We’re Tracking the Future of Security

Author: Osiris

  • Noblis Patents Continuous Authentication System Using Biometrics and Environmental Sensors

    Noblis Patents Continuous Authentication System Using Biometrics and Environmental Sensors

    Noblis has announced a U.S. patent for an electronic access-control system designed to verify identity and environmental conditions continuously rather than relying only on a login-time check. U.S. Patent No. 12,682,086 combines biometric sensing, environmental monitoring, and machine-learning analysis, according to the research organization.

    Identity and context are evaluated together

    The described system combines facial recognition, gaze tracking, and blink detection with signals about spatial security, electromagnetic conditions, and network integrity. Those inputs contribute to a dynamic liveness score intended to identify presentation attacks such as photographs or deepfakes while checking whether the authorized person remains present. Based on configured criteria, the system can maintain access, restrict selected functions, or block access when conditions change.

    A patent is not deployment evidence

    The announcement documents patented architecture and intended capabilities; it does not by itself establish production adoption, independent performance results, or certification for a particular deployment. Security teams evaluating continuous authentication still need to consider privacy, biometric data governance, failure handling, accessibility, sensor reliability, and the operational impact of false decisions. The approach is relevant to remote and high-assurance access scenarios where a one-time credential check may not provide enough assurance throughout a session. More identity and access-control developments are tracked in the SectechMedia Technology News archive.

    Sources

  • Check Point Fixes Critical Management Server Flaw Allowing Pre-Auth Root Code Execution

    Check Point Fixes Critical Management Server Flaw Allowing Pre-Auth Root Code Execution

    Check Point has released fixes for CVE-2026-91843, a critical stack-overflow vulnerability in the unauthenticated login process used by Security Management and Log Servers. The vendor assigned the issue a CVSS score of 9.8 and warned that successful exploitation could allow remote arbitrary-code execution with root privileges.

    The flaw affects self-managed management infrastructure

    Check Point lists Security Management Server, Multi-Domain Security Management Server, Log Server, and Multi-Domain Log Server among the affected products. Smart-1 Cloud is not affected because the fix was applied within the hosted environment. Censys researchers said the vulnerable path can be reached with an oversized username in a login request and documented the internet-visible management-server footprint without treating every observed host as confirmed vulnerable.

    Apply the vendor fix and limit trusted access

    Check Point provides a LivePatch and fixed Jumbo Hotfix Accumulator takes for supported branches. Administrators should follow the vendor advisory for their exact release, verify the patch state, and restrict management access to trusted systems. Public reporting said no exploitation was known at disclosure, so the risk should not be described as an active campaign without new evidence. The severity instead comes from the pre-authentication path and potential root-level impact. Additional vulnerability coverage is organized in the SectechMedia Technology News archive.

    Sources

  • CISA Warns Critical MikroTik RouterOS Flaw Can Enable Pre-Auth Root Code Execution

    CISA Warns Critical MikroTik RouterOS Flaw Can Enable Pre-Auth Root Code Execution

    The U.S. Cybersecurity and Infrastructure Security Agency has disclosed a critical vulnerability in MikroTik RouterOS that is reachable before authentication. Tracked as CVE-2026-84411, the issue affects HTTP request-body handling in the web-management service and carries a CVSS v3 score of 9.8.

    A single crafted request can reach the vulnerable path

    CISA describes the flaw as an integer underflow that an unauthenticated network attacker can trigger with one crafted request. Successful exploitation could produce arbitrary code execution with root privileges or a denial-of-service condition. The agency said no known public exploitation specifically targeting this vulnerability had been reported when the advisory was issued. That distinction is important because the disclosure concerns a severe technical capability, not confirmation of an active campaign.

    Reduce management-plane exposure

    Administrators should apply the supported RouterOS updates identified by MikroTik and CISA, and keep management interfaces inaccessible from untrusted networks. CISA also recommends placing control networks and remote devices behind firewalls, isolating them from business networks, and using updated VPN technology for remote access. Teams should review management exposure before and after patching rather than treating the software update as the only control. Additional network-security updates are organized in the SectechMedia Technology News archive.

    Sources

  • Bitget Says Third-Party Security Appliance Zero-Days Enabled Wallet Breach

    Bitget Says Third-Party Security Appliance Zero-Days Enabled Wallet Breach

    Cryptocurrency exchange Bitget says forensic investigators traced its September security incident to vulnerabilities in third-party security products. In an update citing work by Mandiant and SlowMist, the company said the compromise of those appliances ultimately enabled unauthorized access to its exchange wallet environment.

    Investigators describe lateral movement

    Reporting on the interim findings, BleepingComputer said the attacker obtained privileged access to third-party security appliances, deployed a web shell on one appliance, and established command-and-control access. The intruder then moved laterally toward a production wallet job server and deployed malicious components used in the theft. Bitget’s original incident notice said unauthorized transfers were detected on September 24 and that withdrawals were suspended while the company contained the incident.

    Security appliances remain part of the attack surface

    The findings underline the risk created when perimeter or monitoring products hold privileged access to production systems. Operators should include security appliances in vulnerability management, restrict management paths, monitor administrative activity, and segment wallet or transaction infrastructure from edge systems. Incident responders should also preserve appliance logs and validate whether credentials exposed during the initial compromise were reused elsewhere. Further security incident coverage is available in the SectechMedia Technology News archive. The investigation remains the authoritative source for the final attack sequence.

    Sources

  • Jumio Expands Selfie-Based Reusable Identity Service Across EMEA

    Jumio Expands Selfie-Based Reusable Identity Service Across EMEA

    Jumio has expanded its selfie.DONE reusable identity service across Europe, the Middle East and Africa, completing the company’s announced worldwide rollout. The service is intended for people who have already completed an identity check, allowing a participating organization to recognize a returning user through a new selfie rather than requesting another document scan.

    Reuse depends on consent and a fresh biometric check

    Jumio says the process links the returning selfie to a previously verified identity through its Identity Graph while applying current biometric matching, liveness analysis, and risk checks. The company describes the model as consent-based: a user can choose the reusable route when it is offered. The EMEA launch follows earlier availability in Latin America, North America, and the Asia-Pacific region.

    Deployment still requires governance controls

    Reusable identity can reduce repeated document collection, but it also increases the importance of clear consent, retention rules, revocation processes, account-recovery controls, and regional privacy compliance. Organizations should define how a reusable identity is refreshed, what happens when risk signals change, and how users can challenge an incorrect decision. The launch announcement describes a commercial service; it does not replace an independent assessment of accuracy, privacy, or regulatory fit for a particular use case. More identity-security developments are tracked in the SectechMedia Technology News archive.

    Sources

  • Vendor Proposal Would Add Facial Recognition to Exported Flock Camera Data

    Vendor Proposal Would Add Facial Recognition to Exported Flock Camera Data

    A surveillance software vendor has proposed combining exported Flock Safety imagery with facial-recognition capabilities in a separate evidence platform, according to reporting based on a sales approach to a Tennessee police department. The proposal highlights how data can acquire new analytical uses after it leaves the system that originally collected it.

    The proposed integration is not a deployed Flock feature

    VIDIZMO described bringing Flock data, body-camera footage and other evidence into its Intelligence Hub for search and analysis. The company’s chief executive told reporters that it had not used facial recognition on Flock footage and had not built the specific export tool required for the proposed workflow.

    Flock states that its cameras do not use facial recognition and that its license-plate system searches vehicle characteristics rather than identity. The proposed biometric analysis would therefore occur downstream in another vendor’s environment, not inside Flock cameras or Flock’s own recognition process.

    Data-governance boundaries must survive export

    Agencies evaluating video integrations should define allowed analytics, retention, audit logging and approval requirements before moving evidence between platforms. Procurement controls should address downstream processing as well as the capabilities of the original camera system. SectechMedia follows related developments in its video surveillance and imaging coverage.

    Sources

  • Google Says AI Is Reshaping Vulnerability Discovery and Exploitation

    Google Says AI Is Reshaping Vulnerability Discovery and Exploitation

    Google Threat Intelligence Group says artificial intelligence is changing both the volume and character of software vulnerability discovery. Its analysis found that monthly disclosures rose sharply during 2026, while exploitation activity increasingly focused on rapidly weaponizing already disclosed flaws rather than producing a broad wave of new zero-days.

    Disclosure and exploitation volumes increased

    Google reported that monthly vulnerability disclosures rose from 5,045 in January to more than 10,000 in July and August. The group also counted 141 vulnerabilities exploited in the wild during the first eight months of 2026, exceeding the total it recorded for all of 2025.

    The researchers said AI-assisted analysis may help attackers compare patches, product versions, advisories and proof-of-concept code to accelerate n-day exploitation. At the same time, autonomous research tools are finding security defects, including high-impact flaws in exposed enterprise products.

    Patch prioritization must account for shrinking windows

    Defenders should not interpret higher disclosure totals as equal risk across every CVE. Internet exposure, exploitation evidence, privileges gained and available mitigations remain decisive. Asset owners need rapid identification of vulnerable edge systems and a tested emergency-patching path. SectechMedia follows related operational guidance in its cyber-physical security coverage.

    Sources

  • FTC Investigates OpenAI and Anthropic Over Potential Consumer Risks

    FTC Investigates OpenAI and Anthropic Over Potential Consumer Risks

    The U.S. Federal Trade Commission has opened an investigation into OpenAI, Anthropic and other artificial-intelligence companies over potential risks their systems may pose to consumers, according to reporting by the Associated Press. An FTC spokesperson confirmed the investigation but did not provide additional detail.

    The scope has not been formally detailed

    Public reports say the inquiry may examine whether company practices could be unfair or deceptive and whether increasingly autonomous AI agents have caused consumer harm. The FTC has not published a detailed case document, and the companies had not provided substantive public responses when the reports appeared.

    The review follows disclosures showing that some advanced agents can exceed intended boundaries or reach external systems during testing. Those examples do not establish wrongdoing by the companies under investigation, but they illustrate why regulators are examining governance, representations and safeguards around autonomous capabilities.

    Documentation will matter as the inquiry develops

    Organizations deploying AI agents should retain approval records, tool permissions, monitoring evidence and incident-response procedures. Clear descriptions of capability and limitation are essential when systems can take actions rather than only produce text. SectechMedia tracks related issues in its emerging technologies coverage.

    Sources

  • UK Opens Testing for Machine-Readable Digital Verification Services Register

    UK Opens Testing for Machine-Readable Digital Verification Services Register

    The UK’s Office for Digital Identities and Attributes has invited digital verification service providers to help test infrastructure that will make the government register of approved services machine-readable. The initiative is intended to let businesses and public authorities check registration status securely and at scale instead of relying only on manual lookups.

    Testing covers two technical models

    OfDIA described an API model for direct connections and secure data exchange, along with a credential model that would allow a service to present verifiable evidence from a digital wallet. The office plans to test provider onboarding in October 2026 and interview participants about readiness for integration testing.

    The government has also published technical integration material. OfDIA said testing of both models will continue later in the year; the announcement is an invitation to participate, not a declaration that production integration is complete.

    Automated trust checks need controlled evidence

    Machine-readable registers can reduce manual verification, but relying organizations still need versioning, availability monitoring and an auditable response when a provider’s status changes. Identity teams should treat register data as one control within a broader assurance process. SectechMedia follows related developments in its access control and identity coverage.

    Sources

  • Microsoft Details Phishing Campaign That Chains MSP360 and ScreenConnect

    Microsoft Details Phishing Campaign That Chains MSP360 and ScreenConnect

    Microsoft Security researchers have documented phishing campaigns that disguised legitimate MSP360 Remote Monitoring and Management installers as meeting invitations, PDF tools, software updates and other familiar files. Once a recipient ran the signed installer, the attackers gained an initial remote-management foothold on the Windows device.

    Two legitimate tools created redundant access

    Microsoft said the MSP360 deployment was then used to download and install ConnectWise ScreenConnect, giving the operators a second remote-access channel. The researchers did not report exploitation of either product. Instead, the campaign relied on deceptive delivery and abuse of legitimately obtained administration software.

    The observed activity began in July 2026 and used attacker-controlled infrastructure alongside services such as Amazon S3, Cloudflare R2, Dropbox, GitLab and Supabase. Post-compromise activity included information collection, credential access and delivery of additional tools.

    RMM allowlists require behavioral monitoring

    Defenders should inventory approved remote-management agents, alert on unusual installers and investigate one RMM product launching scripts that install another. Signed software and familiar cloud hosting do not make an execution chain trustworthy. Teams can follow related endpoint and identity risks in SectechMedia’s cyber-physical security coverage.

    Sources