We’re Tracking the Future of Security

Author: Osiris

  • Securing the Video Surveillance Network: Camera and VMS Cybersecurity Hardening

    Securing the Video Surveillance Network: Camera and VMS Cybersecurity Hardening

    A video surveillance deployment is, from a network architecture standpoint, a fleet of embedded computers with microphones and lenses attached. Every IP camera runs firmware, exposes management interfaces, and communicates over the network with a video management system (VMS) that itself typically runs on general-purpose server infrastructure. That reality has made surveillance infrastructure an increasingly attractive target: camera botnets, credential-stuffing campaigns against exposed device management ports, and compromises of large fleets of network video recorders have all been documented by security researchers in recent years, with campaigns targeting tens of thousands of devices at a time through weak default credentials, unpatched authentication bypasses, and exposed peer-to-peer discovery services.

    Where the Attack Surface Actually Lives

    Camera and VMS security incidents tend to cluster around a small number of recurring weaknesses:

    • Default and weak credentials. Cameras and NVRs shipped with default administrative passwords, or deployed without forcing a credential change during commissioning, remain one of the most common initial-access vectors documented in mass-compromise campaigns.
    • Exposed management interfaces. Web-based camera configuration portals and VMS admin consoles left reachable from the public internet — whether through direct exposure or through port-forwarding and peer-to-peer relay services intended to simplify remote viewing — substantially expand the attack surface beyond what a properly segmented deployment would allow.
    • Unpatched firmware and software. Camera firmware and VMS platforms both accumulate disclosed vulnerabilities over their service life; devices that are difficult to patch at scale, or that are past vendor support, accumulate risk the longer they remain in service.
    • Flat network architecture. Surveillance devices placed on the same network segment as general IT infrastructure, without VLAN segmentation or firewall rules restricting camera-to-camera and camera-to-internet traffic, allow a single compromised device to become a pivot point into the broader network.

    Baseline Hardening Practices

    Network Segmentation

    Placing surveillance devices on a dedicated VLAN, with firewall rules limiting traffic to only the VMS server and required management systems, is widely regarded as the single highest-value control. Properly segmented deployments prevent a compromised camera from being used as a stepping stone to reach payroll systems, building automation, or other unrelated infrastructure.

    Credential and Access Management

    Forcing unique, strong credentials at commissioning, disabling unused default accounts, and integrating camera and VMS authentication with centralized identity management where supported all reduce the practical value of credential-based attacks. Multi-factor authentication on VMS administrative accounts is increasingly treated as a baseline expectation rather than an optional enhancement.

    Patch and Lifecycle Management

    Maintaining an inventory of camera models, firmware versions and support end-dates allows security teams to prioritize patching and plan replacement of end-of-life devices before they become the weakest link in the deployment. Vendor security advisories should be monitored on an ongoing basis, not just at initial deployment.

    Disabling Unnecessary Services

    Many cameras ship with peer-to-peer discovery, UPnP, and remote-access features enabled by default to simplify consumer setup. In enterprise deployments, these services are frequently unnecessary and expand the attack surface without a corresponding operational benefit; disabling them where not explicitly required is standard hardening guidance.

    FAQ

    Are IP cameras less secure than older analog systems?

    Not inherently — but IP cameras carry cybersecurity risks that analog systems did not, because they are addressable network devices. The security question is less about IP versus analog and more about whether the network deployment follows segmentation, credential and patch-management practices appropriate to a networked device fleet.

    Who is responsible for camera cybersecurity in most organizations?

    This varies significantly. In organizations where physical security and IT/cybersecurity functions remain siloed, camera and VMS hardening can fall into a gap between the two teams. Organizations further along in cyber-physical convergence typically assign shared or explicit ownership of surveillance-network security to avoid this gap.

    Conclusion

    Video surveillance infrastructure has moved from being a passive physical-security tool to being an active part of the enterprise attack surface. Treating cameras and VMS platforms with the same network segmentation, credential hygiene and patch discipline applied to other networked IT assets — rather than as a separate, lower-scrutiny category — is now a baseline expectation for any organization operating surveillance infrastructure at scale.

  • Industrial AI for Physical Security Operations: Predictive Maintenance Meets Threat Detection

    Industrial AI for Physical Security Operations: Predictive Maintenance Meets Threat Detection

    For most of its history, industrial artificial intelligence has lived in a separate silo from physical security. Predictive maintenance teams watched vibration sensors, thermal signatures and power-draw curves to forecast when a compressor or conveyor motor would fail. Security teams watched cameras, access logs and perimeter sensors to catch intruders and policy violations. The two disciplines rarely shared data, tooling or staff.

    That separation is eroding. As industrial facilities instrument more of their operational technology (OT) environment with connected sensors, the same telemetry streams that feed predictive-maintenance models are increasingly valuable to security operations — and vice versa. An unexplained vibration pattern on a pump, for instance, can indicate mechanical wear, or it can indicate physical tampering. A model trained to distinguish the two cases needs a security-aware view of the asset, not just a maintenance-aware one.

    Where the Overlap Is Real

    Three areas show the clearest convergence between industrial AI and physical security today:

    • Anomaly detection on shared sensor infrastructure. Vibration, thermal, acoustic and power-quality sensors originally deployed for condition monitoring can also flag events consistent with tampering, unauthorized equipment access, or sabotage — provided the analytics layer is trained to separate mechanical degradation signatures from disruption events.
    • Video analytics tied to process state. Rather than analyzing camera feeds in isolation, some facilities now correlate video analytics with process control data, so that a person detected near a valve or control panel is evaluated against whether that area is expected to be active, under maintenance, or should be unoccupied at that point in the process cycle.
    • Predictive risk scoring for OT assets. Machine-learning models that already rank equipment by failure risk are being extended to also incorporate cybersecurity exposure — patch status, network segmentation, and known-vulnerability data — producing a single risk score that blends reliability and security concerns for the same physical asset.

    Why This Convergence Is Accelerating Now

    Several forces are pushing industrial AI and physical security together. Regulatory attention on critical infrastructure has increased scrutiny of both operational reliability and cyber-physical resilience simultaneously, making it harder to justify maintaining separate, uncoordinated monitoring programs. At the same time, the cost of deploying and training separate machine-learning pipelines for maintenance and security has made a shared data platform more attractive from a budget standpoint. And as attacks on industrial control systems and programmable logic controllers have drawn public attention — including advisories from agencies such as CISA covering active reconnaissance and exploitation attempts against OT protocols — security leaders have become more willing to treat OT telemetry as a security signal in its own right, not just a reliability metric.

    Implementation Challenges

    The convergence is not without friction. OT and security teams typically report through different organizational structures, use different tools, and are measured against different KPIs — uptime for one, incident count for the other. Merging their data streams requires governance decisions about who owns alert triage, how false positives are handled without disrupting production, and how sensitive process data is protected when it becomes visible to a broader set of security personnel.

    There is also a technical challenge in model training: industrial equipment failure signatures are often well-documented after years of maintenance history, but tampering and sabotage events are comparatively rare, making it harder to train reliable classifiers without synthetic data or carefully designed red-team exercises to generate labeled examples.

    FAQ

    Does industrial AI replace dedicated physical security systems?

    No. Industrial AI applied to OT telemetry is a complementary signal, not a replacement for access control, video surveillance, or perimeter detection. Its value lies in correlating operational anomalies with security context that purpose-built security systems may not otherwise capture.

    What data is typically shared between maintenance and security teams in a converged model?

    Common shared signals include vibration and acoustic sensor data, thermal imaging, power-quality metrics, and access-control logs tied to specific equipment zones. Process control data itself is usually kept segmented and shared only in summarized or access-controlled form.

    Conclusion

    The line between predictive maintenance and physical security is blurring for a straightforward reason: both disciplines are trying to answer variations of the same question — is this asset behaving as expected? Facilities that build a shared data and governance layer between OT reliability teams and security operations are positioned to catch a wider range of anomalies than either discipline could catch alone, provided they invest in the organizational coordination the convergence requires, not just the underlying sensors and models.

  • ProdataKey and Aiphone Launch Integrated Cloud-Based Access Control and Video Intercom Solution

    ProdataKey and Aiphone Launch Integrated Cloud-Based Access Control and Video Intercom Solution

    ProdataKey (PDK) and Aiphone announced on August 26, 2026, a new cloud-based integration designed to unify access control and video intercom management for commercial and multi-tenant properties. The integration connects AiphoneCloud, Aiphone’s cloud-managed intercom platform, with PDK.io, ProdataKey’s mobile-first access control management software.

    “The future of physical security is built on connected, intuitive technologies,” said Dallan Labrum, Executive Vice President of Sales at ProdataKey. “Our integration with Aiphone gives dealers, integrators, and end users a smarter way to manage access control and video intercoms from a unified ecosystem. Together, we’re helping customers improve operational efficiency while delivering a better experience for everyone who enters and manages their buildings.”

    Automatic Tenant Sync Eliminates Duplicate Record-Keeping

    According to the companies, when tenant information is added, updated, or removed in PDK.io, those changes automatically sync to connected Aiphone IXG intercoms, eliminating the need for dealers and property managers to maintain duplicate records or manually coordinate directory updates between two separate systems. Security administrators and property managers can manage both access control and video intercom operations through a single streamlined workflow, which the companies say reduces administrative overhead and helps close security gaps caused by human error in manual record-keeping.

    The launch follows ProdataKey’s earlier preview of the integration at ISC West 2026, where the company showcased new locksets, readers, burglar-panel integrations, and video intercom offerings alongside the incoming Aiphone connection. For multi-tenant and commercial property operators, the combined platform reflects a broader industry shift toward converging previously siloed access control and visitor-verification systems into single-pane-of-glass management, reducing the operational friction that has historically accompanied maintaining separate vendor ecosystems for door access and intercom hardware.

  • Iranian State-Backed Nimbus Manticore Expands Toolset With New Backdoor and SSH Tunneler

    Iranian State-Backed Nimbus Manticore Expands Toolset With New Backdoor and SSH Tunneler

    Cybersecurity researchers at Group-IB have identified additional operational infrastructure and previously undocumented malware associated with Nimbus Manticore, an Iranian state-sponsored hacking group affiliated with the Islamic Revolutionary Guard Corps. In an analysis published August 26, 2026, and reported the same day by The Hacker News, Group-IB described the group as among the most active Iranian advanced persistent threat actors of 2026.

    Nimbus Manticore — also tracked as GalaxyGato, Mirage Kitten, Screening Serpens, Smoke Sandstorm, Subtle Snail, and UNC1549 — is assessed by Group-IB to be linked to the Tortoiseshell cluster (also known as Imperial Kitten and Unyielding Wasp), itself part of the broader Charming Kitten activity cluster. The group has a documented history of using social-engineering campaigns, including fake recruitment and “Dream Job” lures, to deliver malware to targets in aerospace, defense, IT services, and telecommunications.

    New Backdoor and Tunneling Infrastructure Found Across Two Regions

    Group-IB researchers Mansour Alhmoud and Mohamed Emam identified a C++ backdoor with characteristics similar to the group’s existing TWOSTROKE implant, along with an SSH-based tunneling utility, deployed across newly discovered infrastructure spanning both Europe and the Middle East. “The discovered Tortoiseshell infrastructure potentially suggests an expanded targeting profile, focusing on Middle Eastern countries, alongside European countries,” the researchers wrote.

    The findings follow earlier reporting on the group’s NightLedger backdoor and custom WebSocket tunnelers, which Group-IB said have been used to turn compromised systems into covert network relays capable of executing commands, uploading files, and capturing screenshots while tunneling traffic through victim networks. Group-IB said the continued development of new tools alongside the expanding infrastructure footprint “demonstrates a threat actor that is steadily evolving its toolset and adapting its techniques to maintain access across a growing number of targets.”

    Organizations in the aerospace, defense, telecommunications, and critical-infrastructure-adjacent sectors that operate in Europe or the Middle East are advised to review indicators associated with the Tortoiseshell/Nimbus Manticore cluster as part of routine threat-intelligence monitoring.

  • AWS and Nvidia Expand Partnership With 2 Million More GPUs for Agentic and Physical AI

    AWS and Nvidia Expand Partnership With 2 Million More GPUs for Agentic and Physical AI

    Amazon Web Services and Nvidia announced on August 27, 2026, a major expansion of their infrastructure partnership, with plans to deploy 2 million additional Nvidia GPUs across AWS’s global infrastructure during 2027 and 2028. The new capacity will include Nvidia’s Blackwell Ultra, Rubin, and Rubin Ultra platforms, and builds on AWS’s previously announced plan to add more than 1 million Nvidia GPUs beginning in 2026.

    “NVIDIA and AWS have built one of the great growth engines of the AI era, and demand is running ahead of every forecast,” Nvidia founder and CEO Jensen Huang said in the companies’ joint announcement. “For 16 years, we have scaled NVIDIA computing in the cloud together. Now, we are expanding our partnership across the full stack — GPUs, CPUs, networking, open models and software — to make agentic and physical AI real at an unprecedented pace and scale that only AWS and NVIDIA can deliver.”

    Robotics, Federal AI Factories, and CPU Infrastructure

    The expanded collaboration extends beyond GPU deployment. AWS will integrate Nvidia’s Vera CPU-based infrastructure into its cloud, giving customers a CPU option purpose-built for AI agent workloads alongside accelerated compute. The companies also plan to build AI factories for the U.S. government, including deploying 100,000 Nvidia GPUs on AWS infrastructure dedicated to federal and national-security workloads.

    On the physical-AI and robotics side, Amazon Robotics is working with Nvidia to develop next-generation robots using Nvidia’s Jetson platform, Omniverse simulation libraries, and the Isaac open robotics development platform. The collaboration spans simulation, synthetic data generation, robot training, route optimization, functional safety, and real-to-sim validation, running on GPU-accelerated Amazon EC2 instances — work with direct relevance to warehouse automation, logistics security, and the broader push toward AI-driven physical infrastructure that industrial and critical-infrastructure operators are increasingly evaluating.

    The deal also covers data processing and open-model availability, including GPU-accelerated processing on Amazon EMR via new EC2 G7 instances and continued availability of Nvidia’s Nemotron model family on Amazon Bedrock and SageMaker.

  • Critical cPanel Flaw Could Let a Hosting Customer Take Root Control of a Whole Server

    Critical cPanel Flaw Could Let a Hosting Customer Take Root Control of a Whole Server

    cPanel published a security advisory on August 27, 2026, disclosing a critical vulnerability in the domain-parking and addon-domain functionality of cPanel & WHM. Tracked as CVE-2026-65643, the flaw allows an authenticated account holder with permission to add parked or addon domains to create arbitrary files on the server, which can ultimately be abused to achieve code execution as the root user.

    According to cPanel’s own advisory, successful exploitation “leads to code execution as the root user, giving an attacker full control of the server and every account, website, and database on it.” The vulnerability affects all currently supported versions of cPanel & WHM. Patched versions are 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2, and WP2 build 11.138.1.7 or later; servers running end-of-life cPanel releases must first upgrade to a supported version before they can receive the fix.

    Particularly Severe for Shared and Multi-Tenant Hosting

    Security researchers covering the disclosure noted that the flaw’s impact is amplified in shared-hosting environments, where a single low-privilege tenant account with domain-management permissions could serve as a stepping stone to compromising every other customer hosted on the same server — including the ability to deploy persistent backdoors, alter website content, exfiltrate databases, and manipulate server configuration across multiple unrelated hosted accounts.

    cPanel has not disclosed evidence of active exploitation, and as of the August 27, 2026 update to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog, CVE-2026-65643 was not listed. The advisory also carries no published CVSS score; as of August 28, 2026, the CVE Program’s own record store had not yet published a formal record for the vulnerability, even though two unrelated cPanel plugin flaws disclosed on July 31 already had entries at the time of the check.

    Given how widely cPanel is deployed across web and hosting infrastructure, administrators are advised to prioritize the update, particularly on multi-tenant servers where the domain-parking feature is exposed to lower-trust account holders.

  • McKesson Confirms Cyberattack as ShinyHunters Claims Theft of 284 Million Patient Records

    McKesson Confirms Cyberattack as ShinyHunters Claims Theft of 284 Million Patient Records

    McKesson Corporation, the pharmaceutical distributor that moves roughly a third of prescription drugs sold in the United States, confirmed on August 28, 2026, that it suffered a cybersecurity incident involving unauthorized access to third-party applications. In a Form 8-K filed with the U.S. Securities and Exchange Commission, McKesson said it discovered the incident on August 25, 2026, and that its investigation “remains in the early stages,” with updates being posted to the company’s website.

    Hours after McKesson’s disclosure, the extortion group ShinyHunters told BleepingComputer it had exfiltrated approximately one terabyte of data from the company’s Salesforce and Snowflake environments over a four-day window between August 21 and August 25, 2026. According to the group, initial access came through vishing attacks that compromised multiple employees’ Okta single sign-on accounts, which were then used to reach the Salesforce and Snowflake platforms.

    ShinyHunters claimed the stolen data includes roughly 284 million patient-related records, and said it contacted McKesson after completing the theft to demand a ransom of $55,236,150, giving the company 72 hours to respond. The group said McKesson did not negotiate or respond to the demand.

    Part of a Broader Pattern Targeting Healthcare and SaaS Platforms

    The McKesson incident is the latest in an ongoing wave of data-theft attacks attributed to ShinyHunters against healthcare and health-technology organizations, several of which have involved compromised third-party SaaS and cloud-data platforms rather than direct breaches of core clinical systems. As with earlier incidents in this pattern, the exposure risk here centers on identity providers and cloud data warehouses that sit adjacent to, but outside, an organization’s primary operational infrastructure — a distinction that matters for how healthcare and pharmaceutical enterprises prioritize identity security and third-party risk monitoring alongside traditional network defenses.

    McKesson has not confirmed the scope of data exposed or verified ShinyHunters’ record-count claim. The company said additional updates would be provided as the investigation progresses.

  • Comelit-PAC Launches Linear Beam Smoke Detector Range for Warehouses and Large Open Spaces

    Comelit-PAC Launches Linear Beam Smoke Detector Range for Warehouses and Large Open Spaces

    Comelit-PAC has launched a new range of linear beam smoke detectors designed for warehouses, atriums, industrial facilities, sports halls and other high-ceiling environments, the company said on August 26, 2026. The detectors use reflective infrared beam technology to monitor for smoke over distances of up to 120 meters, and the range comprises four models split between addressable and conventional variants covering 5 to 60 meters and 50 to 120 meters respectively.

    The addressable models are compatible with Comelit-PAC’s Logifire panels, while conventional variants work with standard fire alarm control panels; all models are certified to EN54-12, and the addressable versions add EN54-17 certified short-circuit isolation. The detectors include smart alignment technology that automatically optimizes signal strength during commissioning, an integrated laser pointer to assist installation, and automatic compensation for environmental drift such as dust buildup, minor structural movement and temperature fluctuation, with maintenance alerts generated when servicing is needed. “As warehouses become larger, industrial facilities more complex and public spaces increasingly multi-purpose, there’s growing demand for technologies to deliver reliable coverage without adding unnecessary complexity,” said Mandy Bowden, Fire Systems Business Manager UK & ROI at Comelit-PAC.

    Beam smoke detection is a standard approach for protecting large-volume spaces where point smoke detectors would be impractical to install and maintain in sufficient density, and reducing false alarms from environmental drift has been a persistent integrator complaint with older beam detector generations. The addressable range’s real-time alignment display and dual day/night sensitivity settings target that maintenance burden directly, a common driver of beam detector replacement cycles in large commercial and industrial buildings.

  • Cosmos EVM Flaw Drains $5.72 Million From Six Blockchains After Patch Shipped Without a Security Advisory

    Cosmos EVM Flaw Drains $5.72 Million From Six Blockchains After Patch Shipped Without a Security Advisory

    Cosmos Labs disclosed in a post-mortem published August 28, 2026 that a critical balance-handling flaw in the shared Cosmos EVM module, used by more than 115 known public blockchains, was exploited on six chains between August 20 and August 25, 2026, draining roughly $5.72 million in assets, according to the company’s writeup and reporting by The Hacker News. The vulnerability allowed an attacker to manipulate token balances through a supply-overflow condition on older chain versions and a type-conversion issue on newer ones, both exploitable within a single transaction carrying a net supply change of zero.

    According to The Hacker News, a fix for the flaw was made public in May 2026 but was not distributed as a security release until August 19, and the release notes for the patched versions did not disclose that they contained a security fix. Cosmos Labs has said it does not maintain a complete registry of the networks running its software, meaning some chain operators may not have known a security-relevant update was available. Attackers moved roughly $2.87 million of the stolen funds through decentralized exchanges and an estimated $2.85 million through centralized exchanges, whose accounts have reportedly been frozen pending investigation.

    The incident highlights a recurring weakness in open-source infrastructure that underlies widely used platforms: a patch is only protective if downstream operators know it addresses a security issue, and shared modules used across dozens of independently operated networks can leave a long window of exposure when disclosure practices lag behind development timelines. Cosmos Labs has since urged all EVM chains running unpatched versions to halt operations until they upgrade.

  • Attackers Chain Two PaperCut Flaws to Achieve Unauthenticated Remote Code Execution

    Attackers Chain Two PaperCut Flaws to Achieve Unauthenticated Remote Code Execution

    Malicious actors are exploiting a newly patched vulnerability in PaperCut NG and PaperCut MF print management software to execute arbitrary code on affected servers, according to research from Huntress and reporting by The Hacker News. PaperCut released an emergency fix with additional hardening after the flaw, which does not yet have an assigned CVE identifier, was found being exploited in the wild.

    Huntress researchers John Hammond and Andrew Brandt said the vulnerability gives an unauthenticated attacker remote control over PaperCut’s trusted configuration, which can be used to execute arbitrary Java code inside the application’s process. The flaw stems from how PaperCut’s authorization check handles a specifically crafted request: an attacker can reference one page that gets rendered in the response while a different page actually owns the component or action being executed, allowing the authorization check to trust the rendered page and miss the permission requirements tied to the executed action.

    PaperCut print management software is widely deployed across schools, government agencies, healthcare systems and corporate print environments, making unauthenticated remote code execution a significant exposure wherever an instance is reachable from an untrusted network. Organizations running PaperCut NG or MF are advised to apply the emergency patch immediately and review Huntress’s indicators for signs of prior exploitation.