We’re Tracking the Future of Security

Author: Osiris

  • Thales Launches UK-Hosted Luna Cloud HSM Service

    Thales Launches UK-Hosted Luna Cloud HSM Service

    Thales announced on September 14 a UK-hosted version of Luna Cloud HSM, its hardware-security-module capability delivered as a cloud service. The company says customer keys can be generated, stored, used, backed up and destroyed within UK-hosted infrastructure.

    Two UK instances are intended to support availability and disaster recovery within the country. The service is positioned for organizations that need to separate the location of application data from control of the cryptographic keys used to protect it.

    Claims about service architecture and compliance originate with Thales and should be treated as vendor statements unless checked against the relevant independent validation records and customer-specific configuration. UK hosting also does not remove the need for access governance, backup policy and key-lifecycle controls.

    Why it matters

    Data residency answers where data is stored; key sovereignty asks who can authorize decryption and under which jurisdiction. Regulated organizations increasingly need evidence for both questions when evaluating cloud security architecture.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • Indonesia Says IKD Digital ID Has Passed 20.5 Million Users

    Indonesia Says IKD Digital ID Has Passed 20.5 Million Users

    Indonesia’s Directorate General of Population and Civil Registration says 20,598,478 residents had activated Identitas Kependudukan Digital, or IKD, by the first half of 2026. The authority presented the figure alongside broader electronic identity registration data.

    The official account describes IKD as a gateway to multiple public services rather than only a digital copy of a physical identity card. Biometric Update separately reported the figures and noted continuing barriers involving connectivity, smartphone access and digital literacy.

    Adoption counts show reach, not security performance. They do not on their own demonstrate fraud resistance, service availability or equitable access, and those outcomes need separate operational evidence.

    Why it matters

    National digital identity becomes critical infrastructure as more services depend on it. Growth should be matched by resilient enrollment, secure account recovery, accessible alternatives and clear governance for verification data shared across agencies.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • South Africa Seeks Facial Recognition for Police Body and Dashboard Cameras

    South Africa Seeks Facial Recognition for Police Body and Dashboard Cameras

    South Africa’s State Information Technology Agency is seeking a supplier for body-worn cameras, vehicle dashboard cameras and supporting software for the national police. Public tender information describes facial recognition, automatic number-plate recognition and integration with other security platforms.

    The procurement is described as a three-year contract including training and maintenance. Public documents cited in the reporting do not state a target budget or a final camera quantity, so those fields remain unknown rather than estimated.

    Biometric Update also highlighted unresolved governance questions around police processing of biometric footage. Procurement requirements establish desired technical functions; they do not by themselves demonstrate that privacy, retention, accuracy and redress rules are complete.

    Why it matters

    Body-camera programs combine evidentiary, operational and civil-rights requirements. Buyers need measurable image-quality and audit controls as well as explicit policies for face searching, retention, access and disclosure before deployment.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • Google Pay and Mastercard Plan Device-Biometric Card Payments in India

    Google Pay and Mastercard Plan Device-Biometric Card Payments in India

    Mastercard and Google Pay plan to introduce optional device-biometric approval for eligible card payments in India. Participating customers would use the fingerprint, face recognition or passcode already configured on their phone to approve supported transactions.

    The companies previewed the capability at Global Fintech Fest and expect rollout to begin by the end of 2026. Participating issuers and eligible card products have not yet been publicly specified, so availability should not be described as nationwide or universal.

    The design uses a consumer-device cardholder verification method and is separate from payment tokenization. Tokenization protects card details used in a transaction; local biometric or passcode verification confirms that the person operating the device is authorized to approve it.

    Why it matters

    India’s updated payment-authentication directions allow alternatives to SMS one-time passwords while retaining multi-factor requirements. Device-based verification can improve usability, but secure enrollment, fallback and issuer risk controls remain essential.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • Ukraine Considers Unified Biometrics Law to Align With EU Rules

    Ukraine Considers Unified Biometrics Law to Align With EU Rules

    Ukraine is considering a comprehensive law to standardize how biometric data is defined, collected, stored, accessed and overseen. Reporting on a parliamentary study says the current framework is spread across multiple laws and subordinate acts, creating inconsistent terminology and controls.

    The study recommends clearer processing purposes, retention rules, human-rights safeguards, independent oversight and security and interoperability requirements. It also calls for special treatment of automated facial recognition in law-enforcement and security contexts.

    The proposals are part of a policy process rather than an enacted law. Claims about future obligations therefore need to remain conditional until Ukraine adopts final legislation and publishes its operative text.

    Why it matters

    Unified definitions matter because biometric governance cannot be enforced consistently when agencies use different scopes, retention periods or access rules. Interoperability goals also need privacy, audit and redress mechanisms to avoid turning technical integration into uncontrolled data sharing.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • UK Expands Passkey Sign-In for GOV.UK One Login

    UK Expands Passkey Sign-In for GOV.UK One Login

    The UK government is broadening passkey sign-in for GOV.UK One Login, allowing users to authenticate with a device biometric or local passcode instead of entering a password and a separate security code. The option follows a trial and remains an alternative rather than the only sign-in route.

    Biometric Update reported that more than 300,000 users adopted passkeys during the trial. GOV.UK guidance explains that the biometric template used to unlock a credential stays with the user’s device or credential manager and is not sent to One Login.

    A passkey is distinct from the identity-checking process that may compare a selfie with an identity document. It authenticates possession of a cryptographic credential after an account has been established; it does not independently prove the civil identity behind that account.

    Why it matters

    Public-sector passkey deployments can reduce phishing exposure, but recovery and fallback paths remain part of the security boundary. A strong credential can be undermined if enrollment, account recovery or help-desk processes allow weaker impersonation routes.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • Cisco Secure Email Gateway Zero-Day Added to CISA Exploited Vulnerabilities Catalog

    Cisco Secure Email Gateway Zero-Day Added to CISA Exploited Vulnerabilities Catalog

    Cisco has disclosed CVE-2026-76461, a vulnerability affecting Secure Email Gateway and Secure Email and Web Manager software that can allow an unauthenticated attacker to execute commands with root privileges under vulnerable conditions. Cisco’s advisory provides the affected-version and remediation details.

    The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on September 14, confirming evidence of exploitation in the wild. That designation does not identify every victim or attacker, but it materially changes patch priority.

    Email gateways are high-value perimeter systems because they inspect untrusted content and often hold privileged network positions. Defenders should follow Cisco’s exact guidance, review appliance logs and avoid relying on exposure assumptions that have not been tested.

    Why it matters

    An exploited edge-device vulnerability can bypass controls deeper inside the network. Asset owners need authoritative version checks, rapid remediation and post-compromise review, because installing a fix does not by itself remove persistence created before patching.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • Compromised HBO Max Reddit Account Used in ClickFix Malware Campaign

    Compromised HBO Max Reddit Account Used in ClickFix Malware Campaign

    Researchers at ADAMnetworks and Hudson Rock have reported that a compromised Reddit account associated with HBO Max was used to distribute promoted posts leading to a ClickFix-style infection path. SecurityWeek published an independent summary of the findings on September 15.

    ClickFix campaigns rely on social engineering: victims are shown instructions that persuade them to copy or run commands presented as a repair or verification step. The technique abuses the user’s own trusted tools rather than depending only on a silent browser exploit.

    The incident also demonstrates the distribution power of a verified or recognizable brand account. When an attacker gains access to a marketing channel, paid promotion and brand familiarity can amplify malicious content before platform or account owners detect it.

    Why it matters

    Organizations need to protect social-media and advertising accounts with the same identity controls used for other business systems. Monitoring should include unexpected campaign creation, changed recovery settings and anomalous administrator sessions, not only public posts.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • Microsoft Publishes AI Code of Conduct for Cybersecurity Operations

    Microsoft Publishes AI Code of Conduct for Cybersecurity Operations

    Microsoft has published a Humanist AI Code of Conduct that addresses how advanced AI systems should be governed when used for cybersecurity. The document draws a line between defensive research and operational attack capability and emphasizes a clear chain of human responsibility.

    The code frames authorization, proportionality and escalation as design requirements rather than optional policy language. It also describes constraints intended to prevent autonomous systems from moving from analysis into harmful action without accountable decision-making.

    SecurityWeek’s coverage highlights the significance of the document for AI-enabled cyber operations. The code is a Microsoft policy position, not a statute or independent technical certification, and organizations adopting similar principles still need enforceable controls, logging and review.

    Why it matters

    AI systems can compress the time between discovery and action. Governance therefore has to be translated into identity controls, scoped permissions, audit trails and reliable stop conditions; a written code alone cannot provide those technical safeguards.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • Apple Releases iOS 27 and macOS 27 Security Updates Covering 200 Flaws

    Apple Releases iOS 27 and macOS 27 Security Updates Covering 200 Flaws

    Apple has published security notes for iOS 27, iPadOS 27 and macOS Golden Gate 27, documenting fixes across the kernel, WebKit and multiple system components. SecurityWeek’s review counted roughly 200 vulnerability entries across the releases.

    The issues span memory corruption, privilege escalation, information exposure and application or system termination. Counts across Apple bulletins can overlap because a vulnerability may affect more than one platform, so the figure should be read as the scale of the release set rather than 200 wholly separate attack paths on every device.

    Apple’s security-release page is the authoritative place to check which operating-system version addresses a specific CVE. Administrators should use that device-specific information instead of assuming every fix applies identically to all supported hardware.

    Why it matters

    Large coordinated update sets create an asset-management problem as much as a patching problem. Security teams need accurate device inventories, supported-version visibility and staged deployment plans that reduce exposure without interrupting critical mobile workflows.

    For wider context, see SectechMedia’s related technical coverage.

    Sources