Bitrix24 Adds Email One-Time Codes as New Two-Factor Authentication Option in Cloud Version
Bitrix24 has expanded its two-factor authentication capabilities in the cloud edition by adding support for one-time codes delivered via email. This new method joins existing options that include codes from authenticator applications, push notifications, and SMS messages.
The feature is designed to assist organizations where staff members, for various reasons, do not use separate 2FA apps or may have inconsistent access to mobile phones for receiving verification texts. By providing an alternative channel, Bitrix24 aims to increase adoption of stronger authentication without forcing every user onto a single verification method.
Two-factor authentication adds an extra verification layer beyond the standard username and password combination. Even if attackers obtain credentials through phishing emails, data breaches, or social engineering calls impersonating technical support, they still need the additional code to gain entry.
Nevertheless, the company cautions that relying on email for the second factor requires careful consideration. If an attacker has already compromised the user’s mailbox, this method offers little protection. For high-value accounts, Bitrix24 therefore recommends using authenticator applications or device-based confirmations instead.
The same email-code functionality is scheduled to appear in the on-premise, boxed version of Bitrix24 in the near future. Additionally, the vendor plans to make two-factor authentication mandatory for all organizations subscribed to the Professional and Enterprise cloud tariffs.
Related articles
Positive Technologies Adds Unified Console to PT X for Centralized Incident and Asset Management
Positive Technologies has introduced a single console within its PT X platform that combines incident management, asset control, and security posture assessment. Customers can now monitor attack attempts around the clock, view possible causes, track response status, and prioritize events without switching between multiple interfaces. The system lets organizations predefine which assets Positive Technologies may act upon and choose between manual customer response, automatic PT X actions, or approval-based workflows, with full audit reports generated afterward. A dedicated dashboard highlights coverage gaps by showing hosts protected by MaxPatrol EDR and flagging assets without agents installed. Machine learning capabilities have been expanded through a combination of large language models and classical ML to accelerate early attack detection and automate handling of low- and medium-severity incidents. Additional features include external perimeter analysis that reveals internet-facing resources from an attacker’s perspective and a bug-bounty-style cyber testing program that rewards researchers for identifying unacceptable events.
Meta Allows Over 50 Paid Ads Sexualizing Minors to Run on Facebook, Instagram, Messenger and Threads
Meta's advertising moderation systems failed to detect and remove more than 50 paid advertisements containing sexualized images of minors across its major platforms. The ads, some generated using generative AI tools, appeared on Facebook, Instagram, Messenger, and Threads over a nine-month period. Researchers at Tech Transparency Project identified that several of these advertisements remained active into early August. The content was not organic user posts but commercially purchased ads that bypassed Meta's review processes. The incident highlights ongoing weaknesses in automated and human moderation of paid promotional material involving prohibited themes. Tech Transparency Project emphasized that the scale and persistence of the ads point to systemic gaps in Meta's enforcement mechanisms for child safety policies.
Yandex Go Develops Custom DSL to Handle Complex Dynamic Ride Pricing Logic
Yandex Go has moved its ride pricing algorithm out of the main service code into a dedicated domain-specific language to avoid frequent deployments and tangled conditional logic. The pricing system accounts for geozones, demand surges, discounts, toll roads, extra stops, and special requirements such as transporting pets or sports equipment. Parameters are collected in parallel, dependencies are modeled as a graph, and requests run asynchronously on userver so that a single slow source does not break the entire calculation. Because rules change on average twice a week, keeping the logic in C++ would require rebuilding and redeploying 50 pods for roughly 40 minutes each time. The new DSL supports conditions, functions, immutable values, and fold operations instead of loops; rules are chained so each step receives the current price and metadata and returns an updated result. ANTLR 4 defines the grammar while the Z3 verifier ensures programs cannot produce invalid prices. The platform is already used by Yandex Taxi, Delivery, and the electric-vehicle charging service.
Third Edition of The Ultimate Kali Linux Book Released with Expanded OSINT and Pentesting Coverage
The publishing house Piter has released the third international edition of The Ultimate Kali Linux Book by Glen Singh. The updated volume provides comprehensive guidance on using Nmap, Metasploit, Aircrack-ng and Empire for ethical hacking and penetration testing. Significant revisions include a new chapter on OSINT, refreshed practical exercises and clearer descriptions of virtual lab environments. The book targets both beginners and experienced IT professionals seeking to master vulnerability assessment, wireless network testing and web application exploitation. Readers learn to build testing labs, perform reconnaissance, exploit network weaknesses and evaluate corporate infrastructure security. Author Glen Singh holds an MSc and multiple certifications from EC-Council, Cisco and Check Point, bringing real-world Red Team and Blue Team experience to the material.