Cybersecurity daily — 30 October 2026: verify enforcement beyond configuration
Clerk adds passkeys as a second factor; an older PDF MCP authentication flaw enters the advisory database. Verify enforcement, not just settings and logs.
Текст статьи на этом языке недоступен; показывается английский.
Window: 29 October 2026 08:00 to 30 October 2026 08:00 JST. One product update and one older vulnerability newly added to the advisory database. Clerk dates its announcement 29 October; its exact publication time relative to the cutoff is unverified. Following Brotli patch verification, the focus is whether configured safeguards actually operate on the request path.
## 1. Clerk: passkeys as a second factor
On 29 October Clerk announced passkeys as a second factor after password, social or other supported sign-in, including reverification. Registering a passkey does not itself enable MFA. This is a Clerk authentication-flow update, not finalization of a new WebAuthn standard.
Architecture implications: test first factor, second factor and recovery separately. Web requirements include clerk-js 6.40.0 and ui 1.41.0 or newer; custom flows must handle passkey in supportedSecondFactors. Older apps and web instances may need configuration or update opt-in. Verify the production instance and actual sign-in rather than assuming an SDK update completed adoption. Adding passkeys does not strengthen an SMS fallback that remains available.
Primary source: [Clerk changelog, 29 October](https://clerk.com/changelog/2026-10-29-passkey-second-factor). This is provider documentation, not independent measurement of end-to-end authentication strength.
## 2. PDF MCP: an authentication-enabled log is not enforcement
CVE-2026-62264 entered the GitHub Advisory Database on 29 October at 16:34 UTC (30 October 01:34 JST), but the maintainer published the advisory on 25 June. HTTP mode in @sylphx/pdf-reader-mcp >=2.2.0 and <3.0.1 loaded MCP_API_KEY and logged authentication as enabled without validating the request header. Reachable clients could access PDFs readable by the process. Default stdio transport is unaffected.
Upgrade affected deployments to 3.0.1 or newer and verify that missing or wrong keys receive 401. Where immediate upgrade is impossible, stop HTTP exposure, enforce authentication at a proxy and/or restrict readable directories. Loopback binding is not a substitute for authorization. The reviewed maintainer report does not state in-the-wild exploitation; silence is not proof of absence.
Primary sources: [Maintainer advisory, 25 June](https://github.com/SylphxAI/anymd/security/advisories/GHSA-q344-5v34-gm84) / [Database entry, 29 October UTC / 30 October JST](https://github.com/advisories/GHSA-q344-5v34-gm84). This is not presented as a newly released fix.
## Decisions
Act now: check affected MCP versions/HTTP listeners and Clerk MFA policy. Validate: failed authentication refusal and combinations of sign-in, reverification and recovery. Watch: no new primary-source development changing TEE/isolation architecture decisions was verified. Continue distinguishing Brotli rollout targets from active patched runtimes.