We’re Tracking the Future of Security

Author: Osiris

  • Croatia Considers mGrađani Digital Identity for Online Age Verification

    Croatia Considers mGrađani Digital Identity for Online Age Verification

    Croatia is considering its mGrađani digital identity application as a tool for electronic age verification while European institutions develop new online child-protection rules. The government says the application already supports a privacy-preserving way to confirm that a user is over 18.

    Age proof without full identity disclosure

    The Croatian Ministry of Justice, Public Administration and Digital Transformation said more than 204,000 citizens use mGrađani. Its age-verification function is designed to provide an eligibility result rather than disclose a person’s full identity record to an online service. That distinction can reduce unnecessary data exposure when a service only needs proof of age.

    The proposal is being discussed as Croatia prepares its position on the emerging EU KIDS Act framework. The final European rules and the technical role of national identity applications are still developing, so the announcement should not be read as a completed mandatory deployment.

    Implementation questions remain

    Age-verification systems need clear legal purpose, data-minimization controls, accessible alternatives and testing against exclusion or circumvention. Operators also need assurance that relying services cannot silently expand the information requested beyond the age claim. SectechMedia follows related identity architecture in its access control and identity channel.

    Sources

  • Bitget Reports $351.6 Million Theft After Wallet Backend Compromise

    Bitget Reports $351.6 Million Theft After Wallet Backend Compromise

    Cryptocurrency exchange Bitget says attackers stole $351.6 million from a limited set of hot and warm wallets after compromising a critical backend system in its wallet infrastructure. The company detected unauthorized transfers on September 24 and temporarily suspended withdrawals while it investigated.

    What Bitget has disclosed

    Bitget said its cold wallets and most platform assets were not affected, and that customer account balances remained recorded correctly. According to the company, the attacker manipulated transaction data and triggered the authorization process to move funds. Bitget engaged Mandiant and SlowMist for outside investigation and contacted affected blockchain foundations about freezing addresses.

    The company attributed the activity pattern to suspected North Korean actors, but that attribution remains an assessment rather than an independently confirmed finding. The intrusion method also remains under investigation. Reporting should therefore separate confirmed unauthorized transfers and the disclosed backend compromise from still-developing attribution details.

    Security implications

    The incident highlights the need to isolate signing systems, require independent transaction verification, limit hot-wallet balances and test controls against compromised backend data. Exchanges also need rehearsed withdrawal suspension, chain-monitoring and customer-communication procedures. SectechMedia tracks connected risks in its cyber-physical security channel.

    Sources

  • CISA Adds Exploited WSO2 and Adobe Commerce Flaws to KEV Catalog

    CISA Adds Exploited WSO2 and Adobe Commerce Flaws to KEV Catalog

    The U.S. Cybersecurity and Infrastructure Security Agency has added two enterprise-software vulnerabilities to its Known Exploited Vulnerabilities catalog. The additions cover CVE-2026-5430 in WSO2 products and CVE-2026-71362 in Adobe Commerce and Magento.

    Two different attack paths

    The WSO2 issue is a path-traversal weakness that can enable unrestricted file upload and potentially remote code execution in affected API-management components. Security researchers reported exploitation attempts before the catalog update. The Adobe Commerce issue is an authorization flaw that can allow an attacker to reach another customer’s account context and sensitive information under vulnerable conditions.

    KEV inclusion means CISA has evidence that the vulnerabilities are being exploited, not merely that public proof-of-concept material exists. Federal civilian agencies received a remediation deadline, while private organizations can use the catalog as a prioritization signal alongside asset exposure, business impact and compensating controls.

    Prioritization for defenders

    Teams should inventory affected WSO2, Adobe Commerce and Magento deployments, compare versions against vendor advisories, apply fixes, and inspect logs for file-upload anomalies, forged tokens or unusual account switching. Internet-facing systems and identity-connected APIs deserve immediate attention. SectechMedia follows similar operational risk in its cyber-physical security channel.

    Sources

  • Cloudflare Fixes Cross-Tenant Disk Data Exposure in Container Platform

    Cloudflare Fixes Cross-Tenant Disk Data Exposure in Container Platform

    Cloudflare has disclosed and fixed a cross-tenant data exposure issue affecting its Containers and Sandboxes products. The flaw involved storage reuse: a newly provisioned workload could receive disk blocks that still contained residual data from a previous customer.

    How the isolation failure occurred

    Researchers at Accomplish demonstrated that discarded thin-provisioned storage was not reliably cleared before reuse. That created a path for one tenant to inspect fragments left by another. Cloudflare said the affected products were in beta and reported no evidence that the issue had been exploited maliciously.

    The company disabled the relevant storage behavior, introduced sanitization controls and reviewed the platform after receiving the report. Cloudflare’s account and the researchers’ technical write-up agree on the core risk, although they describe some affected service details differently. The incident illustrates that workload isolation depends on storage lifecycle controls as well as compute and network boundaries.

    Lessons for multi-tenant platforms

    Operators should include block-device reuse, snapshot handling and deprovisioning in tenant-isolation tests. Encryption, secure erase procedures and monitoring for unexpected reads can add defense in depth, but each control must be verified against the actual storage architecture. Customers should also avoid treating beta isolation guarantees as equivalent to mature production assurance. Related coverage appears in SectechMedia’s cyber-physical security channel.

    Sources

  • Roundcube Pre-Authentication SQL Injection Is Under Active Exploitation

    Roundcube Pre-Authentication SQL Injection Is Under Active Exploitation

    Canada’s Cyber Centre has warned that attackers are actively exploiting a patched Roundcube Webmail vulnerability. Tracked as CVE-2026-48842, the flaw affects the virtuser_query plugin and can permit SQL injection before a user authenticates.

    What the advisory confirms

    Roundcube released fixes in versions 1.6.16 and 1.7.1 on May 24. The project described the issue as a security defect involving query handling, while the Canadian advisory now adds evidence of exploitation in the wild. The available notices do not disclose a detailed campaign profile, so attribution and victim counts remain unconfirmed.

    The risk depends on whether the vulnerable plugin is enabled and how the database is configured. Successful injection could expose information held by the webmail backend, including data that may support further account compromise. Internet-facing email systems are especially sensitive because they combine identity, communications and recovery workflows.

    Immediate defensive actions

    Administrators should identify Roundcube versions and enabled plugins, upgrade to a fixed release, review web and database logs for unusual query patterns, and rotate affected credentials if compromise is suspected. Restricting unnecessary public exposure and applying least privilege to the database account can reduce impact. SectechMedia covers connected defensive controls in its cyber-physical security channel.

    Sources

  • ICE Plans Nationwide Intelligence Support Network for Biometric Targeting Operations

    ICE Plans Nationwide Intelligence Support Network for Biometric Targeting Operations

    U.S. Immigration and Customs Enforcement is preparing a contracting effort to expand intelligence research support across Enforcement and Removal Operations headquarters, field areas and national targeting centers. The proposed structure, described in federal procurement records, would place cleared analysts in locations that already use biometric and biographic information for identity resolution.

    A distributed analyst network

    The planning documents call for approximately 142 intelligence research specialists across headquarters, 24 field areas and three national support centers. The Law Enforcement Support Center, National Criminal Analysis and Targeting Center and Pacific Enforcement Response Center already combine law-enforcement, immigration and identity information to generate operational leads.

    The statement of work does not say that contractor analysts will operate a new facial-recognition or fingerprint platform. It describes all-source research, intelligence-gap analysis, network analysis and operational support within an existing enforcement architecture. Reporting should therefore distinguish the proposed analyst workforce from any separate biometric technology procurement.

    Governance and oversight

    The records describe work involving classified information, law-enforcement-sensitive data and personally identifiable information. Any deployment will require strict access controls, audit logging, human oversight, retention rules and review of how identity data supports consequential decisions. The procurement notice was posted on September 18 and remained a planning action rather than proof of a completed award. SectechMedia follows similar systems in its border security coverage.

    Sources

  • SIA and AMAG Launch Role-Based OSDP Training Program

    SIA and AMAG Launch Role-Based OSDP Training Program

    The Security Industry Association and AMAG Technology have announced a tiered training program for the Open Supervised Device Protocol. The curriculum is intended to give commercial teams, installers and operators different levels of instruction based on how they specify, deploy or maintain access-control communications.

    Training by operational role

    Sales and marketing participants will study OSDP fundamentals and how the protocol differs from older reader interfaces. Technical personnel will receive configuration and troubleshooting instruction through AMAG coursework combined with SIA’s OSDP Boot Camp. AMAG says the certified material is being incorporated into its core training curriculum.

    OSDP defines communication between access-control panels and peripheral devices such as readers. It supports bidirectional communication and secure-channel capabilities when correctly implemented. Training remains only one part of a secure deployment: device compatibility, key management, wiring, firmware and commissioning procedures still need to be verified at system level.

    Why implementation discipline matters

    Protocol support on a datasheet does not guarantee that every feature is enabled or interoperable. Integrators should test secure-channel operation, supervision, addressing and fault reporting across the exact panel and reader combination used on site. Documented commissioning and maintenance procedures help preserve those controls after handover. SectechMedia covers related design issues in its access control and identity channel.

    Sources

  • Unpatched OnePlus Flaws Let Installed Apps Gain Root Access

    Unpatched OnePlus Flaws Let Installed Apps Gain Root Access

    Security researchers have disclosed a chain of vulnerabilities affecting OnePlus OxygenOS that can allow an installed Android application to reach privileged system functions and gain root-level access. The findings build on earlier concerns about overly exposed manufacturer components in customized Android builds.

    Privilege boundaries can collapse

    The research describes interfaces that are accessible to ordinary applications but connect to highly privileged services. By combining exposed functionality with insufficient authorization checks, a malicious application can move beyond its normal Android sandbox. Rapid7 separately documented a OnePlus telephony-provider permission bypass and reported that the issue remained unfixed at publication.

    The demonstrated paths require an application to be installed on the device; they are not described as remote attacks that compromise a phone merely by visiting a website. That distinction is important for risk assessment, but it does not remove the concern because seemingly low-permission applications can be distributed through social engineering or third-party stores.

    Enterprise response

    Organizations managing Android fleets should identify affected OnePlus models and OxygenOS versions, restrict installation from untrusted sources, monitor vendor updates and review mobile-device-management policies for application allowlisting. Where sensitive credentials or operational access are present, teams should consider temporary compensating controls until patches and supported upgrade paths are confirmed. SectechMedia tracks connected-device risks in its cyber-physical security channel.

    Sources

  • UNCTAD Evaluation Highlights Digital Identity Training for Small Island States

    UNCTAD Evaluation Highlights Digital Identity Training for Small Island States

    An independent evaluation published by the United Nations Conference on Trade and Development has assessed a three-year capacity-building program for small island developing states. The project used UNCTAD’s TrainForTrade model and covered digital identity for trade and development, legal aspects of e-commerce and digital-economy statistics.

    Training across dispersed jurisdictions

    The project ran from March 2022 through December 2025 and reached participants across Africa, the Caribbean and Asia-Pacific. According to the evaluation, 153 participants completed the digital-identity course, while the wider initiative reached 920 participants across 58 countries and territories. The assessment drew on document review, stakeholder interviews and a participant survey.

    Digital identity was treated as enabling infrastructure for secure digital trade and access to online services. The report also records practical constraints, including geography, resource limitations and remote data collection. Those limitations are relevant when translating training outcomes into national systems and policy.

    Implementation remains country-specific

    Capacity building does not by itself establish a trusted identity system. Governments still need legal authority, privacy safeguards, cybersecurity controls, inclusive enrollment and interoperable credentials suited to local conditions. The evaluation is useful as evidence about training delivery and institutional learning rather than as proof of a single technical architecture. SectechMedia follows related developments in its identity technology coverage.

    Sources

  • Face Recognition Research Exposes Limits of Image Quality Scores

    Face Recognition Research Exposes Limits of Image Quality Scores

    Recent research is challenging the assumption that a single image-quality score can reliably predict face-recognition performance. A Johns Hopkins University study examined low-resolution and degraded imagery, while current NIST evaluations compare quality estimators against the utility of images for automated matching.

    Quality and recognition utility are different

    Blur, occlusion, compression and low resolution can remove information from a face image. Newer recognition algorithms may still recover useful identity cues from some degraded samples, but a visually poor image is not automatically unusable and a visually clean image is not automatically useful for every matcher. The distinction matters when operators use quality thresholds to accept, reject or recapture images.

    NIST’s Face Recognition Technology Evaluation publishes results for face-image quality algorithms and links those scores to recognition error. The Johns Hopkins work focuses on recognition under severe degradation. Together, the findings support testing quality measures against the actual cameras, capture conditions and matching systems used in an operational deployment.

    Operational implications

    Security teams should avoid treating a vendor-neutral quality number as a universal pass-or-fail decision. Acceptance testing should include representative lighting, distance, pose and compression conditions, followed by matcher-specific performance checks. Human review and alternative identity evidence remain important where poor imagery or high-consequence decisions are involved. SectechMedia covers related system design in its access control and identity channel.

    Sources