We’re Tracking the Future of Security

Author: Osiris

  • Optus Apologizes After Network Outage Disrupts Emergency Calls Across Three Australian States

    Optus Apologizes After Network Outage Disrupts Emergency Calls Across Three Australian States

    Optus, Australia’s second-largest telecommunications carrier, apologized for a 76-minute technical glitch on September 11 that disrupted voice calling — including some emergency-services calls — across Victoria, South Australia, Tasmania and the Northern Territory, Reuters reported.

    The outage follows a 2025 Optus emergency-calling failure that resulted in two deaths, drawing renewed government scrutiny of telecom resilience as a form of critical infrastructure.

    Why it matters: Repeated emergency-calling failures at a major national carrier underscore why telecom networks are increasingly treated as critical infrastructure in their own right, subject to resilience and redundancy requirements comparable to power and water utilities, rather than purely commercial service-quality standards.

    Source: Reuters, September 12, 2026.

  • Smoke Control and Stairwell Pressurization: How Buildings Manage Smoke During a Fire

    Smoke Control and Stairwell Pressurization: How Buildings Manage Smoke During a Fire

    In most building fires, smoke inhalation rather than direct burns is the primary life-safety threat, which is why modern fire protection engineering treats smoke control as a distinct discipline from fire suppression. Sprinklers and fire-rated construction address the fire itself; smoke control systems address keeping escape routes usable while that fire is being dealt with.

    Why Smoke Is the Primary Threat

    Smoke spreads faster than fire, traveling through stairwells, elevator shafts, and HVAC ductwork well beyond the room of origin, and can rapidly make normally survivable spaces impassable due to reduced visibility and toxic combustion products. In high-rise buildings, where full evacuation to ground level can take significant time, keeping stairwells and refuge areas smoke-free during that evacuation window is often more operationally critical than the fire suppression response itself.

    Stairwell Pressurization

    Stairwell pressurization systems use dedicated fans to maintain the stairwell at a higher air pressure than the adjacent floor spaces, so that when a stairwell door opens during an evacuation, air flows outward from the stairwell into the fire floor rather than allowing smoke to flow into the stairwell. This positive-pressure design is what keeps a high-rise egress stairwell usable even on a floor where a fire is actively burning nearby.

    Getting pressurization right is a balancing act: too little pressure fails to keep smoke out, while excessive pressure can make stairwell doors difficult for occupants, particularly those with limited mobility, to physically open against the pressure differential during an evacuation.

    Smoke Zones and Compartmentation

    Large-footprint and high-rise buildings are typically divided into smoke zones, with smoke barriers, dampers and dedicated exhaust systems designed to contain smoke within the zone of origin rather than letting it spread building-wide. On fire alarm activation, building automation systems can trigger dedicated smoke-zone exhaust fans to actively remove smoke from the affected zone while supply fans elsewhere maintain pressure differentials that keep smoke from migrating into unaffected areas.

    Elevator Smoke Control

    Elevator shafts present a particular smoke-control challenge, since they can act as a chimney, rapidly drawing smoke through the building via stack effect. Elevator lobbies in modern high-rises are frequently designed with their own pressurization or smoke-purge systems, both to keep elevators usable for firefighter access during an incident and to prevent the shaft itself from becoming a smoke-distribution pathway to upper floors.

    Conclusion

    Smoke control engineering rarely gets the visibility that fire suppression systems do, but it is frequently the difference between a stairwell that remains usable throughout an evacuation and one that becomes impassable within minutes. Building code requirements for smoke control scale with building height and occupancy specifically because the failure mode — a filled, unusable egress route — is one of the most consequential outcomes a fire protection system is designed to prevent.

  • Two-Person Integrity: Dual Authorization Access Control for High-Consequence Areas

    Two-Person Integrity: Dual Authorization Access Control for High-Consequence Areas

    For most secured spaces, the security question is simply who should be allowed in. For a narrower category of high-consequence areas — pharmaceutical controlled-substance vaults, cash-handling rooms, weapons storage, sensitive server rooms, certain industrial control rooms — the more important question is whether any single individual should ever be able to gain access alone at all. Two-person integrity (2PI) access control exists to enforce that no single person can act unilaterally in these spaces.

    The Core Principle

    Two-person integrity requires two separately authorized, distinct individuals to be simultaneously present to gain and maintain access to a controlled area, rather than one person’s credential being sufficient on its own. The underlying goal isn’t distrust of any specific individual; it’s structural risk reduction — removing the possibility that a single compromised credential, a single coerced employee, or a single person acting alone can result in unauthorized access to the most consequence-sensitive spaces in a facility.

    How It’s Implemented

    The most common implementation requires two independent, valid credential presentations within a defined time window before an access control system will unlock a controlled door, with the system explicitly rejecting a second scan from the same credential to prevent a single person defeating the control by badging twice. More rigorous implementations pair this with biometric verification for each individual, video confirmation that two distinct people are actually present, and logging that records both individuals’ identities against the access event, not just the fact that “two-person” access occurred.

    Handling the Exit Side

    Two-person integrity is often designed asymmetrically: exit typically doesn’t require the same dual authorization as entry, both because life-safety egress requirements generally take precedence and because the security concern is usually about who can initiate access to the controlled area, not who can leave it. Facilities implementing 2PI need to explicitly define this asymmetry rather than assuming it, since an overly rigid two-person requirement on egress can itself become a life-safety problem during an emergency.

    Where It Breaks Down in Practice

    The most common practical failure of two-person integrity isn’t a technology gap but a workflow one: when staffing is tight, employees under pressure to get a task done sometimes badge a colleague in and then leave, defeating the “simultaneous presence” requirement the control depends on. Facilities that rely on 2PI for genuinely high-consequence areas need staffing models and monitoring that make the control practically sustainable, not just technically correct on paper.

    Conclusion

    Two-person integrity is one of the more demanding access control patterns to implement well, because it depends as much on staffing discipline and monitoring as on the underlying credential technology. For the narrow set of areas where the consequence of a single unauthorized entry is severe enough to justify the operational overhead, it remains one of the more effective structural controls available — but only when the workflow around it is designed as carefully as the access control logic itself.

  • Anthropic Says Accounts in Houthi-Held Yemen Used Claude to Pursue Weapons Programs

    Anthropic Says Accounts in Houthi-Held Yemen Used Claude to Pursue Weapons Programs

    Anthropic’s newest threat-intelligence report, covered by the Associated Press and SecurityWeek, says accounts operating from Houthi-controlled northern Yemen used its Claude Code tool to pursue three separate weapons-development programs, including work toward a hypersonic-glide multi-variant missile design. A field test of a guided rocket associated with the effort reportedly failed.

    Anthropic said the accounts involved have been banned and that, per its assessment, no operational weapon was fielded as a result of this activity.

    Why it matters: The disclosure is one of the more concrete public examples yet of state or non-state actors attempting to use general-purpose AI coding tools to accelerate weapons development, and underscores why AI providers’ own threat-intelligence and account-enforcement programs are increasingly functioning as a frontline layer of defense-relevant security — alongside, not instead of, traditional export-control and nonproliferation controls.

    Source: Associated Press via SecurityWeek, September 11, 2026.

  • AI Agents and Machine Identities Are Now a Leading Initial-Access Vector, Report Finds

    AI Agents and Machine Identities Are Now a Leading Initial-Access Vector, Report Finds

    SpyCloud’s 2026 Identity Threat Report, based on a survey of 750 organizations and covered by SecurityInfoWatch, found that non-human identities — AI agents, service accounts, and API keys — were the leading initial-access vector in 31% of identity-related security incidents.

    The report found a significant confidence gap: 95% of surveyed organizations believe they have adequate visibility into their AI agents and non-human identities, but only 36% actually monitor those identities in practice.

    Why it matters: As enterprises deploy AI agents with their own credentials and permissions across more systems, the attack surface represented by non-human identities is growing faster than most organizations’ identity-governance programs, creating a widening gap between perceived and actual security posture — a pattern directly relevant to any critical-infrastructure operator now integrating AI agents into operational workflows.

    Source: SecurityInfoWatch.com, September 11, 2026, citing SpyCloud’s 2026 Identity Threat Report.

  • Celero Communications Raises $275 Million for AI Data Center Networking Chips

    Celero Communications Raises $275 Million for AI Data Center Networking Chips

    Celero Communications raised a $275 million Series C funding round, valuing the company at $3 billion, Crunchbase News reported. Celero develops coherent digital signal processing (DSP) technology designed to move large volumes of data between chips and across data centers with lower power draw than conventional interconnects.

    The company positions its technology as addressing a growing bottleneck in AI infrastructure: as AI compute clusters scale, the power and bandwidth cost of moving data between chips and data center nodes is becoming a limiting factor alongside compute capacity itself.

    Why it matters: As data center operators race to add compute capacity, interconnect and networking efficiency is emerging as an equally important constraint — directly relevant to the power and cooling infrastructure planning that also shapes data center physical security and site design decisions.

    Source: Crunchbase News, September 11, 2026.

  • Defense Manufacturer Mach Industries Raises $600 Million Series C

    Defense Manufacturer Mach Industries Raises $600 Million Series C

    Huntington Beach, California-based defense manufacturer Mach Industries raised a $600 million Series C funding round led by Ribbit Capital and Sequoia, valuing the company at $3.7 billion, Crunchbase News reported. Mach develops unmanned aircraft, long-range weapons systems and propulsion technology.

    The company said the funding will go toward building infrastructure to produce defense systems at scale, part of a broader wave of venture capital flowing into defense-technology manufacturing in 2026.

    Why it matters: The scale of the round — among the largest for a pure defense-hardware manufacturer this year — reflects a broader shift in venture investment toward physical defense manufacturing capacity rather than purely software-based defense-tech, a trend with downstream implications for the unmanned-systems and counter-UAS markets this publication tracks closely.

    Source: Crunchbase News, September 11, 2026.

  • GitLab Critical Path-Traversal Flaw Exploited One Day After Disclosure

    GitLab Critical Path-Traversal Flaw Exploited One Day After Disclosure

    Security firm WatchTowr observed in-the-wild exploitation of CVE-2026-85706, a maximum-severity (CVSS 10) path-traversal vulnerability in GitLab Community and Enterprise Edition, just one day after GitLab released a patch, SecurityWeek reported. The flaw allows unauthenticated attackers to read arbitrary files from an affected server.

    The same GitLab release also patched a second critical vulnerability, CVE-2026-87719, an insecure-deserialization flaw in GitLab’s GraphQL implementation.

    Why it matters: A one-day gap between patch release and confirmed exploitation leaves almost no window for organizations to apply updates before attackers act, underscoring why source-code and DevOps infrastructure — not just perimeter network gear — needs to be included in any organization’s emergency-patching runbook.

    Source: SecurityWeek, September 11, 2026.

  • EU Cyber Resilience Act’s 24-Hour Vulnerability Reporting Mandate Takes Effect

    EU Cyber Resilience Act’s 24-Hour Vulnerability Reporting Mandate Takes Effect

    As of September 11, 2026, manufacturers selling digital products in the European Union must report actively exploited vulnerabilities to ENISA within 24 hours of becoming aware of them, and file a full notification within 72 hours, Dark Reading reported, corroborated by the European Commission’s official Cyber Resilience Act reporting page. Non-compliance can carry fines of up to €15 million.

    The reporting mandate is the first Cyber Resilience Act obligation to take effect, well ahead of the regulation’s full enforcement date in December 2027.

    Why it matters: The 24-hour reporting window is significantly tighter than most manufacturers’ existing vulnerability-disclosure processes, and applies to any company selling connected digital products into the EU market — including physical security hardware vendors such as camera, access control and sensor manufacturers — making early compliance planning a genuine operational deadline rather than a distant regulatory milestone.

    Source: Dark Reading, September 11, 2026, corroborated by the European Commission’s official CRA reporting page.

  • DHS Opens $440.7 Million Governmentwide Competition for Biometric Capture Devices

    DHS Opens $440.7 Million Governmentwide Competition for Biometric Capture Devices

    The Department of Homeland Security has opened bidding on a five-year, $440.7 million multiple-award IDIQ contract (solicitation 70RDA126R00000001) to standardize procurement of biometric capture devices — fingerprint, facial, iris, palmprint and multimodal systems — across DHS components and other federal agencies including the Departments of State and Justice, Washington Technology reported.

    The contract vehicle is intended to replace fragmented, one-off purchasing historically used by DHS’s Office of Biometric Identity Management. Proposals are due September 18, 2026.

    Why it matters: A single large, standardized federal contract vehicle for biometric hardware procurement gives vendors a much larger and more predictable addressable market than the agency-by-agency purchasing it replaces, and is likely to influence which biometric hardware standards and interoperability requirements become de facto norms across other government biometric deployments.

    Source: Washington Technology, September 11, 2026, corroborated by FedScoop and ID Tech Wire.