We’re Tracking the Future of Security

Category: Government

  • Cloudflare Announces Public Certificate Authority for Post-Quantum TLS

    Cloudflare Announces Public Certificate Authority for Post-Quantum TLS

    Cloudflare has announced plans to operate a public certificate authority capable of issuing both conventional and post-quantum digital certificates. The company says the service is intended to help website operators prepare public key infrastructure for future cryptographic threats without waiting for a separate migration project.

    The program targets the certificate layer

    Post-quantum TLS requires more than changing the key exchange used during a connection. Certificate signatures, issuance workflows, validation software and hardware security modules also need compatible algorithms and operational controls. Cloudflare said its authority will support standards-based certificates as browser and ecosystem requirements mature.

    The company already uses post-quantum key agreement on parts of its network, but a public certificate authority introduces a different trust role. Certificate issuance requires audited identity validation, key protection, revocation services, public logging and browser-root program acceptance.

    Deployment must follow ecosystem readiness

    Organizations should inventory certificate lifetimes, automation dependencies, TLS inspection devices and embedded clients before adopting new signature schemes. Larger keys and signatures can affect constrained devices and network paths. Hybrid testing and rollback plans remain essential while standards and client support evolve. SectechMedia follows related controls in its cybersecurity coverage.

    Sources

  • OpenSSL Patches High-Severity DTLS Flaw That Can Expose Server Memory

    OpenSSL Patches High-Severity DTLS Flaw That Can Expose Server Memory

    The OpenSSL project has fixed a high-severity vulnerability in its Datagram Transport Layer Security implementation that can disclose portions of server memory. CVE-2026-84782 affects applications using DTLS listening functionality and may expose data before a peer has been authenticated.

    An invalid cookie could trigger an oversized response

    According to the project advisory, a server processing a malformed ClientHello with an invalid cookie could calculate the length of its HelloVerifyRequest incorrectly. The resulting message could include uninitialized heap memory and transmit it without encryption. OpenSSL said the issue primarily affects DTLS servers built around BIO_s_datagram and DTLSv1_listen.

    The project released corrected versions across supported branches, including OpenSSL 3.0.22, 3.3.7, 3.4.5, 3.5.5 and 3.6.1. Distribution advisories from Ubuntu and Debian provide package-level guidance for affected systems.

    Operators need an application-level inventory

    Teams should identify services that actually use DTLS server-listening functions, not assume every installed OpenSSL package has the same exposure. Internet-facing gateways, communications systems and embedded services deserve priority. After upgrading, operators should restart dependent processes and verify the loaded library version. SectechMedia follows related risks in its cybersecurity coverage.

    Sources

  • Pentagon Personnel Agency Data Breach Exposes Records of About Three Million People

    Pentagon Personnel Agency Data Breach Exposes Records of About Three Million People

    The US Defense Manpower Data Center has begun notifying people that unauthorized users accessed files containing personal information on one of its file-sharing servers. Reporting based on the agency’s notification and a Defense Department official places the affected population at roughly three million living and deceased individuals.

    The exposed server held unencrypted personnel data

    The notification says a vulnerability discovered on July 16, 2026 allowed unauthorized access to files. Investigators found that a small number of users had accessed the server between October 2025 and discovery. The center patched the file-sharing system and restored service after identifying the weakness.

    Records varied by person and could include names, Social Security numbers, dates of birth, contact details, demographic information and military occupational specialties. The agency said it had not identified misuse when notices were issued.

    Long exposure windows increase investigation demands

    Incident teams must determine which files were reached, which identities were exposed and whether access persisted across credential or server changes. Sensitive government repositories require encryption, least privilege and alerting on abnormal file access. SectechMedia follows related controls in its cybersecurity coverage.

    Sources

  • Microsoft Says Star Blizzard Used Fake Event Invitations to Deliver CosmicPulse Backdoor

    Microsoft Says Star Blizzard Used Fake Event Invitations to Deliver CosmicPulse Backdoor

    Microsoft Threat Intelligence says the Russia-linked actor Star Blizzard has refined its phishing and malware delivery operations with a technique the company calls RedFlick. The group used fake invitations and follow-up correspondence to persuade selected targets to open password-protected archives that ultimately installed a backdoor named CosmicPulse.

    The campaign blended social engineering with scheduled execution

    Microsoft identified at least 13 larger campaigns during 2026, in addition to more narrowly targeted activity. The emails impersonated recognized organizations and event hosts, while compromised WordPress and cPanel webmail accounts helped make messages appear more credible. The archive password was presented separately, encouraging recipients to treat the file as protected material.

    After execution, RedFlick used scheduled tasks to establish persistence and launch CosmicPulse. Microsoft said the activity focused heavily on organizations and individuals connected to Ukraine, policy research and international affairs.

    Defenders should investigate the conversation, not only the attachment

    Security teams should review multi-message exchanges, unusual password-protected archives and new scheduled tasks together. Compromised third-party mailboxes can defeat simple sender-reputation checks, so identity telemetry and endpoint evidence remain essential. SectechMedia tracks related campaigns in its cybersecurity coverage.

    Sources

  • ANSSI Finds Stolen Passwords and Monitoring Gaps Behind French Tax Data Theft

    ANSSI Finds Stolen Passwords and Monitoring Gaps Behind French Tax Data Theft

    France’s national cybersecurity agency ANSSI has published its investigation into cyberattacks affecting the country’s tax administration, the DGFiP. The agency found that attackers used legitimate staff credentials and exploited weaknesses in authentication, network architecture and monitoring to reach sensitive systems and remove data.

    Valid accounts reduced the attacker’s visibility

    ANSSI traced unauthorized activity between May and August 2026 across the tax portal and a separate land-registry environment. Credentials had been exposed after use on unmanaged personal devices, while some access portals lacked strong authentication. Sensitive applications were also reachable through government network paths without sufficient segmentation.

    The report says neither DGFiP monitoring nor ANSSI’s network sensors detected the two data-exfiltration waves. One portal used by the attacker was not monitored, application logs were unavailable to ANSSI and suspicious signals were not correlated across systems.

    Session control and application telemetry are central

    The case shows why password resets must revoke active sessions across every connected portal. Public-sector operators should combine phishing-resistant authentication, application-level logging, data-volume alerts and segmentation between agencies. Retrospective searches should also connect identity, application and network evidence across administrative boundaries. SectechMedia follows related controls in its cyber-physical security coverage.

    Sources

  • Dutch Police Arrest Amsterdam Man in ShinyHunters Investigation

    Dutch Police Arrest Amsterdam Man in ShinyHunters Investigation

    Dutch police have confirmed the arrest of a 24-year-old Amsterdam man in an investigation into the ShinyHunters cybercrime group. Authorities said the suspect was due to appear before the Rotterdam District Court on September 29, while public reporting linked the case to an individual previously convicted for data theft and extortion activity.

    The investigation follows renewed ShinyHunters activity

    The arrest comes amid scrutiny of recent operations attributed to ShinyHunters, including attacks involving enterprise applications and claims concerning stolen government data. Dutch authorities did not publish detailed allegations in the brief confirmation, so the arrest should not be treated as proof of responsibility for every campaign associated with the group name.

    SecurityWeek and The Hacker News reported that the suspect had faced an earlier Dutch cybercrime case. The current investigation remains subject to court proceedings and further law-enforcement disclosure.

    Attribution should remain evidence-led

    Organizations responding to extortion or data-theft claims should preserve access logs, identity records and application telemetry before drawing conclusions from a threat actor’s public statements. Law-enforcement coordination can also help correlate infrastructure and victim reports. SectechMedia follows related investigations in its cybersecurity coverage.

    Sources

  • US Justice Department Selects ROC Platform for Digital Evidence and Video Analytics

    US Justice Department Selects ROC Platform for Digital Evidence and Video Analytics

    The US Department of Justice has selected ROC technology to support a digital-evidence review platform used in federal criminal investigations, according to a September 28 report by Biometric Update. The contract combines evidence ingestion and review with facial recognition and other video-analytics capabilities.

    The platform is intended for mixed digital evidence

    The reported scope includes e-discovery material from sources such as mobile devices and social-media accounts. ROC is responsible for developing and supporting the platform used to ingest, review and analyze that information. The company describes the award as a one-year base contract followed by optional annual extensions.

    Biometric Update reported a guaranteed base value of $7 million and a possible value of $64.3 million if all options are exercised. Those optional years are not guaranteed spending and should not be treated as the current contract value.

    Evidence workflows require more than recognition software

    Large investigative systems need access controls, audit trails, retention rules, model-performance monitoring and reproducible evidence exports. Facial recognition can narrow review workloads, but candidate results require trained human assessment and documented handling rather than automatic identity conclusions.

    Procurement teams should also test image quality limits, demographic performance, false-positive handling and chain-of-custody controls before operational acceptance. The award sits at the intersection of Video Surveillance & Imaging and digital forensics, where analytics must preserve evidentiary integrity as well as search speed.

    Sources

  • US Lawmakers Reintroduce Federal Biometric Surveillance Moratorium Bill

    US Lawmakers Reintroduce Federal Biometric Surveillance Moratorium Bill

    US lawmakers have reintroduced legislation intended to restrict federal use of facial recognition and other biometric surveillance technologies. Senator Edward Markey announced the bill with Senator Jeff Merkley and Representatives Pramila Jayapal, Rashida Tlaib and Ayanna Pressley on September 25.

    The proposal covers multiple biometric modalities

    According to the sponsors and Biometric Update, the proposal would prevent federal agencies from using or acquiring facial recognition, voice recognition and other biometric surveillance systems without explicit congressional authorization. It also addresses access to biometric data held by state, local and private entities.

    The measure revives an earlier moratorium proposal with broader language. Supporters argue that federal use should pause until Congress establishes enforceable rules for civil rights, due process, transparency and oversight. The bill is a proposal rather than current law, and its provisions remain subject to the legislative process.

    Procurement teams face continuing policy uncertainty

    Public-sector security programs should distinguish technical capability from legal authority. Agencies considering biometric deployments need documented purpose, data retention rules, performance testing, human review and an appeal process, while suppliers must avoid presenting pilot results as universal accuracy guarantees.

    The debate also affects interoperability and lifecycle planning because restrictions can influence which databases, cameras and identity services may be connected. SectechMedia tracks these issues within Access Control & Identity, where privacy governance and operational performance need to be evaluated together.

    Sources

  • FBI and CISA Warn Critical Infrastructure Operators About ICS Integrator Access

    FBI and CISA Warn Critical Infrastructure Operators About ICS Integrator Access

    The FBI and the Cybersecurity and Infrastructure Security Agency issued guidance on September 23 about cybersecurity risks created when third-party industrial control system integrators receive access to critical-infrastructure environments. The agencies urged operators to treat integrator connections as governed, monitored access paths rather than permanent trusted links.

    A provider breach exposed customer information

    According to the guidance summarized by Security Today, a 2025 breach of a US industrial automation provider affected an organization serving power and transportation customers. Foreign actors searched the provider network for customer and supervisory control and data acquisition material, then placed hundreds of items into compressed archives.

    The episode illustrates how a compromise at one engineering or support company can create visibility into multiple operators. Drawings, device information and customer SCADA data can help attackers understand industrial environments even when they have not yet reached an operational network.

    Access should be limited and observable

    The agencies recommended limiting each integrator to the access required for its work, recording remote sessions and documenting supplied technology. Contracts should define cybersecurity obligations, while operators should maintain offline copies of software needed to run equipment and prepare for a provider becoming unavailable.

    Organizations should also review dormant accounts, shared credentials, remote-access gateways and support pathways after projects end. These controls align supplier governance with technical segmentation and operational resilience. The warning is especially relevant to SectechMedia readers responsible for Industrial Safety & Monitoring, where maintenance access can cross the boundary between business systems and essential processes.

    Sources

  • DC Health Agency Says Hidden Report Data Exposed Nearly 400,000 Beneficiary Records

    DC Health Agency Says Hidden Report Data Exposed Nearly 400,000 Beneficiary Records

    The District of Columbia Department of Health Care Finance is notifying nearly 400,000 Medicaid and DC Healthcare Alliance beneficiaries after discovering that two reports on its public website contained hidden personal information. The incident was not described as a network intrusion; the exposure came from underlying report data that unauthorized users could potentially reach.

    Summary reports contained accessible supporting records

    The reports were intended to display enrollment totals and other aggregate statistics. DHCF said the visible pages did not show personal details, but supporting information may have been accessible between 2023 and July 2026. The affected population includes beneficiaries enrolled during that period.

    The exposed fields varied by record and included Medicaid identifiers and other personal information. DHCF removed the reports, investigated the issue and began notifying affected people. The agency’s notice provides current details and assistance information.

    Publication workflows need hidden-data testing

    Organizations publishing dashboards, spreadsheets or generated reports should inspect source files, embedded datasets, metadata and export endpoints before release. Access tests must verify what an unauthenticated user can retrieve, not only what the page displays. SectechMedia follows related controls in its cybersecurity coverage.

    Sources