We’re Tracking the Future of Security

Author: Osiris

  • SU Group Holdings to Acquire Hong Kong Safety Firm KM Safety Solution

    SU Group Holdings to Acquire Hong Kong Safety Firm KM Safety Solution

    SU Group Holdings Limited, a Nasdaq-listed integrated security services provider offering security engineering, guarding, screening and vocational training services in Hong Kong, agreed to acquire 100% of KM Safety Solution Company Limited for HK$5,616,000 (approximately US$721,000) in cash at completion. The deal is contingent on satisfactory due diligence and required approvals by October 31, 2026.

    KM Safety Solution provides safety consultancy services and holds a 24-month distribution agreement, started in July 2026, for intelligent emergency-lighting control products in Hong Kong. SU Group said the acquisition is intended to “expand SU Group’s technology-enabled safety and security offerings,” with management saying KM’s operations and distribution rights complement SU Group’s existing security-engineering capabilities and support more integrated customer solutions.

    Why it matters

    The deal is a small one in dollar terms, but it reflects a broader pattern among regional security-services firms of adding adjacent life-safety product lines — like emergency lighting — to existing guarding and engineering businesses rather than staying narrowly focused on a single service category.

    Sources

  • Sen. Hawley Expands AI Surveillance-Camera Probe to Motorola Solutions, Verkada and Axon

    Sen. Hawley Expands AI Surveillance-Camera Probe to Motorola Solutions, Verkada and Axon

    Senator Josh Hawley, a Missouri Republican who chairs the Senate Subcommittee on Crime and Counterterrorism, sent letters to the chief executives of Motorola Solutions, Verkada and Axon in early September 2026, expanding an investigation he had previously directed at Flock Safety’s camera network to three additional companies that operate AI-assisted surveillance camera systems. The letters gave the companies until September 16 to respond.

    According to Hawley’s office, the letters state that the companies “are building large camera networks, assisted by artificial intelligence, that intrude on the privacy of all Americans.” The senator requested information on the geographic scope of searches customers can run for vehicle or driver data, how long that data is retained, confirmed cases of misuse since 2021, and the safeguards governing who can search the systems and why.

    Why it matters

    The probe puts four of the largest AI-assisted camera and license-plate-recognition networks under the same congressional scrutiny at once, and the specific questions — retention periods, search scope, documented misuse — track closely with the data-governance practices state and local agencies are increasingly asked to justify when they deploy these systems.

    Sources

  • Agility Robotics Unveils Digit 5, a Humanoid Built to Work Without Safety Cages

    Agility Robotics Unveils Digit 5, a Humanoid Built to Work Without Safety Cages

    Agility Robotics unveiled Digit 5, the fifth generation of its general-purpose humanoid robot and the company’s first designed for what it calls “cooperatively safe work at scale” — operating alongside people without the physical safety cages traditional industrial robots require. The robot uses sensors, human-detection and independent motion control to stop or reposition itself when a person moves into its workspace, rather than relying on fixed barriers to keep people out.

    Digit 5 stands 5 feet 11 inches tall, weighs 284 pounds and can reach up to 7.2 feet, with grippers that let it lift up to 50 pounds repeatedly and recharge in nine minutes for shifts the company says can run more than 20 hours a day. Agility reports more than $300 million in multi-year customer orders as of May 2026 and says it plans to make Digit available for commercial deployment outside North America for the first time, starting with the EU and UK, with CE and other regional certification marks.

    Why it matters

    Most humanoid and industrial robots still depend on fenced-off work cells to keep people safe; a robot engineered to share floor space with workers without that barrier changes the layout calculus for warehouses and factories, and shifts more of the safety burden onto the robot’s own sensing and control systems rather than the facility’s physical design.

    Sources

  • Drone Strikes on Saudi Arabia’s East-West Pipeline Expose a Critical Bypass Route

    Drone Strikes on Saudi Arabia’s East-West Pipeline Expose a Critical Bypass Route

    A series of drone strikes hit Saudi Arabia’s East-West Crude Oil Pipeline in the Riyadh and Medina regions on the morning of September 10-11, 2026, causing fires and damage to pump stations and injuring several people, according to the Saudi government. Saudi authorities shut the 1,200-kilometer pipeline as a precautionary measure. No group had claimed responsibility for the strikes as of this writing, and officials said the drones were launched from Iraqi territory amid the wider 2026 Iran war.

    The pipeline had taken on outsized importance in the weeks before the attack: with the Strait of Hormuz effectively closed by Iran, Saudi Arabia had been rerouting roughly 5 million barrels of oil per day through the East-West pipeline to the Red Sea port of Yanbu instead of the Gulf. The strikes cut off a critical bypass route for Saudi crude exports at a moment when alternative shipping capacity was already constrained.

    Why it matters

    The attack illustrates how a single above-ground pipeline corridor can become a single point of failure for a country’s export capacity once its primary maritime route is blocked — pump stations and above-ground infrastructure along long-haul pipelines are difficult to defend comprehensively against low-cost drone strikes.

    Sources

  • Plugin4Shell: Same Zero-Click RCE Flaw Hits Claude Code, Codex, Copilot and Gemini CLI

    Plugin4Shell: Same Zero-Click RCE Flaw Hits Claude Code, Codex, Copilot and Gemini CLI

    Security researchers disclosed a zero-click remote-code-execution flaw, dubbed Plugin4Shell, affecting the plugin-installation logic shared by four major AI coding agents: Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. Researchers describe it as the first supply-chain vulnerability found across the AI coding agent ecosystem, giving an attacker who exploits it the same system and data access as the developer running the agent.

    The flaw lies in how these tools handle SHA-pinned plugin versions: marketplaces pin a plugin to a specific Git commit hash after review, but for Claude Code, Codex and Copilot, an attacker can create a branch whose name matches that 40-character commit hash, and Git may check out the attacker-controlled branch instead of the reviewed commit. Gemini CLI has a related variant that abuses a branch named FETCH_HEAD to redirect the checkout. Anthropic patched Claude Code in version 2.1.179 and OpenAI fixed Codex in version 0.146.0. Microsoft has not yet shipped a fix for Copilot, and Google chose to deprecate Gemini CLI rather than patch it, leaving existing installs exposed indefinitely.

    Why it matters

    AI coding agents now run with broad repository and system access inside many development pipelines; a shared flaw in how four of the most widely used agents install plugins means a single exploitation technique can reach into a large share of the software supply chain that depends on them.

    Sources

  • SITA Launches Border Flow Lane, an In-Motion Biometric Border Check for Airports

    SITA Launches Border Flow Lane, an In-Motion Biometric Border Check for Airports

    SITA launched Border Flow Lane, a border-processing model that replaces stop-and-check passport control at gates, kiosks and officer stations with continuous, in-motion identity verification as travelers walk through the terminal. The company says the approach runs up to eight times faster than standard eGates and can clear more than 75% of passengers before their flight departs, freeing immigration officers to focus on non-routine cases while retaining full authority to stop any traveler.

    Toronto Pearson is piloting the system with Air Canada across four facial-verification gates — one for domestic travelers and three for U.S.-bound passengers — using Dormakaba hardware with middleware from SITA and Airsphere. For U.S.-bound flights, the reference image comes from the identity record created during U.S. preclearance; for domestic flights, it draws on the record generated through Air Canada’s app. Participation remains voluntary, and travelers can opt for standard document checks instead.

    Why it matters

    Airports have largely hit the physical limits of widening queues and adding staff to handle passenger growth; shifting identity verification earlier and making it continuous rather than a single stop-and-check event is one of the few remaining ways to add effective checkpoint capacity without new floor space.

    Sources

  • Oracle Ships Java 27 With Post-Quantum Hybrid Key Exchange for TLS 1.3

    Oracle Ships Java 27 With Post-Quantum Hybrid Key Exchange for TLS 1.3

    Oracle released Java 27, the platform’s second non-LTS update since JDK 25, headlined by JEP 527: Post-Quantum Hybrid Key Exchange for TLS 1.3. The feature implements the IETF’s Hybrid Key Exchange in TLS 1.3 specification, pairing a quantum-resistant key-exchange algorithm with a conventional one in the same handshake so a connection stays secure as long as either algorithm holds up. The release ships nine JEPs in total, five of which remain in preview or incubator status.

    The hybrid approach is designed to blunt “harvest now, decrypt later” attacks, in which adversaries capture encrypted traffic today and store it until a sufficiently powerful quantum computer can break the classical encryption protecting it. Because Java 27 combines the new algorithm with an existing one rather than replacing it outright, Oracle says organizations can adopt the protection with minimal disruption to existing TLS-dependent applications.

    Why it matters

    TLS underpins the great majority of encrypted communication between servers, applications and connected devices; building quantum-resistant key exchange into a mainstream runtime like Java gives large swaths of enterprise and industrial software a path to post-quantum protection without a wholesale cryptographic migration.

    Sources

  • Rohde & Schwarz Debuts QPS Walk500 Walk-Through Scanner for High-Traffic Events

    Rohde & Schwarz Debuts QPS Walk500 Walk-Through Scanner for High-Traffic Events

    Rohde & Schwarz will introduce the QPS Walk500, a new walk-through security scanner aimed at high-throughput venues, at Security Expo 2026 in Essen (September 22-25, Booth 6C39, Hall 6). The scanner is a more compact addition to the company’s QPS Walk product line, sitting below the existing QPS Walk2000, and is built for event security where large crowds need to move through checkpoints quickly.

    The QPS Walk500 combines millimeter-wave imaging with AI-based detection algorithms to identify metals, plastics, liquids, granules, organic materials and ceramics, and can screen up to 750 people per hour without requiring visitors to stop, empty pockets or remove outerwear. Detected items are flagged on a neutral avatar so staff can direct a follow-up check to the specific area of concern, and an optional hand-masking mode lets people continue holding phones or wallets during screening. Rohde & Schwarz positions the scanner for aviation, border crossings, data centers, correctional facilities, critical infrastructure sites and large public events.

    Why it matters

    Walk-through screening that does not require people to stop or shed clothing addresses one of the main throughput bottlenecks at stadiums, transit hubs and other high-footfall venues, where queue time at checkpoints is often the limiting factor on how many people a site can screen per hour.

    Sources

  • Leonardo and Marshall Unveil Containerised Falcon Shield Counter-Drone System

    Leonardo and Marshall Unveil Containerised Falcon Shield Counter-Drone System

    Leonardo and Marshall Land Systems unveiled a containerised configuration of Leonardo’s Falcon Shield counter-uncrewed aircraft system (C-UAS) at the Defence Vehicle Dynamics (DVD) show. The new package integrates Leonardo’s HYAS command-and-control system and Nerio ultra-long-range surveillance and target-acquisition sensor inside a standard ISO shipping container, so the whole detect-and-defeat stack can move by air, land or sea and be set up wherever protection is needed.

    The containerised system keeps Falcon Shield’s open architecture, which can integrate radar, electronic-surveillance sensors and electro-optical/infrared cameras alongside kinetic and non-kinetic effectors, and multiple units can be networked for layered coverage. Falcon Shield is already in service with the UK Royal Air Force — where the system is designated Orcus and has protected major international events — and with the Canadian Armed Forces.

    Why it matters

    Packaging a full C-UAS detect-track-identify-defeat chain into a standard shipping container turns counter-drone protection into something that can be trucked or shipped to a temporary site — an airbase, a border crossing, a major event — and stood up quickly rather than requiring a fixed installation.

    Sources

  • CISA Advisory Flags Two Critical Flaws in Hitachi Energy Grid Control Platform

    CISA Advisory Flags Two Critical Flaws in Hitachi Energy Grid Control Platform

    CISA published an advisory covering five vulnerabilities in Hitachi Energy’s FACTS Control Platform (FCP), software used to manage Flexible AC Transmission Systems that stabilize voltage and power flow on electric grids. Two of the flaws, CVE-2024-4872 and CVE-2024-3980, are rated 9.9 (Critical) on the CVSS v3.1 scale; a third, CVE-2024-7940, is rated 8.3 (High); a fourth, CVE-2024-3982, is rated 8.2 (High); and a fifth, CVE-2024-7941, is rated 4.3 (Medium).

    According to CISA, the flaws include improper neutralization of special elements in data query logic, path traversal, authentication bypass by capture-replay, missing authentication for a critical function, and open redirect. An authenticated attacker could chain these to inject code, access critical files, hijack sessions, bypass authentication or run phishing attacks against operators. Hitachi Energy says only FCP deployments with the GWS component installed since 2020 are affected, spanning FCP versions 3.4.0 through 4.1.1. The company’s advisory 8DBD000229 outlines remediation; interim mitigations include isolating control systems behind firewalls, requiring VPNs for remote access and enforcing strong password policies.

    Why it matters

    FACTS platforms sit inside the control layer that keeps transmission voltage stable — CISA lists the affected sector as Energy, and a successful chained exploit could let an authenticated attacker manipulate grid-stabilization logic rather than simply steal data.

    Sources