Liquibase, the leader in Database Change Governance, today announced the release of Liquibase Secure 5.1, extending modeled Change Control to Snowflake. With 5.1, enterprises can govern Snowflake control plane changes with the same rigor and automation they already apply to schema evolution, closing a critical gap in data platform security, compliance, and AI readiness. Liquibase Secure 5.1 also expands database platform coverage, including new support for additional cloud and enterprise data stores.
Snowflake has become mission-critical infrastructure for analytics, data products, and AI initiatives. As organizations scale DataOps and internal developer platforms, Snowflake changes are no longer isolated technical updates. They are platform-level changes that impact trust, availability, and every downstream consumer. Yet many of the most consequential changes still happen outside standardized governance, often delivered as scripts with limited visibility, weak enforcement, and evidence that is difficult to assemble when it matters most.
Modeled Change Control for Snowflake
Liquibase Secure 5.1 treats key Snowflake control plane changes as first-class, modeled change types, rather than opaque scripts. That modeling enables precise policy enforcement, object-aware drift detection, and audit-ready evidence at the level where access, movement, and execution are defined.
With Liquibase Secure 5.1, data platform teams can govern Snowflake changes across access and security configuration, data sharing and movement, platform and cost controls, and automated execution, using standardized workflows across environments and teams.
Key outcomes include:
- Stop risky Snowflake control plane changes before they reach production
- Standardize how Snowflake changes are delivered across environments and teams
- Automatically generate audit-ready evidence for every change
- Detect drift and out-of-band updates to governed Snowflake objects
- Recover faster with traceable, reversible changes and tested rollback procedures
This closes a long-standing gap for organizations that govern schema evolution, yet still struggle with over-permission creep, ungoverned data movement, and control plane drift that can undermine security posture and AI initiatives.
Built for DataOps, data products, and AI readiness
As Snowflake increasingly powers feature engineering, model training, and AI-driven decisioning, the blast radius of ungoverned change grows. A single access change can expose sensitive training data. An unreviewed sharing update can expand compliance scope. An execution change can silently alter business-critical logic. Liquibase Secure 5.1 helps data platform teams keep Snowflake predictable, auditable, and reliable as usage scales, without turning governance into a bottleneck.
Expanding database support across Liquibase’s industry-leading coverage
Liquibase Secure continues to deliver broad database coverage across 60+ platforms, from mainframe DB2 to cloud-native data stores. Liquibase Secure 5.1 expands support for Snowflake, Databricks, and MongoDB, and adds new platform support for Couchbase, AWS Keyspaces, DataStax Enterprise, and AlloyDB for Google Cloud. This breadth helps enterprises standardize change governance across heterogeneous environments using a single platform instead of stitching together siloed tools and processes. Teams can apply consistent workflows and generate unified, audit-ready evidence across their database estate, reducing operational overhead while preserving the flexibility to adopt new technologies without rebuilding governance each time.
Enterprise partnership, not just tooling
Liquibase brings more than a decade of frontline experience helping enterprises govern database change at scale. In addition to the platform, Liquibase provides hands-on professional services, a dedicated customer success organization, and ongoing advisory support to help teams operationalize Change Control across their delivery model.
Availability
Liquibase Secure 5.1 is available now. To learn more about Change Control for Snowflake and Database Change Governance, visit liquibase.com.
Hackers Target Microsoft Entra Accounts in Device Code Vishing
Posted in Commentary with tags Microsoft on February 19, 2026 by itnerdIt is being reported hackers are targeting technology, manufacturing, and financial organizations in campaigns that leverage device code phishing with voice phishing (vishing) to abuse the OAuth 2.0 Device Authorization flow and compromise Microsoft Entra accounts.
Unlike previous attacks that utilized malicious OAuth applications to compromise accounts, these campaigns instead leverage legitimate Microsoft OAuth client IDs and the device authorization flow to trick victims into authenticating.
This provides attackers with valid authentication tokens that can be used to access the victim’s account without relying on regular phishing sites that steal passwords or intercept multi-factor authentication codes.
Ensar Seker, CISO at SOCRadar, commented:
“This campaign is significant because it doesn’t break authentication, it abuses it. The OAuth 2.0 Device Authorization flow was designed for usability across limited-input devices, but attackers are now socially engineering users into completing legitimate device login prompts under the guise of IT support or security validation. By leveraging real Microsoft OAuth client IDs instead of malicious apps, adversaries avoid many traditional detection controls. The result is a valid authentication token issued by Microsoft itself, which means no password theft, no MFA bypass exploit, just human manipulation.
“What makes this especially dangerous for enterprises is that many security programs still focus heavily on credential phishing indicators, fake domains, cloned login pages and MFA fatigue. Device code phishing shifts the battlefield into token abuse and session hijacking. Once the attacker has a valid access token tied to Entra ID, they can move laterally into M365, SharePoint, Teams, and potentially pivot toward financial fraud or data exfiltration without triggering obvious alerts.
‘If ShinyHunters is indeed involved, it signals continued evolution from traditional data-theft extortion toward identity-centric compromise models. Identity is the new perimeter, and OAuth abuse is becoming a preferred entry point because it blends into normal authentication telemetry.
“From a defensive standpoint, organizations need to restrict or monitor the Device Authorization flow where not required, enforce Conditional Access policies that bind tokens to compliant devices, reduce token lifetimes, enable sign-in risk policies, and implement stronger session monitoring. Security teams should also train employees that legitimate IT will never ask them to manually enter device codes shared over the phone.
“This is not a vulnerability in Microsoft Entra, it’s a design feature being exploited through social engineering. The real lesson is that modern attacks increasingly weaponize legitimate cloud workflows rather than exploit technical flaws.”
This is a very good time to start looking at your Microsoft Entra setup to make sure that you are not vulnerable. Because now that this is being used by one group of threat actors, it will be used by others soon enough.
Leave a comment »