Standard
PBKDF2 is a standard key derivation function that repeatedly applies HMAC-SHA256 to a password to produce cryptographic keys, resisting brute-force attacks.
Django 6.1 raised its default PBKDF2 iteration count from 1.2M to 1.5M, adding about 50 to 90ms of CPU per login in a dev.to benchmark. The same tests show each stored hash rewritten on its owner's next login, including hashes deliberately set stronger than the new default.
Reality
The FBI and Secret Service warned Tuesday that FortiBleed is still scanning Fortinet firewalls and SSL VPN gateways with 86,644 stolen credentials. Patching and a password reset will not clear it.
Perspective Coverage
10 publishersReality
Australia's ACSC told Fortinet users on 18 June to rotate all admin and VPN credentials immediately, the first of six steps in its alert. On hosted or co-managed gateways, each step first needs someone to settle who holds the accounts and who has to act.
Reality
ACSC flagged credential attacks on Fortinet gateways with no CVE or version list, so scans counting 983,996 FortiGate assets are the sizing fallback. A certificate-key filter narrows the count to 254,801 but cannot show which admin logins face the internet.
Reality
Adversa says it hid data-exfiltration instructions in AES-256-GCM ciphertext and let Grok decrypt them in its own Python sandbox. The plaintext version of the same attack was refused.
Reality
A developer's nightly job reported success for over a year without once proving the archive could be opened. The first restore drill found most of the signing keys were never collected.
Reality