We’re Tracking the Future of Security

Author: Osiris

  • Sam Altman’s World Launches Iris-Verified ‘World Money’ App Across 150+ Countries

    Sam Altman’s World Launches Iris-Verified ‘World Money’ App Across 150+ Countries

    World, the identity and cryptocurrency project from Tools for Humanity co-founded by Sam Altman and Alex Blania, launched “World Money,” a self-custodial financial app now live in more than 150 countries supporting balances in eight currencies. The app integrates Stripe for converting Apple Pay funds to stablecoins, Circle’s USDC, Bridge for virtual bank and payroll accounts, Morpho for yield, and Kalshi for prediction-market trading.

    World ID, the platform’s iris-scan-based biometric identity credential, is positioned as an anti-fraud and anti-fake-account layer, with verified users unlocking additional rewards within the app. The launch extends World’s biometric identity infrastructure — built primarily to prove a user is a unique human rather than a bot — into mainstream consumer payments and cross-border finance.

    Why it matters

    Tying a biometric identity credential directly to a payments app is a significant step in normalizing iris-scan verification for everyday financial transactions, a use case with different privacy and consent stakes than the anti-bot verification World was originally built for.

    Sources

  • Texas School District Rolls Out AI Weapons-Detection Scanners at Elementary and Middle School Entrances

    Texas School District Rolls Out AI Weapons-Detection Scanners at Elementary and Middle School Entrances

    Center Independent School District in Texas is deploying AI-based weapons-detection scanners at every student and visitor entry point across three campuses, phasing the rollout in day by day: F.L. Moffett Elementary, Center Elementary and Center Middle School. Superintendent Jake Henson described the deployment as “a proactive measure … designed to provide an additional layer of safety and security for our students, staff, and visitors.”

    The district released an explanatory video covering how the system works and outlining new entry procedures for students and visitors adjusting to the scanners. No cost or budget figures were disclosed publicly alongside the rollout.

    Why it matters

    AI weapons-detection scanners are becoming a routine capital purchase for US school districts, but they also raise questions — being litigated elsewhere — about liability when a system misses a threat, making transparent rollout communication like this district’s explainer video part of managing that risk.

    Sources

  • CISA Flags Command-Injection and SQL Injection Flaws in Schneider Electric NetBotz Monitors

    CISA Flags Command-Injection and SQL Injection Flaws in Schneider Electric NetBotz Monitors

    CISA published an advisory covering two vulnerabilities in Schneider Electric’s NetBotz 5 appliances, which provide video, door-contact, leak, smoke, vibration, temperature and humidity monitoring for data centers and industrial facilities. CVE-2026-13336 is an OS command-injection flaw reachable through a maliciously modified backup-restore file, rated 6.4 (Medium) on the CVSS v3.1 scale. CVE-2026-13337 is a SQL injection flaw in the appliance’s web interface, rated 4.6 (Medium).

    Both vulnerabilities affect NetBotz software versions 5.5.2 and earlier. Schneider Electric has released version 5.6.0 to remediate both issues. CISA lists the affected sectors as Commercial Facilities, Critical Manufacturing and Information Technology, with unpatched devices at risk of arbitrary code execution, device manipulation or unauthorized data access.

    Why it matters

    NetBotz appliances are themselves security and environmental monitoring equipment installed inside data centers — a vulnerability in the monitor undermines the very physical-security function the device is deployed to provide.

    Sources

  • FERC Approves Tougher NERC Physical Security Standard for Critical Power Substations

    FERC Approves Tougher NERC Physical Security Standard for Critical Power Substations

    The Federal Energy Regulatory Commission has approved a revised reliability standard, CIP-014-4, developed by the North American Electric Reliability Corporation to strengthen physical security requirements for critical bulk-power transmission substations and control centers. The standard applies to facilities whose loss or damage could trigger cascading failures across the grid, and the revision tightens the timelines utilities must follow when conducting risk assessments of those facilities.

    The order also clarifies which facilities fall under the standard’s scope and increases the rigor required for third-party verification of risk and vulnerability evaluations. FERC simultaneously approved retirement of the prior standard, CIP-014-3, with utilities given a multi-year runway to reach compliance with the new requirements.

    Why it matters

    Physical attacks on substations — from gunfire to intrusion — have repeatedly knocked out power to thousands of customers in recent years; a tighter, more consistently enforced risk-assessment standard is meant to close gaps in which facilities utilities have historically been required to protect.

    Sources

  • Coast Guard and FBI Board Oil Tankers After Cyberattacks Reach Engine-Room Systems

    Coast Guard and FBI Board Oil Tankers After Cyberattacks Reach Engine-Room Systems

    The US Coast Guard and FBI boarded at least two foreign-flagged, US-bound oil tankers in the Gulf of Mexico — including the Liberian-flagged VL Prosperity — on August 21 and August 24, 2026, after detecting evidence that the vessels’ onboard networks had been compromised. Coast Guard Rear Adm. Amy Grable confirmed “evidence of a malicious cyber actor” on the ship’s IT/OT systems, though the Coast Guard has not attributed the intrusion to any state actor. A joint team of Coast Guard cyber specialists, a vessel inspector and an FBI Cyber Action Team spent four days aboard the VL Prosperity.

    Iran’s Mehr News Agency separately reported that the VL Prosperity suffered a cyberattack on August 7 while transiting the Strait of Gibraltar, alleging the intrusion reached engine-room systems — altering coolant flow, engine speed and fuel delivery — and knocked out communications for roughly 30 hours; those specific technical claims have not been confirmed by the Coast Guard. Officials say there is no evidence the vessels operated unsafely, and the Coast Guard says it has conducted an estimated 40-50 similar cyber-related boardings over the past year.

    Why it matters

    Commercial vessels increasingly run networked engine, navigation and fuel-management systems that were not designed with the same threat model as IT networks — an attacker reaching those systems mid-voyage, even briefly, raises the kind of physical-safety stakes that a typical office network breach does not.

    Sources

  • Cohere and Aleph Alpha Finalize $20B Merger to Build ‘Sovereign AI’ Alternative

    Cohere and Aleph Alpha Finalize $20B Merger to Build ‘Sovereign AI’ Alternative

    Canada’s Cohere and Germany’s Aleph Alpha signed a definitive merger agreement, combining into a single business that will operate under the Cohere name with dual headquarters in Toronto and Berlin. Aleph Alpha’s Heidelberg office will focus on research under the combined company, and Aleph Alpha co-chief Ilhan Scheer becomes chief operating officer of the merged entity.

    Lidl parent Schwarz Group is investing 500 million euros in the combined company as part of the deal, which was first disclosed in April 2026 at an estimated $20 billion valuation. The transaction remains subject to regulatory approval. Cohere chief executive Aidan Gomez said the merger is meant to meet demand from government and enterprise customers for AI systems that are “powerful enough to compete, but secure and governable enough to trust,” particularly customers wanting data residency and independence from US cloud providers.

    Why it matters

    Governments and regulated industries in Europe have been pushing for AI infrastructure they can host and control domestically rather than relying on US hyperscalers — a combined Cohere-Aleph Alpha is explicitly positioning itself to serve that “sovereign AI” demand.

    Sources

  • King Charles Convenes Nvidia, OpenAI, Anthropic and DeepMind Leaders for AI Safety Summit

    King Charles Convenes Nvidia, OpenAI, Anthropic and DeepMind Leaders for AI Safety Summit

    King Charles III hosted senior leaders from Nvidia, OpenAI, Google DeepMind and Anthropic at Dumfries House in Ayrshire, Scotland, for a summit on AI safety organized by the Ditchley Foundation. Reported attendees included Nvidia chief executive Jensen Huang, Google DeepMind founder Demis Hassabis and OpenAI chief financial officer Sarah Friar.

    Discussion topics reportedly included whether the AI industry needs a shared code of conduct and how autonomous AI agents can be advanced responsibly. The gathering is a separate, multi-stakeholder dialogue distinct from the public disagreement between Nvidia’s Huang and Anthropic and OpenAI executives over the pace of AI safety measures reported earlier this week.

    Why it matters

    A UK monarch-convened, closed-door summit signals that governments outside the US are trying to build their own channels of influence over frontier AI labs’ safety practices, rather than leaving the conversation entirely to Washington and the companies themselves.

    Sources

  • Ransomware Attacks on Manufacturers Rose Nearly 40% in First Half of 2026, Report Finds

    Ransomware Attacks on Manufacturers Rose Nearly 40% in First Half of 2026, Report Finds

    Cyber-risk intelligence firm Black Kite reported 1,183 manufacturing-sector ransomware victims in the first seven months of 2026, a nearly 40% increase year-over-year, with attacks on the sector more than doubling since 2023. Manufacturing accounted for 22% of all 7,551 ransomware disclosures the firm tracked across all industries in the period.

    The report found newer ransomware groups — including The Gentlemen, which alone claimed 142 manufacturing victims, along with Qilin, Akira, DragonForce and INC Ransom — have displaced the threat-actor groups that previously dominated the sector. Black Kite said 73% of attacks hit mid-market companies, with a median victim revenue of $42.9 million, and that European victim counts rose 85.4% year-over-year while the US share of global victims fell from 52.3% to 34.8%.

    Why it matters

    The shift toward mid-market manufacturers suggests attackers are increasingly targeting companies that may have less mature security operations than large enterprises but still enough revenue — and enough dependence on continuous production — to make ransom payment attractive.

    Sources

  • Airwise and UAS Sentry Integrate Remote ID Drone Detection Into Airspace Platform

    Airwise and UAS Sentry Integrate Remote ID Drone Detection Into Airspace Platform

    Airwise Solutions and UAS Sentry announced a partnership integrating UAS Sentry’s Nexus Remote ID drone-detection capability into Airwise’s Nexus operational airspace platform. The integration displays detected Remote ID signals from nearby drones alongside an organization’s own drone operations, airspace data, mission activity, telemetry, FAA services and weather in a single operating picture.

    The companies are targeting critical infrastructure operators, utilities, energy sites, public-safety agencies, airports and industrial facilities that need visibility into unauthorized drone activity in their airspace — not just their own fleet’s operations.

    Why it matters

    Remote ID data gives facility operators a legal, standards-based way to see who is flying a drone nearby without deploying their own detection hardware, which lowers the barrier to basic airspace awareness for sites that can’t justify a full counter-UAS system.

    Sources

  • Hardcoded Cryptographic Keys in Wärtsilä Ship Management Software Rated Critical

    Hardcoded Cryptographic Keys in Wärtsilä Ship Management Software Rated Critical

    CISA disclosed two critical vulnerabilities in Wärtsilä FOS-Onboard, fleet-management software used aboard vessels, after the flaws were reported by maritime cybersecurity firm Cydome Security. CVE-2026-78225, rated 9.1 to 9.5 depending on scoring version, is a hardcoded cryptographic server key in the software’s Update Controller component that could let an attacker deliver an unauthorized software update or execute code on affected systems.

    A second flaw, CVE-2026-81855, is a hardcoded client authentication key in a robot-testing-framework component that could let an attacker extract credentials and impersonate a privileged client. Wärtsilä said the vulnerabilities are not exploitable under its recommended installation configuration and has made a patch available to customers on request. CISA lists the affected sector as Transportation Systems, with deployment worldwide.

    Why it matters

    Hardcoded keys are a recurring failure mode in operational technology because they can’t be rotated the way a normal credential can — once exposed, every deployed unit sharing that key is affected until firmware is patched.

    Sources