We’re Tracking the Future of Security

Author: Osiris

  • Siemens Patches Critical Remote Code Execution Flaw in Siveillance Video Management Servers

    Siemens Patches Critical Remote Code Execution Flaw in Siveillance Video Management Servers

    Command Injection Rated Critical

    CISA published ICS advisory ICSA-26-225-09 on August 13, 2026, describing a critical vulnerability in Siemens Siveillance Video, a video management platform deployed worldwide across the critical manufacturing, communications and commercial facilities sectors. Tracked as CVE-2026-3014 and rated CWE-78 (OS Command Injection), the flaw affects Siveillance Video V2023 R3 versions before 23.3.27, V2024 R1 versions before 24.1.16, and V2025 versions before 25.1.15, with a CVSS v3 base score of 9.1.

    According to the advisory, a user with edit permissions on the Management Server can exploit the flaw to execute arbitrary code in the context of the Management Server service, which could allow an attacker to take control of connected video management infrastructure.

    Updates Available for All Affected Branches

    Siemens has released fixed versions for each affected release branch: V23.3 HotfixRev27 or later, V24.1 HotfixRev16 or later, and the V25.1.15 update for the 2025 branch. CISA and Siemens recommend that operators update to the corrected versions as soon as practical and, in line with general ICS hardening guidance, restrict Management Server edit permissions to trusted administrators and segment video management infrastructure from untrusted networks.

    Sources

  • CISA Details Credential Exposure Flaw in Johnson Controls Simplex Incident Manager

    CISA Details Credential Exposure Flaw in Johnson Controls Simplex Incident Manager

    Cleartext Credentials Found in Memory

    The Cybersecurity and Infrastructure Security Agency published ICS advisory ICSA-26-232-01 on August 20, 2026, disclosing a vulnerability in Johnson Controls Simplex Incident Manager, a fire and life-safety incident-management application used across critical manufacturing, commercial facilities, government facilities, transportation systems and energy sites worldwide. Tracked as CVE-2026-27875, the flaw stores user credentials, including passwords and authentication tokens, in an unencrypted form in system memory while the application is running.

    CISA assigned the vulnerability a CVSS v3.1 base score of 5.8 (medium), rating it CWE-316, Cleartext Storage of Sensitive Information in Memory. A local attacker with low privileges, or an insider with memory-dumping tools, could extract the exposed credentials and use them for unauthorized access to the application and connected systems. Exploitation requires local access to the host, and CISA rates the attack complexity as high.

    Patch Available

    Johnson Controls has released version v2.01.01 to address the flaw and published Product Security Advisory JCI-PSA-2026-28 with mitigation guidance. CISA and the vendor recommend upgrading affected Simplex Incident Manager deployments (v2.01 and earlier), restricting local system access to authorized personnel, deploying endpoint monitoring to detect memory-dumping activity, enforcing least-privilege access controls, and using full-disk encryption and secure boot to reduce the risk of offline memory analysis.

    Johnson Controls reported the vulnerability to CISA. No public evidence of active exploitation has been disclosed.

    Sources

  • Flock Safety Cuts License-Plate Data Retention to Seven Days Amid Surveillance Backlash

    Flock Safety Cuts License-Plate Data Retention to Seven Days Amid Surveillance Backlash

    New Guardrails Announced Amid Growing Criticism

    Flock Safety, which operates a nationwide network of more than 119,000 automated license-plate-reader (ALPR) cameras used by law enforcement agencies, announced a set of privacy and accountability reforms on August 13, 2026, according to Fox Business. The changes come as the company faces mounting criticism from privacy advocates and elected officials over mass surveillance concerns and reports of officers misusing the technology, including cases documented by Wired in which police reportedly used Flock data to track romantic partners.

    Flock CEO Garrett Langley discussed the changes publicly, telling Fox Business’s “Varney & Co.” that the reforms were a direct response to backlash the company has faced over its car-tracking cameras. Some local officials have gone further than criticism: Knox County, Tennessee, Mayor Glenn Jacobs has called for a national moratorium on further deployment of Flock’s camera network, according to Fox Business.

    Shorter Retention, Mandatory Audit Controls

    The centerpiece of the announcement is a reduction in Flock’s standard data-retention window from 30 days to seven. The company said that roughly 90% of all searches conducted on its platform already occur within a week of data capture, arguing the shorter window would have limited practical effect on law enforcement’s ability to use the system while narrowing the amount of location data stored on Flock’s servers at any given time. For cases requiring longer retention, Flock is introducing an “Evidence Mode” feature that lets agencies preserve specific data for extended periods under state or local policy.

    Flock is also making its “Audit Assistance” feature — which flags abnormal search behavior and can lock a user out of the system in real time pending administrator review — mandatory for all law enforcement customers rather than optional; the company said roughly a third of agencies had turned the feature on voluntarily before the change. Separately, Flock is making the previously optional requirement to log a case code with every search mandatory going forward, with an override reserved for emergencies such as missing-child cases. “A search without a reason is a search that shouldn’t happen in the first place, and now Flock’s system automatically treats it that way,” the company told Fox Business.

    New Controls Over Cross-Agency Data Sharing

    The company is also giving individual agencies more granular control over which types of cases they will share camera search access for with other jurisdictions. In comments to Fox Business, Flock gave the example that “City A could allow City B to search its cameras for a stolen vehicle or violent crime while blocking searches related to immigration enforcement” — an option aimed at addressing concerns that Flock’s interconnected camera network could be used for purposes individual municipalities have not authorized.

    Civil liberties groups were not satisfied by the announcement. The American Civil Liberties Union said in a statement reported by Fox Business that the reforms “seem to be a thinly veiled PR attempt to counter communities’ genuine privacy concerns with its mass surveillance system with largely hollow security promises, rather than an earnest effort to address them.” Flock, for its part, has pointed to its own figures on the technology’s investigative use, telling Fox Business that its cameras were involved in roughly 1 million investigations last year and were tied to the location of about 10,000 missing people — figures that reflect the company’s own reporting and have not been independently verified.

    Sources

  • UK and Ukraine Sign AI Defense Partnership Granting Access to Ukraine’s Avengers AI Labs

    UK and Ukraine Sign AI Defense Partnership Granting Access to Ukraine’s Avengers AI Labs

    Britain and Ukraine signed a partnership in Kyiv on Monday, August 24, 2026, to jointly develop artificial intelligence tools for defense and security, with the UK becoming the first international partner granted access to Ukraine’s Avengers AI Labs battlefield-data platform, according to Reuters and a UK government statement.

    A Battlefield Dataset Built From Ukraine’s War

    UK Prime Minister Andy Burnham and Ukrainian President Volodymyr Zelenskyy signed the agreement, which the UK government describes as part of the two countries’ “100 Year Partnership.” Avengers AI Labs is built around an annotated dataset of roughly 5 million battlefield images, according to Ukraine’s Defence Ministry, drawn largely from the DELTA combat management and situational-awareness system. The platform aggregates data from cameras and sensors deployed across Ukraine’s front lines, capturing tanks, artillery, air-defense systems, infantry and aerial targets including Shahed drones and reconnaissance UAVs, which is used to train AI models that the UK government says currently identify a majority of targets in real time.

    Under the deal, Britain will in turn back Ukraine with access to its universities, researchers and technology companies, which the UK government describes as the world’s third-largest AI ecosystem. The agreement initially focuses on defense and national-security applications, bringing together engineers, academics, businesses and military operational experts from both countries.

    Fiber-Optic Sensing and Low-Power AI Chips Among First Pilot Projects

    Three British startups — Bristol-based Sintela, Oxford-based Mind Foundry, and London-based Skyral — are involved in the initial pilot projects announced alongside the partnership. The first project turns buried fiber-optic cables into a distributed AI-enabled sensor system, initially being trialed at a UK defense site to detect protesters and hostile actors attempting to gather intelligence; UK officials say the same approach could later extend to protecting airports, prisons, railways and energy plants. A second pilot project will explore low-power AI chips designed for future drones, robotics and autonomous systems.

    The AI agreement was announced alongside a separate decision by the UK to let defense contractor MBDA release classified information on UK-made components for the SCALP long-range missile, enabling local assembly lines in Ukraine. UK Defence Secretary Wes Streeting and AI Minister Kanishka Narayan both framed the AI partnership as part of a broader push to convert Ukraine’s wartime operational data into long-term technology and national-security capability for both countries.

    Sources

  • Denver Police to Let ShotSpotter Gunshot-Detection Contract Expire After a Decade

    Denver Police to Let ShotSpotter Gunshot-Detection Contract Expire After a Decade

    City Will Phase Out Acoustic Sensors by Year’s End

    The Denver Police Department says it will let its contract for ShotSpotter gunshot-detection technology expire at the end of 2026, ending more than a decade of automated gunfire alerting in the city, according to CBS Colorado and Denver7 reporting on the department’s August 20-21, 2026 announcement. The system uses acoustic sensors mounted on utility poles to detect the sound of gunfire and alert Denver’s 911 dispatch center, often before a human caller reports a shooting. Denverite reported the city’s contract with SoundThinking, the company behind ShotSpotter, is worth roughly $4.7 million and expires at the close of the year.

    Rather than an abrupt shutdown, DPD says it will begin removing sensors from areas generating the fewest alerts first, with most of the network remaining active through the rest of 2026. According to Denver7, the department said it is evaluating “whether a new vendor can provide greater public safety benefits” and plans to launch a bidding process to assess alternative gunshot-detection capabilities while gathering community input on how to reallocate resources. As part of the initial ramp-down, DPD said it will begin phasing out ShotSpotter coverage specifically in the Sun Valley and Park Hill neighborhoods.

    A Decade of Data on Alerts, Arrests and Recovered Firearms

    In its release announcing the change, the department said that from 2020 through June 2026 the program generated 25,217 alerts, leading to 655 arrests and the recovery of 721 firearms, according to CBS Colorado. Officers also located shell-casing evidence tied to 6,672 of those alerts. Denver’s decision comes amid what Denver7 described as broader nationwide scrutiny of police gunshot-detection and surveillance technology, as cities weigh the systems’ operational value against their cost and questions about alert accuracy and community impact that have been raised in other jurisdictions.

    What Happens Next

    City officials have not yet named a preferred replacement vendor or detailed the criteria for the planned bidding process. The wind-down gives Denver several months to evaluate alternative gunshot-detection platforms and to solicit public feedback before the current sensor network is fully retired, according to the reporting from Denver7 and Denverite.

    Sources

  • Nvidia Makes Minority Investment in Data-Center Power Developer Cloverleaf

    Nvidia Makes Minority Investment in Data-Center Power Developer Cloverleaf

    Nvidia has made a minority investment in privately held Cloverleaf Infrastructure, a company that arranges power and site infrastructure for AI data-center projects across the United States, the companies said on Friday, August 21, 2026, according to Reuters.

    Chipmaker Moves Further Upstream Into Power

    Financial terms of the investment were not disclosed, but the Wall Street Journal reported the same day, citing people familiar with the deal, that Nvidia was expected to invest up to several hundred million dollars. Cloverleaf works with utilities, energy providers and investors to secure power and other infrastructure for data-center sites, and the company says it has delivered multiple gigawatt-scale projects across North America since its founding in 2024. As part of the arrangement, Cloverleaf will deploy Nvidia’s DSX platform to help optimize decisions on site selection, power, cooling and computing infrastructure for the data centers it develops.

    J.P. Morgan Securities served as exclusive financial advisor and Kirkland & Ellis as legal counsel to Cloverleaf in structuring the deal, according to trade publication POWER.

    Part of a Broader Pattern of Financing Data-Center Buildout

    The Cloverleaf investment came just days after Nvidia announced a separate $1.5 billion investment in SoftBank-owned SB Energy to support the PORTS-Pike technology campus, a 10-gigawatt, OpenAI-linked data-center project in Pike County, Ohio. Nvidia CEO Jensen Huang said of that earlier deal that “AI is becoming infrastructure — the foundation for intelligence in every industry — and land, power and shell have become vital.” Taken together, the two deals illustrate how Nvidia has begun taking a more direct role in financing and developing the data centers that ultimately buy its AI computing systems, rather than simply supplying chips to third-party developers. Power availability, rather than chip supply, has increasingly become the binding constraint on how quickly new AI data-center capacity can come online.

    Sources

  • Civilian Drones Have Grounded Wildfire Aircraft Dozens of Times in 2026, Officials Say

    Civilian Drones Have Grounded Wildfire Aircraft Dozens of Times in 2026, Officials Say

    67 Reported Incursions So Far This Year

    The U.S. Forest Service says there have been 67 unauthorized drone incursions into wildfire airspace so far in 2026, a pattern officials say repeatedly forces firefighting aircraft out of the sky. In an August 2026 public safety post, the Forest Service and the National Interagency Fire Center said temporary flight restrictions are put in place over active wildfires specifically to protect aerial firefighting crews flying air tankers and helicopters, and that every incursion by an unauthorized drone forces those aircraft to stand down until the airspace is confirmed clear. Thirty-nine of the 67 reported incursions this year occurred in Washington state, according to the agencies. Individuals caught flying drones into these restricted zones can face significant fines and potential prison time.

    Spokane Complex Fires: A Concrete Example of the Risk

    The scale of the disruption was illustrated during the Spokane Complex wildfires in Washington in early August 2026. According to FireRescue1, citing a Spokane County Sheriff’s Office news conference, 26 drone incursions were reported on August 2, four of which flew directly into the path of firefighting aircraft. The following evening, aircraft were grounded for roughly 30 minutes after another unauthorized drone entered the restricted airspace, the outlet reported, citing The Seattle Times; the operator in that case was not located. Spokane County Sheriff John Nowels said his office had identified multiple drone operators from the earlier incidents and referred citations to the Federal Aviation Administration, noting each operator could face penalties up to $100,000.

    Washington Department of Natural Resources spokesperson Ryan Rodruck told FireRescue1 that grounding aircraft even briefly has real operational costs: “We’re utilizing all units at our disposal right now, but we can’t do that effectively if the airspace isn’t clear.” He said the temporary flight restriction over the Spokane fires protected airspace up to 5,000 feet, and that wildland firefighting aircraft often operate at altitudes similar to many civilian drones, raising collision risk for pilots and ground crews alike. Thirty-five aircraft, including assets from DNR and the National Guard, were assigned to the Spokane fires on August 3. “Vital seconds, minutes, are lost” with every grounding, Rodruck said.

    Legal Exposure and Public Messaging

    Interfering with firefighting operations on public lands is a federal crime that can carry up to a year in prison, and flying a drone inside a wildfire-related temporary flight restriction can also trigger a civil penalty of $20,000 or more, according to FireRescue1’s reporting. The Forest Service has run a public-awareness campaign, “If You Fly, We Can’t,” aimed at recreational drone operators, warning that even a very small drone can damage a helicopter’s tail rotor or disable an aircraft engine. Both agencies encourage anyone who spots a drone inside restricted wildfire airspace to call 911 or report it directly to the FAA.

    Sources

  • XPeng’s Robotics Unit Raises $900 Million at $6.3 Billion Valuation

    XPeng’s Robotics Unit Raises $900 Million at $6.3 Billion Valuation

    Chinese automaker XPeng said on Monday, August 24, 2026, that its robotics business had raised more than $900 million in its first funding round, valuing the unit at over $6.3 billion and setting a record for a single private financing in China’s embodied AI sector, according to Reuters.

    Record Round for a Standalone Robotics Business

    The round was led by IDG Capital, with Tencent and Alibaba participating as strategic investors, XPeng said in a statement. The financing establishes a standalone market valuation for XPeng’s robotics operation, separate from its automotive business, and will fund robotics hardware and software development, training and refinement of XPeng’s Physical AI models, collection of high-quality training data, construction of mass-production infrastructure, and international expansion, according to the company.

    At the center of the robotics unit’s strategy is IRON, XPeng’s next-generation general-purpose humanoid robot, which the company says combines a human-like physical design with an internally developed AI and control architecture spanning hardware, software, processors and motion systems. XPeng has said IRON features 76 degrees of freedom across its body, including 21 in each hand. The company plans to begin mass production of IRON by the end of 2026, with initial deployments at its retail stores and industrial campuses, followed by commercial sales and deliveries in China and overseas markets in 2027. XPeng CEO He Xiaopeng said in June he would personally lead the robotics business as the company pushes toward mass production.

    Funding Comes Amid Pressure on XPeng’s Core Business

    The robotics financing arrives as XPeng’s automotive business faces intensifying competition from domestic Chinese manufacturers and from Tesla in both overseas and domestic markets. According to AI News, XPeng’s publicly traded shares were down more than 7 percent on the day the funding was announced, with a roughly 51 percent decline over the preceding 12 months — underscoring that investors are pricing the robotics division well ahead of, and somewhat independently from, the parent company’s struggling share price. The split suggests investors see China’s embodied-AI and humanoid-robotics race as a distinct growth story from XPeng’s core electric-vehicle competition.

    Sources

  • Denver International Airport Logged Six Perimeter Fence Breaches in Three Years, Records Show

    Denver International Airport Logged Six Perimeter Fence Breaches in Three Years, Records Show

    A Pattern of Breaches Preceding a Fatal Incident

    Denver police have responded to six cases of people breaching the perimeter fence at Denver International Airport since January 2023, according to police records reported by The Denver Post on August 17, 2026. The most serious was a fatal incident on May 8, 2026, when 41-year-old Michael Mott scaled the airport’s eight-foot, barbed-wire-topped security fence and walked onto a runway shortly before 11:20 p.m. He was struck and killed by a Frontier Airlines aircraft that was accelerating for takeoff. Denver’s chief medical examiner, Dr. Sterling McLaren, ruled Mott’s death a suicide, according to the Post.

    Of the other five recorded breaches, one involved a man who crashed through a perimeter fence gate and drove onto the airfield, causing more than $2,000 in damage; another involved a man who jumped the fence after crashing his car nearby and was later found sitting on an active taxiway around 6:40 a.m.; and a third involved a man who told police he was trying to walk to Texas. Two additional trespassing cases involved people jumping the boundary fence into the airport’s warehouse area. At least two of the eight individuals involved in these incidents had active arrest warrants at the time of their breach, the Post reported, citing probable-cause statements.

    How the Numbers Compare Nationally

    There is no national database that tracks airport perimeter breaches specifically, and airports report trespassing incidents inconsistently, according to Annmarie Heth, an assistant professor of aviation and aerospace sciences at Metropolitan State University of Denver who was interviewed by the Post. The Federal Aviation Administration does separately track runway incursions — a broader category covering air traffic control errors, pilot violations, and unauthorized pedestrians or vehicles on runways and taxiways — at airports with control towers, including DIA. The FAA’s database recorded roughly 5,890 runway incursions nationwide between January 2023 and June 2026, of which 1,022 involved unauthorized pedestrians or vehicles. Only two of the six DIA police-documented perimeter breaches during that period appear in the FAA’s database, which lists a total of 37 incidents involving unauthorized vehicles and pedestrians at DIA dating back to April 2006, per Post reporting.

    Officials Say the Uptick May Reflect Better Detection, Not Worse Security

    Heth told the Post that fatal breaches like the one that killed Mott are extremely rare and that advanced perimeter technology usually allows security personnel to intercept trespassers before an incident escalates. “Fences are there to keep honest people out,” she said. “If somebody is really intent on getting through a fence, they’re going to get through.” She added that improved sensors, cameras, analytics and staff training may explain why more incidents are being detected and reported today compared with when she worked as an airport operations manager in Florida between 2009 and 2015, when even wind gusts could trigger perimeter alarms and prompt an investigation.

    A Denver Police Department spokesman, Doug Schepman, said the department’s dedicated Airport Police Bureau at DIA works closely with airport operations staff, monitors data on breach trends, and adjusts resources accordingly. DIA officials declined to comment on the individual trespassing incidents when contacted by the Post. The FAA and the National Transportation Safety Board also declined to comment specifically on DIA’s perimeter breaches.

    Sources

  • Nvidia in Talks to Invest in Perplexity at $30 Billion-Plus Valuation

    Nvidia in Talks to Invest in Perplexity at $30 Billion-Plus Valuation

    Nvidia is discussing an equity investment in Perplexity as part of a new funding round that would value the AI search startup at more than $30 billion, The Information reported on August 23, 2026, citing people familiar with the discussions. Reuters also reported the talks but said it could not independently verify the details.

    A Fast-Rising Valuation

    The prospective round would put Perplexity’s valuation more than 50 percent above the $20 billion mark it reached in a September 2025 round, and above the $23 billion valuation reported in a subsequent January 2026 financing, according to the reporting. Perplexity’s annualized revenue has roughly tripled this year, climbing from about $250 million to more than $750 million, a jump largely attributed to “Perplexity Computer,” an AI agent product that automates multi-step professional tasks and drives significantly higher token consumption than conventional search queries. At $750 million in annualized revenue, a $30 billion valuation would price the company at roughly 40 times sales.

    Nvidia is not a new backer: it previously participated in Perplexity’s Series B in January 2024, its unicorn round the same year, and an $18 billion extension round in July 2025 alongside SoftBank Vision Fund 2, NEA and IVP. Per The Information, Nvidia had also weighed a technology-licensing arrangement and hiring some of Perplexity’s staff before the conversation shifted toward a straight equity stake.

    Search as AI-Agent Infrastructure

    Nvidia CEO Jensen Huang has previously said in interviews that Perplexity is his personal go-to AI assistant, and Nvidia has functioned as something of a financial backstop for AI startups in recent years, investing in companies that in turn spend heavily on its chips. Perplexity CEO Aravind Srinivas has said he is considering a public listing around 2028. The talks come as Perplexity competes not only with Google and OpenAI’s distribution advantages but with agent-native search challengers such as Exa, which Nvidia’s venture arm has also backed.

    As of publication, neither Nvidia nor Perplexity has confirmed the terms of the discussions publicly, and the reported valuation and structure could still change before any deal is finalized.

    Sources