We’re Tracking the Future of Security

Category: Data Centers

  • Carbonato Botnet Deploys Telegram-Controlled AI Agent on Exposed Docker Hosts

    Carbonato Botnet Deploys Telegram-Controlled AI Agent on Exposed Docker Hosts

    ThreatDown researchers have documented a botnet called Carbonato that targets Docker daemons exposed without authentication and deploys an open-source AI agent framework for operator-controlled activity. The research was first published on September 22, with additional technical reporting appearing on September 28.

    Exposed Docker APIs provide the entry point

    The operation searches for Docker services reachable on port 2375 without authentication. After finding one, the malware launches a privileged container, mounts the host filesystem and uses the container to execute commands on the underlying host. It then establishes persistence and scans nearby networks for more exposed daemons.

    ThreatDown traced the infrastructure through an unauthenticated registry that exposed repositories, image tags and configuration data. The researchers said the same environment supported a separate operation involving trojanized cryptocurrency wallet applications.

    Hermes Agent becomes the operator interface

    Carbonato installs Hermes Agent without modifying the framework itself, then replaces its persona file with instructions that prioritize persistence, command execution and credential collection. Operators submit tasks through Telegram, while the agent connects to a model gateway and converts those instructions into terminal activity.

    The research highlights a practical cloud-security failure rather than a novel Docker vulnerability: administrative APIs should not be directly exposed without authentication. Organizations can reduce risk by restricting daemon access, authenticating registries, reviewing privileged containers and monitoring for unexpected persistence. The incident adds another example to SectechMedia coverage of Cyber-Physical Security as AI tooling moves into real attack chains.

    Sources

  • SightLogix Launches NS12 and TC12 Thermal Cameras for Critical Infrastructure Perimeters

    SightLogix Launches NS12 and TC12 Thermal Cameras for Critical Infrastructure Perimeters

    SightLogix introduced two new fixed thermal cameras, the SightSensor NS12 and TC12, designed to extend perimeter coverage at critical-infrastructure sites while reducing the number of devices needed across large properties. Both use a 1280×1024 thermal imager, which the company says covers approximately 2.5 times the area of a traditional 640×480 thermal camera, and both run on SightLogix’s Gen7 edge-processing platform, which the company describes as delivering 20 times the AI processing throughput of previous generations.

    The NS12 offers detection distances up to 310 meters depending on lens configuration, while the TC12 combines a thermal sensor with a 4K visible-light camera in a single unit, processing both streams on-device without relying on cloud analysis. Both models use edge-based AI classification intended to reduce false alarms, and integrate with SightLogix’s SightTracker PTZ system for automated target following. The company is positioning the cameras for utility substations, data centers, airports, ports, logistics facilities and large industrial campuses.

    Why it matters

    Perimeter camera coverage at large industrial sites is often limited less by camera quality than by how many devices and how much cabling and networking a site can afford to install — a sensor that covers 2.5 times the area of the previous generation directly reduces that per-site device and installation cost for operators securing long perimeters.

    Sources

  • CISA Flags Command-Injection and SQL Injection Flaws in Schneider Electric NetBotz Monitors

    CISA Flags Command-Injection and SQL Injection Flaws in Schneider Electric NetBotz Monitors

    CISA published an advisory covering two vulnerabilities in Schneider Electric’s NetBotz 5 appliances, which provide video, door-contact, leak, smoke, vibration, temperature and humidity monitoring for data centers and industrial facilities. CVE-2026-13336 is an OS command-injection flaw reachable through a maliciously modified backup-restore file, rated 6.4 (Medium) on the CVSS v3.1 scale. CVE-2026-13337 is a SQL injection flaw in the appliance’s web interface, rated 4.6 (Medium).

    Both vulnerabilities affect NetBotz software versions 5.5.2 and earlier. Schneider Electric has released version 5.6.0 to remediate both issues. CISA lists the affected sectors as Commercial Facilities, Critical Manufacturing and Information Technology, with unpatched devices at risk of arbitrary code execution, device manipulation or unauthorized data access.

    Why it matters

    NetBotz appliances are themselves security and environmental monitoring equipment installed inside data centers — a vulnerability in the monitor undermines the very physical-security function the device is deployed to provide.

    Sources

  • Diesel Spill at New Jersey AI Data Center Draws Environmental Scrutiny

    Diesel Spill at New Jersey AI Data Center Draws Environmental Scrutiny

    An estimated 5,000 gallons of diesel fuel spilled from a storage tank at an Equinix data center in Secaucus, New Jersey, on the evening of Friday, September 11, 2026, and flowed into Anderson Creek, a tributary of the Hackensack River, according to CBS News New York, which cited the New Jersey Department of Environmental Protection. The facility, which is under construction and expansion, uses diesel tanks to power backup generators. Cleanup crews have used vacuum trucks to remove a mixture of fuel and water from the creek since the spill was detected.

    Equinix said in a statement that it detected the fuel release Friday, stopped it, and immediately contacted relevant agencies. “We are working closely with those agencies, local officials, and community stakeholders to ensure a thorough remediation, while also conducting a full investigation to determine the root cause and prevent recurrence,” the company said, according to CBS News New York. Bill Sheehan of the environmental group Hackensack Riverkeeper told CBS he was informed a computer glitch triggered the spill.

    The incident has renewed local debate over the rapid expansion of AI-driven data center capacity in the New Jersey Meadowlands, with advocacy groups using the episode to press for a statewide moratorium on new data center construction, citing the sector’s growing power and infrastructure footprint.

    Why it matters

    Backup-generator fuel systems are a routine part of data center resiliency design, but this incident is a reminder that the same infrastructure meant to protect uptime carries its own environmental and physical-security exposure that facility teams need to monitor, not just the IT floor.

    Sources

  • Acronis Backup Plugins for cPanel and Plesk Carry Actively Exploited Privilege-Escalation Flaw

    Acronis Backup Plugins for cPanel and Plesk Carry Actively Exploited Privilege-Escalation Flaw

    Acronis has disclosed a high-severity local privilege-escalation vulnerability in its backup plugin for cPanel, WebHost Manager (WHM) and Plesk, warning that it has detected exploitation in the wild. The flaw, tracked as CVE-2026-87886, carries a CVSS severity score of 7.8 and allows a low-privileged attacker to increase their permission level on a vulnerable Linux server without user interaction, potentially enabling access to or modification of sensitive data, according to Acronis’s advisory.

    The plugins connect the widely used cPanel and Plesk hosting control panels to Acronis’s backup infrastructure, letting administrators back up and restore websites, databases, mailboxes and hosting accounts. Acronis said exploitation “has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments,” though it told BleepingComputer the assessment is based on a single report from a potentially affected customer.

    Affected versions include the Acronis Backup plugin for cPanel & WHM prior to build 1.9.3.1021, fixed in version 1.9.3 HF3, and the Acronis Backup extension for Plesk prior to build 1.8.11.638, fixed in version 1.8.11. Acronis is urging all users of the affected integrations to update immediately.

    Why it matters

    Backup plugins run with elevated privileges by design, which is exactly what makes a privilege-escalation flaw in one valuable to an attacker who already has limited server access; hosting operators should treat the patch as time-sensitive rather than routine.

    Sources

  • Meta Tests Robots From Watney, Kinova and ABB to Automate Data Center Maintenance

    Meta Tests Robots From Watney, Kinova and ABB to Automate Data Center Maintenance

    Meta is piloting robots from three vendors, Watney Robotics, Kinova and ABB, to handle physical maintenance tasks inside its data centers, including swapping network cables, power-cycling servers, reseating components and inspecting equipment, according to an August 31, 2026 report from WIRED based on current and former employees familiar with the trials.

    What the Robots Are Doing

    At Meta’s Altoona, Iowa campus, a pair of dual-armed Watney robots has been tested on cabling work since June 2025, supervised by human operators and still slower than a person, per the report. At the Prometheus campus in New Albany, Ohio, four-wheel ABB robots equipped with a scissor-lift riser and a six-axis arm are being used to reseat hardware components, and Meta is separately evaluating a Kinova Gen3 robotic arm for power-cycling servers. Meta has also deployed simpler robots that remotely restart devices by physically pressing power buttons. Kinova and ABB declined to comment to WIRED, and Watney did not respond to the outlet’s requests for comment.

    Why It Matters

    One Meta data-center worker told WIRED that a working cable-swapping system could eventually take on as much as 80% of some technicians’ current workload, though that figure is an employee estimate rather than a company-published target, and the robots still struggle with dense cabling, tight corners and tasks that require sustained autonomy. As AI-driven data center buildouts accelerate, the trials point to facility operations and physical security converging with the same automation trends reshaping server hardware itself.

  • Texas Governor Orders Pause on New Data Center Approvals Amid Grid Interconnection Strain

    Texas Governor Orders Pause on New Data Center Approvals Amid Grid Interconnection Strain

    Texas Governor Greg Abbott has ordered a pause on approvals for new large data center projects seeking to connect to the state’s power grid, a move that Houston Public Media reported on August 27, 2026 could delay roughly 300 large data center projects, though not every planned facility in the state is covered by the pause.

    The order responds to mounting pressure on the Electric Reliability Council of Texas (ERCOT) interconnection queue, as AI-driven data center demand has produced a wave of large-load requests competing for grid capacity and connection timelines. According to the report, Beth Garza, who previously served as ERCOT’s independent market monitor, said the interconnection process could take significantly longer than originally projected, whether because of the governor’s pause or because the initial timeline itself was unrealistic; Garza said she “will be pleasantly surprised” if by April 2027 the industry has a clear picture of which data center loads will ultimately be able to move forward.

    Texas has emerged as one of the largest hubs for hyperscale and AI-focused data center construction in the country, drawing investment from major cloud and AI infrastructure providers seeking access to relatively fast permitting and available land, but also straining grid planning as operators request power commitments that can rival the demand of entire cities. The pause reflects a broader tension states are navigating between courting large-scale data center investment and protecting grid reliability and consumer electricity costs for existing residential and industrial customers.

    For the physical security and critical infrastructure sector, large-scale data center buildouts have significant downstream implications beyond power supply: campus perimeter security, access control, and fire and life-safety systems are typically scoped and budgeted alongside the underlying facility and power infrastructure, meaning delays or restructuring of a project’s grid interconnection timeline can directly affect the pace of associated physical security procurement and installation work tied to new builds.

  • Nvidia Makes Minority Investment in Data-Center Power Developer Cloverleaf

    Nvidia Makes Minority Investment in Data-Center Power Developer Cloverleaf

    Nvidia has made a minority investment in privately held Cloverleaf Infrastructure, a company that arranges power and site infrastructure for AI data-center projects across the United States, the companies said on Friday, August 21, 2026, according to Reuters.

    Chipmaker Moves Further Upstream Into Power

    Financial terms of the investment were not disclosed, but the Wall Street Journal reported the same day, citing people familiar with the deal, that Nvidia was expected to invest up to several hundred million dollars. Cloverleaf works with utilities, energy providers and investors to secure power and other infrastructure for data-center sites, and the company says it has delivered multiple gigawatt-scale projects across North America since its founding in 2024. As part of the arrangement, Cloverleaf will deploy Nvidia’s DSX platform to help optimize decisions on site selection, power, cooling and computing infrastructure for the data centers it develops.

    J.P. Morgan Securities served as exclusive financial advisor and Kirkland & Ellis as legal counsel to Cloverleaf in structuring the deal, according to trade publication POWER.

    Part of a Broader Pattern of Financing Data-Center Buildout

    The Cloverleaf investment came just days after Nvidia announced a separate $1.5 billion investment in SoftBank-owned SB Energy to support the PORTS-Pike technology campus, a 10-gigawatt, OpenAI-linked data-center project in Pike County, Ohio. Nvidia CEO Jensen Huang said of that earlier deal that “AI is becoming infrastructure — the foundation for intelligence in every industry — and land, power and shell have become vital.” Taken together, the two deals illustrate how Nvidia has begun taking a more direct role in financing and developing the data centers that ultimately buy its AI computing systems, rather than simply supplying chips to third-party developers. Power availability, rather than chip supply, has increasingly become the binding constraint on how quickly new AI data-center capacity can come online.

    Sources

  • Nvidia Customers Reportedly Warned of AI Server Price Hikes as Groq Deal Moves Forward

    Nvidia Customers Reportedly Warned of AI Server Price Hikes as Groq Deal Moves Forward

    Nvidia’s largest server customers have been told to expect price increases of more than 15% in many cases for AI servers, driven by rising memory chip costs, Bloomberg reported over the weekend of August 22–23, 2026, with the story continuing to be discussed heavily in tech and financial media on August 24. Separately, CNBC reported that Nvidia said racks built with hardware from Groq — in which Nvidia recently made a roughly $20 billion related investment — will come online later this year.

    What is driving the increases

    According to Bloomberg’s reporting, the price increases are being driven primarily by soaring memory chip costs rather than by Nvidia’s own component pricing, as server makers pass through higher costs for the memory needed to build AI-optimized systems. The report landed the week Nvidia is scheduled to report quarterly earnings, adding to investor focus on demand signals for the company’s AI hardware.

    Why it matters

    Rising AI server costs affect every organization planning large-scale data center buildouts, including security, video analytics and AI-driven monitoring platforms that increasingly depend on GPU-accelerated infrastructure. Higher per-server costs can slow the pace at which cloud providers and enterprises expand AI compute capacity, even as demand signals — including Nvidia’s push to bring Groq-linked infrastructure online this year — suggest that AI infrastructure investment is continuing at a rapid pace despite the added cost pressure.

    Sources

    More coverage like this is available on Technology News.

  • Data Center Physical Security: A Layered Design Guide

    Data Center Physical Security: A Layered Design Guide

    Data centers are among the most security-sensitive facilities in modern infrastructure. They contain high-value equipment, critical data services and dependencies that support banking, telecom, cloud platforms, government systems and enterprise operations. Physical security must therefore be designed as a layered system.

    Layer 1: Site Boundary

    The outer boundary should discourage casual access and provide early detection. Depending on the site, this may include fencing, vehicle barriers, perimeter cameras, thermal imaging, radar or fiber-optic intrusion detection. The goal is to create enough distance and warning time before a person reaches the building.

    Layer 2: Vehicle and Visitor Control

    Vehicle gates, intercoms, license-plate recognition and visitor-management systems establish accountability before entry. Delivery vehicles and contractors should follow workflows different from permanent staff.

    Layer 3: Building Access

    Access control should use strong credentials, anti-passback logic and role-based permissions. High-security sites may add biometrics, mantraps or multi-factor physical authentication. Credentials should be linked to HR and identity-management processes so access changes when employment status changes.

    Layer 4: White Space and Critical Rooms

    Server halls, network rooms, power systems and storage areas require additional zoning. Not every employee who can enter the building should be able to enter every technical space. Door events should be correlated with video so investigations can reconstruct who entered, when and under which authorization.

    Video and Analytics

    Cameras support verification, investigation and compliance. Coverage should focus on entrances, corridors, cages, loading areas and critical equipment zones. Analytics can help identify tailgating, unusual movement or occupancy patterns, but should supplement rather than replace access-control logic.

    Environmental and Fire Protection

    Physical security also includes resilience. Aspirating smoke detection, thermal monitoring, leak detection, clean-agent suppression and power-system monitoring protect availability from non-criminal threats.

    Cyber-Physical Security

    Security devices themselves are networked computers. Cameras and controllers need firmware management, segmentation, strong credentials and logging. Compromised physical-security devices can create both cyber and physical risk.

    Conclusion

    The strongest data-center design uses multiple independent layers so failure of one control does not expose the asset. Perimeter security, identity, video, environmental monitoring and cybersecurity should all contribute to a single risk-based architecture.