We’re Tracking the Future of Security

Author: Osiris

  • Access Control Cybersecurity: Hardening Controllers, Readers and Credentials

    Access Control Cybersecurity: Hardening Controllers, Readers and Credentials

    Access control systems were once treated as purely physical hardware: a card reader, a controller board and a locked door. Today most systems run over IP networks, store credential databases, and expose management interfaces, which means they carry the same categories of cybersecurity risk as any other networked infrastructure, alongside the physical risk of an unlocked door.

    Controllers Are Endpoints, Not Just Hardware

    Access control panels and controllers are, functionally, small networked computers, and vulnerabilities in their firmware or management interfaces can let an attacker unlock doors, disable alarms, or extract stored credential data without ever touching the building. Recently disclosed flaws in access control and device management platforms have shown that missing authentication or hard-coded credentials in these systems can hand an attacker root-level control, underscoring why manufacturers and integrators treat firmware update discipline and network segmentation as security-critical rather than optional maintenance.

    Weak Credential Technology Is Still Common

    Despite years of known weaknesses, many sites still rely on older low-frequency proximity cards and legacy Wiegand wiring between readers and controllers, both of which can be cloned or intercepted with inexpensive, widely available equipment. Modern smart cards and mobile credentials using encrypted protocols close much of this gap, but only if a site has actually migrated its readers, controllers and credentials together; a modern reader paired with an unencrypted legacy card format, or vice versa, can leave the original vulnerability largely intact.

    Network Segmentation and Monitoring

    Best practice increasingly places access control controllers on a segmented network separate from general office IT traffic, limiting what an attacker who compromises one system can reach from the other. Pairing that segmentation with logging and monitoring of controller and management-software activity helps detect unusual behavior, such as after-hours credential changes or unexpected firmware update attempts, before it results in an unauthorized physical entry.

    FAQ

    Can a cyberattack on access control lead to a physical break-in? Yes. If an attacker gains control of an access control system’s management interface, they may be able to unlock doors, add unauthorized credentials, or disable alarms, translating a network compromise directly into physical access.

    Are older proximity cards insecure? Many legacy low-frequency proximity card formats can be cloned with low-cost, readily available equipment, which is why organizations are increasingly migrating to encrypted smart card or mobile credential technology.

    Should access control systems be on the same network as office computers? Security best practice generally recommends network segmentation, keeping access control controllers and servers on a separate network segment from general office IT traffic to limit the blast radius of a compromise on either side.

  • Airport Security Technology: Layered Perimeter, Screening and Access Control

    Airport Security Technology: Layered Perimeter, Screening and Access Control

    Airports operate one of the most complex physical security environments of any facility type, combining a large outdoor perimeter, high-throughput passenger screening, tightly restricted airside access, and constant coordination with law enforcement and aviation authorities, all while keeping flights moving on schedule.

    Protecting the Airfield Perimeter

    The airfield perimeter, often several miles of fence line separating public areas from runways, taxiways and aircraft, is typically monitored with a combination of fencing, ground radar, thermal cameras and buried or fence-mounted intrusion sensors, since a single unauthorized incursion onto an active runway can halt operations across the entire airport. Larger airports increasingly integrate airfield perimeter sensors with counter-drone detection systems, addressing the growing risk that unauthorized drone activity near runways poses to aircraft during takeoff and landing.

    Passenger and Baggage Screening

    Checkpoint screening combines walk-through metal detectors or millimeter-wave body scanners for passengers with X-ray and, increasingly, computed tomography (CT) scanning for carry-on baggage, giving screeners a rotatable 3D image rather than the flat 2D image older X-ray systems produce. Checked baggage passes through separate, higher-throughput explosive detection systems behind the scenes, and biometric identity verification, typically facial recognition matched against a passport or boarding pass, is increasingly used to speed passengers through checkpoints and boarding gates without manual document checks at every step.

    Controlling Access to Restricted Airside Areas

    Access to the airfield, ramp areas and other restricted zones is controlled through badge-based access control systems layered with biometric verification, since a badge alone does not confirm that the person carrying it is its rightful holder. Airports also enforce strict escorting and challenge procedures for anyone in a restricted area without airport-issued credentials, backed by video surveillance covering gates, ramps and cargo areas to create an audit trail of who accessed which zone and when.

    FAQ

    Why do airports need counter-drone systems? Unauthorized drones near runways and approach paths pose a collision risk to aircraft during takeoff and landing, which has led many larger airports to add drone detection alongside their existing airfield perimeter sensors.

    What is the difference between X-ray and CT baggage screening? Traditional X-ray produces a flat 2D image of a bag’s contents, while CT scanning produces a rotatable 3D image, giving screeners a clearer view of items that might otherwise be obscured or ambiguous in a 2D scan.

    How is facial recognition used at airports? Facial recognition is typically used to match a live photo of a passenger against their passport or boarding pass photo at checkpoints or boarding gates, allowing faster verification than a manual document check.

  • Vehicle Barriers and Bollards: How Anti-Ram Perimeter Protection Actually Works

    Vehicle Barriers and Bollards: How Anti-Ram Perimeter Protection Actually Works

    Bollards and vehicle barriers have become a standard part of perimeter protection at government buildings, stadiums, transit hubs and commercial plazas, driven by a mix of vehicle-ramming attacks and simple traffic accidents. What looks like a decorative post or a low steel arm is, in most professional installations, a rated device engineered and tested to stop a specific vehicle at a specific speed.

    Fixed, Removable and Automatic Bollards

    Fixed bollards are permanently anchored and offer the highest reliability since there is no mechanism to fail, but they permanently block the space they occupy. Removable or retractable bollards can be taken out of the ground or lowered to allow authorized vehicle access, trading some convenience for a manual or semi-manual operating step. Automatic bollards rise and lower on command from an access control system, gate operator or guard station, letting a single lane serve both pedestrians and authorized vehicles without a fixed barrier permanently occupying the space, at the cost of added mechanical and power complexity that must be maintained.

    Crash Ratings Are Not Marketing Claims

    Serious perimeter security specifications reference independent crash-rating standards, most commonly the US State Department’s K-rating system and ASTM F2656, which test a barrier against a vehicle of a defined weight striking it at a defined speed and measure how far the vehicle penetrates past the barrier line after impact. A barrier rated to stop a 15,000-pound vehicle at 40 miles per hour behaves very differently in a real event than an unrated decorative post that merely looks similar, which is why security consultants specify barriers by their tested rating rather than their appearance.

    Barriers as Part of a Layered Approach

    Bollards and barriers are typically combined with standoff distance, planters, retaining walls, sloped grading and other landscape features that a site’s architects can use to keep vehicles away from a building without visually presenting as a fortress. Security planners generally treat the vehicle barrier line as the outermost layer of a broader protection plan that also includes access control, video surveillance and, at higher-risk sites, manned checkpoints, rather than as a standalone solution to vehicle-borne threats.

    FAQ

    What is a K-rating? K-ratings are a US State Department classification system that rates a barrier’s ability to stop a vehicle of a specified weight traveling at a specified speed, based on independent crash testing.

    Can automatic bollards fail open or closed during a power outage? Behavior varies by product and installation; many automatic bollards are specified to fail in a particular position (safe, secure, or last-known-state) depending on site requirements, which is a key design decision during installation.

    Do decorative bollards provide real vehicle protection? Only if they carry an independent crash rating for the intended threat vehicle and speed. Purely decorative posts without a tested rating should not be relied on to stop a vehicle.

  • Consumer Cybersecurity Firm Guardio Reaches $1.1 Billion Valuation as Wiz Co-Founder Invests

    Consumer Cybersecurity Firm Guardio Reaches $1.1 Billion Valuation as Wiz Co-Founder Invests

    Guardio, a consumer cybersecurity company focused on protecting individuals from online scams and phishing, has raised $40 million in new funding at a valuation of $1.1 billion, with Wiz co-founder and chief executive Assaf Rappaport joining as an investor.

    Four Straight Years of Triple-Digit Growth

    The round, announced September 3, 2026, also included existing investors ION Crossover Partners, Union Tech Ventures, Vintage Investment Partners, Cerca Partners and Emerge Ventures, and brings Guardio’s total funding to date to $167 million. The Israeli company said it has grown revenue more than 100% year over year for four consecutive years, surpassing one million paying customers and $150 million in annual recurring revenue. Guardio plans to use the new capital to expand its suite of consumer-focused protection tools covering browsing, phishing and broader digital-presence risks.

    AI Cuts Both Ways for Consumer Fraud

    Gilad Shany, managing partner at ION Crossover Partners, said the company’s combination of cybersecurity expertise, consumer-product focus and distribution reach was behind the sustained growth. Rappaport, who invested personally in the round, pointed to artificial intelligence as a factor reshaping the threat landscape for ordinary consumers, making phishing, brand impersonation and deepfake voice scams more convincing and harder to distinguish from legitimate communication. Guardio’s raise adds to a run of large valuations for Israeli cybersecurity companies in 2026, as consumer-facing security products compete for a growing pool of capital alongside enterprise-focused vendors.

  • Researchers Build Zero-Click Worm That Hijacked WeChat Accounts via a Single Call

    Researchers Build Zero-Click Worm That Hijacked WeChat Accounts via a Single Call

    Security researchers at the firm Calif built a working worm capable of hijacking WeChat accounts on both iOS and Android through a single incoming call, then using the compromised account to spread automatically to the victim’s contacts, in what the company describes as the first zero-click worm demonstrated against a mainstream messaging app on both platforms.

    Attacker Calls Victim, Victim Becomes Attacker

    In a demonstration published September 8, 2026, Calif showed an Android phone calling an iPhone and taking over its WeChat account while the phone was still ringing, with no answer or user interaction required. The compromised iPhone then called a second Android phone and took control of it the same way, illustrating a self-propagating chain: attacker calls victim, victim becomes attacker, victim calls the next victim. Calif said the underlying issue is a memory-corruption bug in WeChat’s VoIP stack, and that because the caller must already be on the target’s contact list, the extra trust WeChat extends to contacts ends up working in the attacker’s favor once one account in a network is compromised. Once hijacked, an account can read and send messages, place calls, and act on the victim’s behalf.

    Patched Before Public Disclosure

    Calif reported the flaw to WeChat developer Tencent in July, and Tencent shipped version 8.0.77 for Android and 8.0.76 for iOS on August 21, 2026, mitigating the bug; Calif confirmed on August 28 that the specific exploit was also blocked on Tencent’s servers for all users regardless of app version. Tencent has not published a security advisory describing the flaw, and its release notes for the affected updates describe them only as general bug fixes. Researchers are advising WeChat users to keep the app updated, review their contact lists for unfamiliar connections, and treat unexpected incoming calls from known contacts with caution, since a compromised contact’s account could be used to continue the propagation chain.

  • Alby Discloses Critical Flaw in Internet-Exposed Bitcoin Lightning Wallets

    Alby Discloses Critical Flaw in Internet-Exposed Bitcoin Lightning Wallets

    Alby, the company behind the Bitcoin Lightning Network and Nostr tooling suite Alby Hub, has disclosed a critical vulnerability affecting older versions of its self-hosted Lightning wallet that could let an attacker take over and drain funds from any instance left reachable from the public internet.

    Unauthenticated Access to the Management API

    In a disclosure posted September 9, 2026, Alby said it had confirmed a critical flaw in Alby Hub versions 1.7.0 through 1.18.5, released before August 2025, when the Hub is publicly accessible from the internet. According to the company, an attacker who can reach the Hub’s management API over the network can access it without authorization and send funds out of the wallet, effectively draining any exposed node. Alby urged affected users to immediately take internet-exposed instances offline, update to a patched version, and change their unlock password after updating, since the credential itself could have been exposed during the window the Hub was reachable.

    Part of a Rough Stretch for Lightning-Adjacent Projects

    The disclosure follows a difficult few weeks for Lightning Network-adjacent infrastructure: Boltz, a separate non-custodial bridge that moves bitcoin between the main chain, the Lightning Network and the Liquid Network, took its swap functionality offline on August 3, 2026, after its own security issue, and Bitcoin’s Liquid Network separately suffered a $320 million theft that white-hat hackers later helped partially recover. Security researchers have pointed to the growing use of AI-assisted attack tooling as a factor putting increased pressure on smaller, self-hosted Bitcoin infrastructure projects that lack the security resources of larger custodial platforms.

  • Critical Red Hat Flaw Let Low-Privileged Tenants Seize Control of Managed Kubernetes Clusters

    Critical Red Hat Flaw Let Low-Privileged Tenants Seize Control of Managed Kubernetes Clusters

    A critical vulnerability in Red Hat Advanced Cluster Management for Kubernetes (RHACM) could let a low-privileged tenant on a central hub cluster seize administrative control of any Kubernetes cluster it manages, according to Red Hat’s own advisory on the flaw.

    An Unvalidated Annotation Opens the Door

    Tracked as CVE-2026-72526 and carrying a CVSS score of 9.9, the flaw sits in the multicloud-integrations component that RHACM uses to propagate applications from a central hub cluster to the individual managed, or “spoke,” clusters it oversees. The Application propagation controller processes an ocm-managed-cluster annotation on an Application custom resource without properly validating it, which means a tenant who only has permission to create Applications on the hub can direct that annotation at any managed cluster of their choosing, not just their own. Doing so forces ArgoCD on the targeted spoke cluster to synchronize manifests the attacker controls, resulting in arbitrary code execution or privilege escalation on a cluster the tenant was never authorized to touch.

    A Direct Route From Low Privilege to Cluster-Admin

    Because the underlying authorization check is missing entirely rather than merely weak, the flaw gives a low-privileged hub tenant a direct path to cluster-admin rights on infrastructure well outside their own environment, a significant multi-tenant isolation failure for organizations running shared RHACM hubs across business units or customers. Red Hat has published fixed component versions in its advisory and accompanying Bugzilla report; organizations running RHACM are advised to apply the update and confirm that the propagation controller correctly enforces tenant-scoped cluster authorization after upgrading, alongside reviewing who currently holds Application-creation permissions on their hub clusters.

  • Fileless Rootkit ‘PoisonedRefresh’ Found Hiding Web Shells in F5 BIG-IP Memory

    Fileless Rootkit ‘PoisonedRefresh’ Found Hiding Web Shells in F5 BIG-IP Memory

    Researchers at Sophos and ESET detailed a stealthy Linux rootkit, dubbed PoisonedRefresh, discovered on compromised F5 BIG-IP Access Policy Manager (APM) appliances, Help Net Security reported. The implant hooks Apache’s PHP module loader to inject a web shell directly into memory, never writing to disk, making it difficult to detect with conventional file-based scanning.

    The activity is tied to exploitation of CVE-2025-53521, a critical unauthenticated remote-code-execution flaw that F5 originally classified as a denial-of-service issue before reclassifying it. F5 has confirmed exploitation, and Shadowserver was tracking 795 internet-exposed vulnerable BIG-IP APM endpoints as of September 7, 2026. The findings were independently corroborated by BleepingComputer, SecurityAffairs and CybelAngel.

    Why it matters: F5 BIG-IP APM is widely deployed by government, financial and critical-infrastructure organizations to manage secure remote access. A memory-resident rootkit that survives file-based detection on this class of device represents a significant, hard-to-spot foothold inside networks that are supposed to be tightly controlled.

    Source: Help Net Security, September 9, 2026.

  • ShieldCrash PoC Bypasses Recent Microsoft Defender Patch, Grants SYSTEM Access

    ShieldCrash PoC Bypasses Recent Microsoft Defender Patch, Grants SYSTEM Access

    A security researcher known as Nightmare Eclipse released a proof-of-concept exploit dubbed ShieldCrash that bypasses Microsoft’s patch for an earlier Windows Defender privilege-escalation flaw, CVE-2026-69414 (nicknamed ShieldBreak), which had been patched only days earlier on Microsoft’s September 2026 Patch Tuesday, BleepingComputer reported. The bypass was independently corroborated by The Register and SecurityAffairs.

    According to the report, the ShieldCrash proof-of-concept allows arbitrary file reads with SYSTEM-level privileges on fully patched Windows 10, 11 and Server installations.

    Why it matters: Defender is the default endpoint-security product on most Windows deployments, including systems inside OT and critical-infrastructure environments. A public proof-of-concept that defeats a just-shipped patch for a SYSTEM-level flaw creates pressure for organizations to apply Microsoft’s next round of fixes quickly and to monitor for exploitation in the interim.

    Source: BleepingComputer, September 9, 2026.

  • CISA Warns of Actively Exploited Citrix NetScaler Authentication-Bypass Flaw

    CISA Warns of Actively Exploited Citrix NetScaler Authentication-Bypass Flaw

    CISA has added CVE-2026-19490, a CVSS 9.3 authentication-bypass vulnerability in Citrix NetScaler ADC and Gateway appliances configured as a gateway or AAA virtual server, to its Known Exploited Vulnerabilities (KEV) catalog, SecurityWeek reported. Exploitation in the wild has been confirmed since at least September 3, 2026.

    Citrix patched the flaw on August 19, 2026. Under Binding Operational Directive 26-04, federal civilian agencies have a three-day remediation window once a KEV entry is added. The exploitation has been independently corroborated by Rapid7, Belgium’s CCB, and security firm RedLegg.

    Why it matters: NetScaler ADC and Gateway appliances sit at the network perimeter of a huge number of enterprises and government agencies, frequently providing VPN and remote-access functionality. An authentication-bypass flaw at this layer is a direct path into internal networks — including those of critical-infrastructure operators — for any attacker who has not yet patched.

    Source: SecurityWeek, September 2026; CISA KEV catalog.