Author: Osiris

  • IBM Completes Acquisition of HRL Laboratories to Bolster Quantum Hardware Roadmap

    IBM Completes Acquisition of HRL Laboratories to Bolster Quantum Hardware Roadmap

    IBM announced on August 26, 2026, that it has completed its acquisition of HRL Laboratories, a research institution previously jointly owned by Boeing and General Motors, adding capabilities in silicon-spin qubits, quantum sensing, cryogenics, and advanced packaging to IBM’s quantum computing program, according to IBM’s own newsroom announcement and corroborating coverage from The Quantum Insider and Quantum Computing Report.

    HRL’s expertise in silicon-spin qubit fabrication is intended to complement IBM’s existing leadership in superconducting quantum computing, giving the company a second qubit modality to draw on as it pursues a multi-modality hardware roadmap. HRL’s silicon fabrication processes are expected to be integrated into Anderon, IBM’s dedicated quantum wafer foundry established earlier this year.

    Boeing and GM Retain a Role in Quantum Applications

    Boeing and General Motors, HRL’s former joint owners, will continue to partner with IBM and HRL on quantum applications and advanced technology development following the deal’s close, according to IBM’s announcement. The acquisition adds to a broader wave of consolidation and infrastructure investment in quantum computing this year, as government agencies and large technology firms compete to move quantum systems from research labs toward practical, fault-tolerant deployment.

    Financial terms of the acquisition were not disclosed. IBM said HRL’s quantum-sensing and materials-science capabilities, beyond qubit fabrication, are also expected to strengthen its broader hardware development pipeline.

  • Critical Gitea Flaw Under Active Exploitation as Thousands of Servers Remain Unpatched

    Critical Gitea Flaw Under Active Exploitation as Thousands of Servers Remain Unpatched

    A critical vulnerability in Gitea, a widely used self-hosted Git service, is being actively exploited to plant cryptocurrency-mining malware on unpatched servers, according to reporting from The Hacker News and BleepingComputer published August 26 and 28, 2026, and confirmed by vulnerability-tracking service Shadowserver.

    The flaw, tracked as CVE-2026-60004 and carrying a CVSS score of 9.8, allows an attacker with ordinary write access to a repository to execute arbitrary shell commands as the Gitea service account by submitting a malicious patch through the platform’s diffpatch API endpoint. Because Gitea’s default configuration permits open account registration, an unauthenticated attacker can obtain the necessary write access simply by creating an account and a repository, then trigger code execution — researcher Shai Rod (NightRang3r), who is credited with the discovery, described exploitation as achievable in seconds on a default install with zero prior credentials.

    Cryptominer Payloads Observed, CISA Deadline Already Passed

    Shadowserver identified more than 8,300 internet-exposed, vulnerable Gitea instances as of August 27, 2026. The US Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on August 25 and ordered Federal Civilian Executive Branch agencies to patch by August 28. In at least one documented case, a developer’s Gitea instance was compromised by a dropper that cleared environment variables, killed competing processes, and fetched an architecture-specific cryptominer payload before deleting itself — consistent with opportunistic, automated scanning rather than a targeted campaign.

    The vulnerability affects all Gitea versions from 1.17 onward and is fixed in version 1.27.1. Organizations running self-hosted Gitea instances, particularly those with open registration enabled, are advised to patch immediately and review recent repository and account activity for signs of compromise.

  • Waymo Names Munich as Its Third City Outside the US for Driverless Ride-Hailing

    Waymo Names Munich as Its Third City Outside the US for Driverless Ride-Hailing

    Waymo announced on August 28, 2026, that Munich will become its third international city for autonomous ride-hailing, following earlier expansions to London and Tokyo, according to reporting from Euronews. The company said it is laying the operational and regulatory groundwork for a driverless service in the German city but has not set a specific public launch date.

    Waymo pointed to safety data from its US operations to make the case for expansion, citing internal analysis suggesting its autonomous vehicles are involved in significantly fewer serious-injury and fatal crashes per mile than human-driven taxis in the same markets. The company noted that Europe records roughly 20,000 road fatalities annually, with driver error cited as a factor in a majority of crashes, as part of its rationale for prioritizing European expansion.

    Part of a Broader European Push for Autonomous Driving

    The Munich announcement comes as European regulators show growing openness to autonomous and driver-assistance systems more broadly; a recent Dutch approval of Tesla’s Full Self-Driving Supervised system has been followed by similar regulatory movement in Denmark, Lithuania, and Estonia. Waymo already operates fully driverless commercial service across ten US cities, where the company has said it now completes more than half a million paid trips per week.

    Munich’s position as a major automotive-engineering hub, home to BMW and a dense supplier base, is likely to shape how quickly Waymo can secure local regulatory approval and testing partnerships. The company has not disclosed which German authorities it is engaging with or a target timeline for public rides to begin.

  • Hasbro Notifies Employees That Social Security and Financial Data Was Exposed in Cyberattack

    Hasbro Notifies Employees That Social Security and Financial Data Was Exposed in Cyberattack

    Toy and game maker Hasbro has begun notifying current and former employees that a cyberattack exposed their personal and financial information, according to breach notification letters filed with state regulators, including the Massachusetts Attorney General’s Office on August 28, 2026, and reported by BleepingComputer.

    The exposed data varied by individual but could include Social Security numbers, financial account information, credit and debit card numbers, driver’s license details, names, email addresses, and phone numbers. The Massachusetts filing alone identifies 436 affected employees in that state; the total number of individuals notified nationwide was not disclosed in the filing reviewed by BleepingComputer.

    Response and Unresolved Questions on Scope

    Hasbro said it “implemented containment and remediation measures, including disabling the compromised employee account, terminating unauthorized access, and deploying additional safeguards,” and is offering affected individuals complimentary identity-protection services. The company said it has “no indication” the exposed information has been misused.

    Hasbro separately disclosed a cyberattack detected on March 28, 2026, that forced systems offline and contributed to an estimated $25 million in lost revenue during the resulting disruption; the company’s current employee-data notification does not formally confirm whether the two incidents are connected, and BleepingComputer’s reporting treats the link as unconfirmed. The disclosure adds Hasbro to a lengthening list of large employers notifying staff of breach exposure this year, following similar notifications from healthcare and logistics firms including McKesson’s disclosure of a ShinyHunters-linked breach earlier this week.

  • Virginia Tech Opens Counter-UAS Testing and Research Center Backed by $5 Million Army Futures Command Award

    Virginia Tech Opens Counter-UAS Testing and Research Center Backed by $5 Million Army Futures Command Award

    Virginia Tech held a ribbon-cutting ceremony on August 28, 2026, for a new Counter-UAS Testing and Research Center at its Kentland Farms property in Blacksburg, Virginia, a facility the university’s National Security Institute says will support development of drone-defense technology for both the US Army and civilian critical-infrastructure operators, according to Virginia Tech News and local coverage from WSLS.

    The outdoor site is backed by a $5 million award from the US Army Futures Command’s Combat Capabilities Development Command C5ISR Center and gives researchers a real-world, open-air environment to test detection, tracking, and identification systems against unmanned aircraft — complementing indoor and virtual test environments the university already operates. University President Tim Sands, US Senator Mark Warner, and 9th District Congressman Morgan Griffith attended the opening.

    Officials Cite a Capability Gap

    “This is an area where we have to catch up, where America is behind,” Warner said at the ceremony. Austin Phoenix, director of mission systems at the Virginia Tech National Security Institute, said unmanned aircraft present a distinct detection challenge “because they’re just much smaller” than the aerial threats legacy air-defense systems were designed around.

    The center is intended to provide independent verification and validation testing for both government and private-industry counter-UAS systems, adding to a small number of dedicated outdoor test ranges nationally as drone incursions over military installations, airports, and other sensitive sites continue to draw federal attention. Virginia was one of seven states granted early federal UAS test-site designation roughly twelve years ago, giving the university a long-running base of aviation-research infrastructure to build on. The opening follows a string of counter-drone contract awards this year, including DHS’s department-wide counter-drone contracts.

  • ServiceNow Patches Three Maximum-Severity Flaws That Allowed Unauthenticated Code Execution

    ServiceNow Patches Three Maximum-Severity Flaws That Allowed Unauthenticated Code Execution

    ServiceNow disclosed and patched three maximum-severity vulnerabilities in its Now Platform and AI Platform on August 28, 2026, each exploitable by an unauthenticated attacker with low complexity and no user interaction, according to the company’s own security advisories and reporting from BleepingComputer and The Hacker News.

    Two of the flaws, CVE-2026-18885 and CVE-2026-18886, are code-injection vulnerabilities in the ServiceNow AI Platform that could let an attacker execute arbitrary code, access or modify instance data beyond intended permissions, or escalate privileges. A third, CVE-2026-74820, is a SQL-injection flaw in the same platform that could allow an unauthenticated user to run arbitrary SQL statements against the underlying database and alter instance data. A separate, high-severity sandbox-escape bug, CVE-2026-6876, was disclosed alongside the three critical issues.

    No Confirmed Exploitation, but a Pattern of Prior Abuse

    ServiceNow said it is “not currently aware of malicious exploitation against ServiceNow instances” tied to the newly disclosed flaws. The company has hosted-instance customers already patched, while partners and self-hosted customers running on-premises deployments are responsible for applying fixes themselves across the affected Xanadu, Yokohama, Zurich, and Aspen release families.

    The disclosure follows a related ServiceNow flaw, CVE-2026-6875, that researchers confirmed was actively exploited in July 2026, and echoes a pattern from 2024 in which several ServiceNow vulnerabilities were chained together in attacks against government and private-sector targets. Given ServiceNow’s widespread use for enterprise workflow and identity-adjacent processes, security teams are advised to prioritize patching self-hosted instances even in the absence of confirmed in-the-wild exploitation.

  • Iran-Linked Hackers Disable UK Power Plant for Four Days as US Water Utilities Report Coordinated Attacks

    Iran-Linked Hackers Disable UK Power Plant for Four Days as US Water Utilities Report Coordinated Attacks

    A small power generation facility in the United Kingdom was disabled for four days after a suspected Iran-linked cyberattack, in a window that overlapped with a wider wave of intrusions against wastewater treatment plants across roughly a dozen US states, according to reporting from Security Affairs and The Register published August 23–24, 2026, citing UK government and industry sources.

    The UK facility, not named publicly for security reasons, was small enough that its outage did not affect the wider national power supply, and staff were able to restore operations without formal notification thresholds being triggered. A UK government source told reporters the plant fell below the legal reporting threshold for “important generators,” while the National Cyber Security Centre declined to comment on the specific incident. NCSC chief Richard Horne said in June that the agency had handled more than 200 attacks on UK critical national infrastructure over the preceding year.

    US Wastewater Plants Hit Across Multiple States

    In parallel, US authorities traced a separate series of intrusions affecting dozens of wastewater treatment facilities, with the earliest reports emerging from Minnesota on July 26 and subsequent incidents confirmed in Michigan, Georgia, South Dakota, New Jersey, and Alabama. Several affected utilities reported flooding and loss of water pressure, and some jurisdictions issued boil-water advisories as a precaution. The FBI has attributed the water-sector intrusions to “malicious cyber actors,” and US government sources cited by Security Affairs indicated the activity likely originated in Iran.

    Researchers characterize both incidents as capability demonstrations rather than attempts to cause lasting damage, consistent with a broader pattern of suspected Iranian probing reported in recent months against infrastructure operators in Germany, Poland, Finland, Belgium, and Albania. UK officials have said the activity has accelerated since February airstrikes involving the United States and Israel against Iranian targets.

    The incidents add to a year in which operational technology at water and wastewater facilities has faced sustained scrutiny, and follow a separate US executive action restricting foreign-made equipment in bulk-power systems over cybersecurity concerns.

  • Chemical Plant and Hazardous Materials Facility Security Technology

    Chemical Plant and Hazardous Materials Facility Security Technology

    Chemical manufacturing and hazardous-materials storage facilities present a security profile that differs meaningfully from most other industrial verticals: the consequence of a security failure is not limited to theft or operational downtime, but can extend to toxic release, explosion, or environmental contamination affecting surrounding communities. That elevated consequence has shaped both the regulatory environment governing the sector and the security technology commonly deployed within it.

    Regulatory Context Shapes the Technology Stack

    In the United States, chemical facilities meeting certain hazardous-chemical thresholds have historically been subject to federal chemical facility security regulation requiring layered physical security measures, background screening for personnel with access to critical assets, and cybersecurity protections for process control systems. This regulatory framework has pushed the sector toward standardized layered-security architectures more consistently than in less-regulated industrial verticals, where security investment varies more widely based on individual operator risk tolerance.

    Layered Physical Security

    Perimeter and Access Control

    Chemical facilities typically implement multiple concentric security layers: an outer perimeter with fencing, intrusion detection and vehicle barriers; an intermediate layer controlling access to process areas; and the tightest access restrictions around chemicals of highest concern, such as facilities handling theft-attractive or release-hazardous materials. Vehicle access control, including barriers rated to stop forced-entry attempts, is a more prominent design consideration at chemical sites than at many other industrial facility types, given the potential consequences of a vehicle-borne intrusion into a process area.

    Detection Technology for Process Areas

    Gas detection systems monitoring for leaks of specific hazardous compounds are integrated with facility-wide alarm and evacuation systems, and increasingly correlated with video analytics and access-control data so that a detected leak can be cross-referenced against personnel location data to support faster, more targeted emergency response.

    Video Surveillance and Analytics

    Explosion-rated and intrinsically safe camera housings are required in classified hazardous areas within chemical facilities, a specification not typically relevant to general commercial or office-building surveillance deployments. Video analytics tuned to detect unauthorized personnel in restricted process zones, or unusual activity around chemical storage and loading areas, extend monitoring coverage across large facility footprints.

    Operational Technology and Cybersecurity

    Chemical process control systems — the distributed control systems (DCS) and PLCs governing reaction parameters, temperature and pressure — represent a high-consequence target if compromised, since manipulation of process parameters can directly cause a safety incident rather than only a data or availability loss. This has made the sector an early and consistent adopter of OT network segmentation, industrial firewalls, and continuous monitoring for anomalous commands issued to process controllers, generally ahead of adoption rates seen in less safety-critical industrial verticals.

    Personnel and Insider Risk

    Because a portion of chemical-facility risk stems from insider access to hazardous materials or process controls rather than external intrusion, background screening, access-tiering based on role, and behavioral monitoring for personnel with elevated process-control privileges are treated as core components of the security program rather than optional additions, aligning chemical-sector practice with the broader industry shift toward merging physical and cyber insider-threat signals.

    FAQ

    Why do chemical facilities require explosion-rated security cameras?

    In areas classified as hazardous due to the presence of flammable gases, vapors or dust, standard electronic equipment can pose an ignition risk. Explosion-rated (intrinsically safe or explosion-proof) camera housings are engineered to prevent the equipment itself from becoming an ignition source in those classified zones.

    Is chemical facility security primarily a regulatory compliance exercise?

    Regulatory requirements set a baseline, but facilities handling genuinely high-consequence materials generally implement security measures beyond minimum compliance thresholds, given that the potential consequences of a security failure extend to surrounding communities and not just the facility itself.

    Conclusion

    Chemical and hazardous-materials facility security sits at an unusually high-stakes intersection of physical security, process safety and OT cybersecurity. The sector’s layered, regulation-informed approach — combining hardened perimeter and access control, hazardous-area-rated detection technology, and mature OT segmentation practices — reflects consequences that go well beyond typical industrial security concerns of theft or downtime.

  • Smart Building Security Integration: Converging BMS, IoT and Physical Security Systems

    Smart Building Security Integration: Converging BMS, IoT and Physical Security Systems

    A modern commercial building typically runs several parallel digital systems: a building management system (BMS) controlling HVAC, lighting and elevators; a physical security platform handling access control and video surveillance; and a growing layer of IoT sensors monitoring everything from occupancy to air quality to energy consumption. Historically, these systems were built, procured and operated independently, often by different contractors using proprietary protocols with little interoperability. That is changing as building owners push for centralized operational visibility and as IP-based communication becomes the default across all three domains.

    What Integration Actually Enables

    • Occupancy-aware building operations. Access control and video occupancy data can inform HVAC and lighting schedules in real time, reducing energy use in unoccupied zones without requiring separate occupancy sensors purpose-built for BMS use.
    • Correlated alarm response. A door-forced-open alarm correlated with an unexpected HVAC or lighting change in the same zone can help security operators distinguish a genuine intrusion from a false alarm or scheduled maintenance activity.
    • Unified emergency response. Fire alarm, access control and BMS integration allows automated responses during emergencies — such as unlocking designated egress doors and adjusting HVAC to support smoke control — to be coordinated from a single event trigger rather than requiring separate manual actions across disconnected systems.
    • Centralized operational dashboards. Facility operators increasingly want a single interface showing security status, environmental conditions and building system health, rather than switching between multiple vendor-specific consoles.

    The Security Cost of Convergence

    Integration is not free from a risk standpoint. Building management systems have historically been built with less emphasis on cybersecurity than IT infrastructure, and connecting them to the same network as access control and video systems can create pathways for an attacker who compromises a lower-security BMS component to reach higher-value security infrastructure, or vice versa. IoT sensors, in particular, are frequently deployed in large numbers with minimal device management, making them a common weak point in an otherwise well-secured network if not properly segmented and monitored.

    Effective smart-building integration therefore requires the same network segmentation discipline applied to any converged IT/OT environment: BMS, IoT and security systems should typically sit on segmented VLANs with controlled inter-segment communication, rather than a single flat network simply because integration is technically possible.

    Governance and Organizational Challenges

    Beyond the technical architecture, smart-building integration raises questions of system ownership that many organizations have not fully resolved: does facilities management or security operations own the integrated platform? Who is responsible for patching BMS controllers that were historically outside the IT department’s purview? These governance questions frequently prove harder to resolve than the underlying technical integration, and unresolved ownership questions are a common reason integration projects stall after the initial technology deployment.

    FAQ

    Does smart building integration require replacing existing BMS or security systems?

    Not necessarily. Many integration platforms are designed to sit above existing BMS and security systems, aggregating data through APIs or middleware rather than requiring wholesale replacement of underlying infrastructure, though the degree of integration achievable depends on how open or proprietary the existing systems’ interfaces are.

    Is network segmentation still necessary if all systems are managed by the same integrated platform?

    Yes. A shared management platform does not eliminate the value of network segmentation; the two operate at different layers. Segmentation limits the blast radius of a compromised device at the network level, regardless of which platform is used to manage the devices sitting on that network.

    Conclusion

    Converging BMS, IoT and physical security in commercial buildings delivers real operational value, from energy efficiency to more coordinated emergency response, but it also expands the attack surface if approached purely as a data-integration exercise without corresponding network segmentation and governance work. Organizations that succeed at smart-building integration tend to treat it as a security architecture project with an operational-efficiency benefit, not the reverse.

  • Water and Wastewater Treatment Facility Security Technology

    Water and Wastewater Treatment Facility Security Technology

    Water and wastewater treatment facilities occupy an unusual position among critical infrastructure sectors: they are simultaneously among the most physically distributed — with treatment plants, pump stations, storage tanks and distribution infrastructure often spread across large geographic areas — and among the most operationally sensitive, since a disruption can affect public health directly rather than only causing economic damage. U.S. federal agencies, including CISA, have repeatedly flagged the sector for elevated attention, warning water and wastewater system operators to protect programmable logic controllers (PLCs) and other operational-technology assets against reconnaissance and exploitation attempts by both criminal and state-linked threat actors.

    Physical Security Layers

    Perimeter Protection at Distributed Sites

    Because water infrastructure includes remote, often unstaffed sites such as pump stations and lift stations, perimeter security technology for the sector leans heavily on remote-monitoring approaches: fence-mounted or buried intrusion sensors, thermal and visible-light cameras with video analytics tuned for rural or low-activity environments, and cellular or satellite backhaul for sites without reliable wired connectivity. Given the number of remote sites a typical utility must cover, cost-effective, low-maintenance sensing technology is often prioritized over higher-precision but more expensive systems better suited to single high-value facilities.

    Access Control for Critical Process Areas

    Within treatment plants, access control is typically layered around process criticality: chemical storage and dosing areas, SCADA control rooms, and treatment process areas warrant stricter access restrictions than administrative buildings. Credential-based access control integrated with visitor management is standard practice for controlling contractor and vendor access, which represents a recurring risk category across critical infrastructure sectors generally.

    Video Surveillance and Analytics

    Video coverage of treatment processes, chemical handling areas and perimeter zones supports both security monitoring and operational documentation. Analytics capable of detecting loitering, unauthorized vehicle presence, or intrusion at remote unstaffed sites help utilities extend effective monitoring coverage without proportionally increasing staffing.

    The Cyber-Physical Dimension

    Water and wastewater utilities have drawn specific attention from cybersecurity agencies because their operational technology — the PLCs and SCADA systems that control chemical dosing, pumping and treatment processes — is frequently older, harder to patch, and in some cases directly internet-accessible due to historical remote-access configurations designed for operational convenience rather than security. Advisories describing reconnaissance and exploitation attempts against water-sector PLCs have specifically warned operators to review remote-access configurations, apply available patches, and segment OT networks from IT infrastructure. This makes the sector a clear example of where physical security and OT cybersecurity cannot be treated as separate disciplines: a compromised remote-access pathway into a chemical dosing PLC is as much a physical-safety issue as a cybersecurity one.

    Practical Constraints Facing the Sector

    Unlike well-funded critical-infrastructure operators in sectors such as energy or aviation, many water and wastewater utilities are small municipal operations with limited security budgets and technical staff. This constraint shapes technology adoption in the sector: solutions that require minimal specialized staffing to operate, that consolidate physical and cyber monitoring into fewer platforms, and that can be deployed incrementally across a large number of small remote sites tend to see faster adoption than more sophisticated but resource-intensive alternatives designed for larger, better-funded facilities.

    FAQ

    Why are water utilities considered attractive targets?

    Water systems combine public-health impact, historically under-resourced cybersecurity programs, and operational technology that in many cases predates modern security design practices — a combination that has drawn attention from both criminal ransomware actors and state-linked groups conducting reconnaissance against OT infrastructure, according to public advisories from CISA and allied agencies.

    What is the biggest practical barrier to improving water-sector security?

    Funding and staffing constraints are widely cited as the primary barrier, particularly for small municipal utilities that lack dedicated cybersecurity or physical-security personnel and must prioritize a limited budget across a large number of distributed sites.

    Conclusion

    Securing water and wastewater infrastructure requires treating physical security, remote-site monitoring and OT cybersecurity as a single integrated problem rather than three separate budget lines. Given the sector’s resource constraints, the technologies most likely to see real-world adoption are those that consolidate monitoring, minimize specialized staffing requirements, and scale cost-effectively across large numbers of distributed, often unstaffed sites.