We’re Tracking the Future of Security

Author: Osiris

  • OculusIT Adds Seceon Detection and Response to Higher-Education SOC Service

    OculusIT Adds Seceon Detection and Response to Higher-Education SOC Service

    OculusIT has added Seceon’s threat detection and response platform to the managed security operations center service it provides to colleges and universities. The integration is intended to give analysts a consolidated view across campus networks, endpoints, identities, cloud services and applications.

    The service correlates activity across several control layers

    According to the companies, the platform collects and correlates security events, prioritizes alerts and supports automated response playbooks. OculusIT’s analysts remain responsible for monitoring and investigation within the managed service. The offering also includes reporting intended to support higher-education requirements such as FERPA and GLBA.

    The announcement describes a service integration rather than an independent performance test. Institutions should therefore validate detection coverage and response procedures against their own architecture and risk profile.

    Campus buyers should define evidence and escalation requirements

    A managed SOC contract should identify log sources, retention, alert ownership, escalation timeframes and the evidence available after an incident. Universities should also test identity, cloud and endpoint integrations before relying on automated response. Compliance reporting can support governance, but it does not substitute for technical control validation. SectechMedia follows related operations in its cybersecurity coverage.

    Sources

  • NIST Awards $1.7 Million for Regional Cybersecurity Workforce Programs

    NIST Awards $1.7 Million for Regional Cybersecurity Workforce Programs

    NIST has awarded more than $1.7 million in cooperative agreements to nine education and community organizations developing regional cybersecurity workforce programs. The awards cover projects in eight states and are intended to connect training with the needs of local employers and nonprofit organizations.

    Projects combine education with practical pathways

    The agreements are administered through NIST’s National Initiative for Cybersecurity Education. Individual awards are worth up to $200,000 and support Regional Alliances and Multistakeholder Partnerships to Stimulate Cybersecurity Education and Workforce Development, known as RAMPS.

    Planned activities include curriculum development, high-school and college programs, internships, apprenticeships, workshops, boot camps, competitions and hands-on projects. NIST says the new awards expand the RAMPS network to 55 communities in 26 states.

    Workforce planning should map skills to real systems

    Training volume alone does not resolve operational shortages. Employers and educators need role definitions, supervised practice and evidence that participants can work safely with identity, network, cloud and incident-response systems. The NICE Workforce Framework offers a common language for that mapping, while regional partnerships can adapt delivery to local infrastructure and industry. SectechMedia follows workforce and operational resilience issues in its cybersecurity coverage.

    Sources

  • NIST Finalizes Guidance for Protecting Online Identity and Access Tokens

    NIST Finalizes Guidance for Protecting Online Identity and Access Tokens

    NIST has finalized implementation guidance for protecting online identity and access tokens from theft, forgery and misuse. Tokens allow applications and services to recognize authenticated users without repeatedly asking for credentials, but stolen or forged tokens can let an attacker impersonate a legitimate account while bypassing normal sign-in checks.

    The guidance uses a reference cloud implementation

    The publication describes a zero-trust architecture built around commercial and open-source technologies. It covers token discovery, visibility, validation and enforcement across identity providers, applications and cloud services. NIST developed the practice guide with CISA and industry collaborators through the National Cybersecurity Center of Excellence.

    The final material emphasizes that token protection is not limited to one product. Organizations need coordinated telemetry and policy enforcement across the systems that issue, receive and validate tokens.

    Operations should test revocation and misuse detection

    Identity teams should inventory token types, document trust relationships, reduce unnecessary token lifetime and confirm that revocation works during an incident. Monitoring should identify unusual issuance, replay and use from unexpected devices or locations. Those controls complement phishing-resistant authentication rather than replacing it. SectechMedia follows related developments in its identity and access-control coverage.

    Sources

  • NIST Quantum Sensors Improve Nuclear Material Monitoring Accuracy

    NIST Quantum Sensors Improve Nuclear Material Monitoring Accuracy

    NIST researchers and international partners have used ultrasensitive quantum sensors to measure X-ray emissions from uranium, plutonium and neptunium with substantially improved precision. The measurements can help analysts separate those X-rays from overlapping gamma-ray signals used to identify and account for nuclear material.

    Transition-edge sensors resolve overlapping signals

    The work used arrays of transition-edge sensors, superconducting devices operated just above absolute zero. An incoming photon produces a measurable change in resistance, allowing the detector to determine its energy with high resolution. NIST reports that the new measurements reduced uncertainty by between one-third and one-eighth compared with earlier values.

    More accurate X-ray data allows monitoring systems to subtract background interference and estimate isotope ratios more precisely. Those ratios are important for nuclear safeguards because they help distinguish material composition and enrichment.

    Deployment still requires specialized infrastructure

    The sensors need cryogenic cooling and are not handheld instruments. NIST says arrays can operate where sufficient power and refrigeration are available, while samples can also be sent to equipped laboratories. The technology may shorten measurement delays at nuclear facilities, but operational adoption requires calibration, chain-of-custody controls and validated procedures. SectechMedia follows related systems in its industrial monitoring coverage.

    Sources

  • CISA Adds Actively Exploited WordPress Core File-Inclusion Flaw to KEV

    CISA Adds Actively Exploited WordPress Core File-Inclusion Flaw to KEV

    CISA has added CVE-2026-87902, a WordPress core file-inclusion vulnerability, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The issue affects WordPress versions before 7.1.2, with fixes also backported to maintained older branches.

    Specific conditions can turn local inclusion into code execution

    The flaw involves page-template resolution in get_page_template(). An unauthenticated attacker can cause WordPress to include a chosen readable local PHP file outside the active theme directories. Exploitation requires additional server and theme preconditions, but a successful chain can lead to remote code execution. The CVE record assigns a high-severity score and notes that no user interaction or prior privileges are required.

    WordPress released version 7.1.2 on September 22 and recommended immediate updates. CISA added the vulnerability to KEV on September 25, while public reporting documented probing shortly after the patch became available.

    Inventory and verification matter after patching

    Operators should confirm the actual WordPress core version on every site, apply the relevant security release, review web and file-change telemetry, and verify that unsupported instances are not exposed. Patching does not by itself prove that an already-exposed site was not accessed. SectechMedia follows related operational risks in its cybersecurity coverage.

    Sources

  • F-Droid 2.0 Redesigns Open-Source Android App Discovery and Updates

    F-Droid 2.0 Redesigns Open-Source Android App Discovery and Updates

    F-Droid has released version 2.0 of its official Android client, describing it as the project’s largest application update in ten years. The redesign modernizes how users discover, search for and maintain free and open-source Android applications while retaining F-Droid’s repository model.

    The client has been rebuilt around current Android patterns

    The interface now centers on Discover, Search and My Apps. Categories are integrated into discovery, while installed applications and updates are consolidated under My Apps. The project says major components were rewritten with Kotlin Compose after 14 test releases, providing a new base for future development.

    Discovery includes newly added, recently updated and widely downloaded applications. The category system has also been expanded to make specialist tools such as VPNs, firewalls and password managers easier to find. F-Droid says the experience remains free of behavioral tracking.

    Repository trust still requires informed review

    A redesigned client can improve update visibility and software discovery, but users and organizations should still assess repository policy, signing, update cadence and application permissions. Mobile fleets also need a clear rule for software installed outside a managed commercial store. SectechMedia follows related controls in its cybersecurity coverage.

    Sources

  • Local AI Model Reworks Credential Dumper to Evade Two EDR Products in Lab Test

    Local AI Model Reworks Credential Dumper to Evade Two EDR Products in Lab Test

    A security researcher reports that an uncensored local AI model modified a Windows credential-dumping program until it ran without alerts from two endpoint detection and response products available in the test lab. The experiment does not demonstrate a universal EDR bypass, but it illustrates how local models without service-side safeguards can accelerate iterative offensive development.

    The model changed several observable behaviors

    The test began with a tool designed to clone the LSASS process and create an encrypted memory dump. Initial versions were detected. After prompts requesting stealth, the local model changed process-spawning behavior, reduced access rights, inserted timing variation, changed output paths and removed embedded strings. The researcher reports that the revised build then completed without detections in the two tested products.

    The result is limited to one laboratory setup, one task and two unnamed EDR platforms. It should not be generalized into a claim that AI can bypass every endpoint product.

    Defenders need behavior-level validation

    Security teams should test controls against credential-access behaviors rather than rely only on static signatures. Useful layers include LSASS protection, credential isolation, privilege reduction, process-access telemetry and correlation across endpoint and identity systems. Model governance also matters where organizations permit local AI tools. SectechMedia tracks these risks in its cybersecurity coverage.

    Sources

  • Oakland Apartment Fire Injures Four and Displaces About 70 Residents

    Oakland Apartment Fire Injures Four and Displaces About 70 Residents

    A three-alarm fire in a four-story East Oakland apartment building injured four residents and displaced about 70 people, according to local reporting based on fire-department information. The incident began shortly after midnight in the 5100 block of Bancroft Avenue, with smoke and flames visible from all four floors when crews arrived.

    Crews carried out rescues during escalation

    The response grew to a third alarm within minutes and involved about 65 firefighters. Crews rescued several occupants while others evacuated independently. Three adults and a nine-year-old child were taken to hospital for smoke inhalation and other injuries. No firefighter injuries were reported, and the fire was brought under control in a little over an hour.

    Officials described extensive damage, and the 21-unit building was red-tagged as uninhabitable. Emergency housing support was being arranged with assistance from the Red Cross. The cause remained under investigation at the time of reporting.

    Multi-unit incidents test several safeguards

    Apartment fires place simultaneous demands on detection, alarm audibility, protected escape routes, compartmentation and fire-service access. Post-incident reviews should examine whether alarms reached every occupied area, how smoke affected exits and whether resident accountability supported rescues. SectechMedia follows these engineering issues in its fire and life-safety coverage.

    Sources

  • US Senate Scrutiny Grows Around Flock’s Nationwide License-Plate Camera Network

    US Senate Scrutiny Grows Around Flock’s Nationwide License-Plate Camera Network

    Flock Safety’s nationwide network of automated license-plate recognition cameras is facing closer scrutiny from US lawmakers over search practices, data sharing and accountability. A Senate Judiciary subcommittee hearing brought together company, law-enforcement and civil-liberties perspectives on how locally purchased cameras can form a much broader searchable network.

    Local cameras can support wider searches

    Flock cameras capture vehicle plates and related attributes, then make records searchable according to agency permissions and retention settings. The system can support investigations across jurisdictions, but that reach also raises questions about who may search the data, which purposes are authorized and how misuse is detected. Senators have requested information about safeguards after reports of searches that crossed agency or state boundaries.

    Flock says its controls include audit logs, purpose fields, role-based permissions and options for agencies to limit sharing. Those controls still depend on policy configuration, supervisory review and effective response when a search violates rules.

    Governance must match network scale

    Agencies evaluating plate-recognition networks should define permissible uses, retention, interagency access and audit-review frequency before deployment. Procurement should also require exportable logs and a process for investigating complaints. The issue is not only camera accuracy; it is whether access governance remains enforceable as the network grows. SectechMedia follows these systems in its perimeter security coverage.

    Sources

  • Lunex Stealer Uses Vulnerable AMD Driver to Blind Security Tools

    Lunex Stealer Uses Vulnerable AMD Driver to Blind Security Tools

    Researchers have documented a multistage Windows malware chain in which Lunex Stealer abuses a legitimately signed but vulnerable AMD kernel driver before collecting browser and cryptocurrency data. The technique is an example of bring your own vulnerable driver, or BYOVD, in which attackers load a trusted driver whose known flaw provides kernel-level capabilities.

    The driver is used to weaken monitoring

    The chain begins with a fake verification page and a malicious installer. Its loader uses the vulnerable PDFWKRNL.sys driver associated with CVE-2023-20598 to interfere with callbacks used by security products. The products can remain running while losing visibility into activity that follows. The final stealer targets credentials, session cookies and wallet information from several Chromium-based browsers and can add a native-messaging component for persistence and remote file operations.

    AMD published its original bulletin for the driver vulnerability in 2023. The current campaign matters because it shows how older signed-driver flaws can be combined with newer malware delivery and persistence techniques.

    Driver controls need operational testing

    Defenders should inventory vulnerable drivers, apply vendor updates, review driver-loading telemetry and test whether Microsoft’s vulnerable-driver blocklist is active in their actual Windows configuration. Browser credential theft also increases the value of phishing-resistant authentication and rapid session revocation. SectechMedia tracks related developments in its cybersecurity coverage.

    Sources