critical to operations.
• Deploy virtual patching. Web application firewalls (WAFs) and intrusion prevention systems (IPS) can block exploit attempts even before you’ve applied the vendor patch. This buys you time without the risk of a hasty update.
• Assume breach. Even with perfect patching, something will slip through. Have detection and response capabilities that can catch an attacker who’s already inside your network. The faster you spot them, the less damage they can do.

These layers don’t replace patching—they augment it. They give you the breathing room to patch properly, without the panic of an imminent exploit.

Automation: Your Only Real Advantage

Manual patching is dead. There’s simply too much to do, and the window is too short. You need automation that can deploy critical patches across your environment in minutes, not days.

But automation isn’t a silver bullet either. You still need humans to make the tough calls about what to patch first, when to break the change window, and how to handle exceptions. The key is to combine machine speed with human judgment.

And don’t forget the basics. Segment your network so a compromise in one area doesn’t spread everywhere. Enforce least-privilege access so even if an attacker gets in, they can’t move laterally. These are old-school practices, but they remain incredibly effective.

The Bottom Line: Plan for the Worst

N-day exploitation is becoming N-hour exploitation. That’s the new reality, and it’s not going to reverse. The attackers have the advantage of speed, and they’re not giving it up.

So stop pretending that a faster patching process will save you. It won’t. Instead, build a defense that assumes you’ll be hit, and focuses on reducing the blast radius. Patch what you can, as fast as you can, but never rely on it as your only line of defense.

The race is getting shorter, but you can still win it—if you change the game.

Related Reading

For more on how attackers operate and how to defend against them, check out zero-day exploit prevention strategies and practical incident response playbooks.

Attackers Are Already Knocking on Your Login Page

If your WordPress site runs the MiniOrange SAML 2.0 Single Sign-On plugin, there’s a good chance someone has already tried to break in. Security researchers have confirmed that threat actors are actively exploiting two critical authentication bypass vulnerabilities in the plugin, and the window to protect yourself is closing fast.

These aren’t theoretical flaws. They’re being used right now to log in as any user on a vulnerable website — including the administrator. The two vulnerabilities, tracked as CVE-2026-61979 and CVE-2026-15981, were discovered and analyzed by security firm Patchstack in collaboration with DigitalOcean.

Both issues affect the MiniOrange SAML 2.0 SSO plugin, a popular tool that lets WordPress site owners implement single sign-on for their users. The free version alone is installed on more than 10,000 websites, and the paid and enterprise editions add thousands more to that number.

What Makes These MiniOrange Plugin Vulnerabilities So Dangerous?

These are not your average plugin bugs. Both CVE-2026-61979 and CVE-2026-15981 are classified as authentication bypass vulnerabilities. In plain English: an attacker can trick the plugin into thinking they’re someone else. No password needed. No brute-force guessing. Just a crafted request, and they’re in.

Once an attacker authenticates as an administrator, they can do just about anything. Install backdoors, deface the site, steal user data, or use the compromised server as a launchpad for further attacks. For a business, that’s a full network compromise waiting to happen.

Patchstack described the current exploitation attempts as “opportunistic attacks” rather than a targeted campaign. That distinction matters. The attackers aren’t singling out specific companies or industries. They’re scanning the internet and throwing the exploit at every site running the plugin, hoping someone hasn’t patched yet.

Who’s Affected by the MiniOrange SSO Plugin Flaws?

All versions of the MiniOrange SAML 2.0 SSO plugin released before the patches are affected. That includes the free edition, which is the most widely deployed, as well as the various paid tiers and enterprise versions.

The plugin’s popularity makes it an attractive target. Single sign-on is a critical piece of infrastructure for many organizations, and a vulnerability in that component can undermine the security of every connected service.

The Silent Patch Problem: Why Users Are Left in the Dark

Here’s where things get frustrating. The developer has released patches for all affected versions, which is good. But the way the patches were rolled out has left many users completely unaware of the danger.

For the free edition, the fix is included in version 5.4.5. But here’s the catch: the advisory lists it as a bugfix, not a security patch. If you’re not actively following security news, you’d have no reason to rush this update. Patchstack warns that this kind of “silent patch” is dangerous because it gives defenders no urgency while attackers are already weaponizing the exploit.

The situation is even worse for paid editions. Users haven’t received any direct notification about the vulnerabilities. To make matters worse, the paid versions use a different versioning system, so it’s genuinely difficult to tell whether your installation is patched or not. The only way to be sure is to manually update the plugin.

“Whoever is running this appears to be throwing the exploit at every site with the plugin installed without checking which edition or version is behind it,” Patchstack warned. “This is exactly the behavior that makes the silent-patch situation dangerous. The attacker does not need to know which edition you run, you do.”

How to Protect Your WordPress Site Right Now

If you use the MiniOrange SAML 2.0 SSO plugin, don’t wait. Here’s what you need to do immediately:

• Update the free plugin to version 5.4.5 or later — this is the minimum requirement to close the authentication bypass.
• Manually check for updates on paid editions — don’t rely on automatic notifications, since they may not have been sent.
• Review your user accounts — look for any new admin accounts you didn’t create, a common sign of a successful exploit.
• Check your server logs — look for unusual login activity or authentication requests from unfamiliar IP addresses.
• Consider a Web Application Firewall (WAF) — a good WAF can block exploit attempts even if you haven’t patched yet.

If you’re running a website that relies on single sign-on, this should serve as a wake-up call. The same advice applies to other WordPress security issues, like the recent WordPress form plugin vulnerability that exposed hundreds of thousands of sites. The pattern is always the same: a popular plugin, a critical flaw, and a race between attackers and defenders.

What This Means for the WordPress Ecosystem

This incident highlights a broader problem in the WordPress ecosystem. Plugins are the backbone of the platform, but they’re also the primary attack surface. When a plugin developer silently patches a critical vulnerability, they shift the burden of security onto the site owner — who often has no idea there’s a problem.

SecurityWeek has reached out to MiniOrange for comment on the silent patch situation and will update this article if the company responds.

In the meantime, the message from researchers is clear: patch now, verify your users, and don’t assume your plugin updates are protecting you. The attackers certainly aren’t waiting.

For more context on how these attacks unfold, it’s worth reviewing how WordPress remote code execution vulnerabilities have been exploited in the past. The playbook is always similar, and the stakes are always high.