We’re Tracking the Future of Security

Category: News

Current, event-driven reporting, announcements and industry developments.

  • Philippine Nuclear and Naval Targets Hit by Suspected Chinese-Speaking Operator

    Philippine Nuclear and Naval Targets Hit by Suspected Chinese-Speaking Operator

    A suspected Chinese-speaking threat actor breached Philippine nuclear research and naval-related organizations by exploiting known vulnerabilities in internet-facing ownCloud and WordPress systems, stealing sensitive data including nuclear reactor component databases and personnel records, according to Security Affairs and independent research from Hunt.io.

    Known Vulnerabilities, High-Value Targets

    The intrusions exploited two previously disclosed vulnerabilities — CVE-2023-49105 and CVE-2024-28000 — rather than a novel zero-day, underscoring how unpatched, internet-exposed systems remain a viable entry point into sensitive government and defense-adjacent networks years after fixes became available. Hunt.io researchers linked the activity to infrastructure including an IP address at 31.58.209[.]241, and found that stolen data was organized using Chinese-language folder and file names, including terms corresponding to “Nuclear Material Accounts” and “IT Planning,” along with code comments and docstrings that strongly suggest the operator is a native Chinese speaker or highly fluent in the language.

    Intelligence Collection, Not Opportunistic Crime

    Researchers characterized the operation as consistent with targeted intelligence collection against high-value defense and scientific institutions rather than financially motivated cybercrime. The theft of nuclear reactor component data and personnel records from two organizations raises particular concern given the sensitivity of nuclear material accounting information, which is typically subject to international safeguards and non-proliferation reporting requirements.

    Recommended Response

    Security Affairs and Hunt.io both recommend that organizations running ownCloud and WordPress promptly apply available patches, upgrade to supported versions, and enforce strong authentication measures given the continued exploitation of these older, publicly known flaws. The incident adds to a broader pattern of suspected Chinese state-linked operators targeting critical infrastructure and defense-adjacent organizations across the Indo-Pacific region, an area of persistent concern for U.S. and allied cybersecurity agencies monitoring pre-positioning activity ahead of potential regional conflict scenarios.

  • Love Electric Breach Exposes Up to 877,000 UK Driver Records for Sale

    Love Electric Breach Exposes Up to 877,000 UK Driver Records for Sale

    A seller on an English-language cybercrime forum claims to have obtained the driver database of Love Electric, a UK broker that runs electric-vehicle salary sacrifice schemes, offering approximately 877,000 driver records for $600, according to Security Affairs.

    What Was Allegedly Taken

    The seller, operating under the pseudonym “seraphims,” listed the database on August 26 and claims it includes sensitive personal information such as National Insurance numbers and driving license numbers, drawn from a table structured as dbo.drivers within a Microsoft SQL Server database. The seller claims the data was obtained through a zero-day vulnerability in a third-party system, though Security Affairs notes this claim remains unverified, and the actual scope and accuracy of the exposed record count has not been independently confirmed.

    A Third-Party Risk Story

    Love Electric operates as a broker for electric-vehicle salary sacrifice schemes, meaning the driver data it holds is typically supplied by employers on behalf of employees enrolling in the benefit — a structure that concentrates sensitive identity data (National Insurance and driving license numbers) with a third-party intermediary rather than the employer itself. If confirmed, the incident would highlight the identity-theft risk created when employee benefit administrators accumulate government identification data as a byproduct of otherwise routine benefits processing, a risk pattern security researchers have flagged repeatedly across payroll, salary-sacrifice and benefits-brokerage platforms.

    Risk to Affected Drivers

    Exposed National Insurance and driving license numbers are commonly used identity verification data points in the UK, meaning a confirmed breach of this scale could expose affected individuals to a heightened risk of convincing phishing attacks and identity fraud attempts that reference their real personal and vehicle information to appear legitimate. Love Electric has not yet issued a public statement confirming or denying the breach claim.

  • Lockheed Martin Ventures and Presidio Ventures Back Quantum Camera Startup Diffraqtion

    Lockheed Martin Ventures and Presidio Ventures Back Quantum Camera Startup Diffraqtion

    Diffraqtion, an MIT and University of Maryland spinout building quantum camera platforms for defense and space sensing, announced strategic investments from Lockheed Martin Ventures and Presidio Ventures — the venture arm of Japan’s Sumitomo Corporation — bringing the company’s total pre-seed funding to more than $10 million, according to the company’s announcement and SpaceNews.

    From Laboratory to Flight Demonstration

    The new investment follows roughly seven months of progress since the round’s first close in January 2026, led by Ground State Ventures. In that time, Diffraqtion completed on-sky demonstrations at a partner observatory distinguishing closely spaced objects, advanced its DARPA Direct-to-Phase-II SBIR contract into its second option period, and was selected by NASA for an SBIR Phase I award in orbital debris tracking, alongside winning NASA’s $100,000 Space to Soil Challenge for adaptive imaging. “This team’s rapid progress from laboratory development toward flight demonstration is particularly promising,” said Chris Moran, vice president and general manager of Lockheed Martin Ventures.

    Dual-Use Sensing for Defense and Industry

    Diffraqtion’s quantum imaging technology is designed to apply the same underlying physics advantage whether the camera is observing objects in orbit, tracking targets on Earth, or guiding a physical system in real time. “What drew us to Diffraqtion is that the same physics advantage applies whether the camera is observing the sky or the Earth, or guiding a physical system,” said Ross Leav, senior vice president at Presidio Ventures. “We see significant opportunity to bring this capability to industrial and commercial markets globally.”

    Part of a Broader Defense-Tech Investment Wave

    The round adds Lockheed Martin Ventures and Presidio Ventures to a syndicate that already included QDNL Participations, milemark·capital, Aether VC and ADIN from the January close, alongside new participants SBI US Gateway Fund with Plug and Play, Collaborative Fund and TekVentures. The investment reflects a broader surge of venture capital flowing into defense-adjacent sensing and space technology startups, as established defense primes increasingly use corporate venture arms to gain early access to dual-use technologies developed outside traditional defense contracting channels.

  • Axis Survey Finds Growing Public Comfort With Video Surveillance, But Privacy Expectations Remain High

    Axis Survey Finds Growing Public Comfort With Video Surveillance, But Privacy Expectations Remain High

    A new survey commissioned by Axis Communications finds that nearly six in ten U.S. adults are more comfortable with video surveillance today than they were five years ago, even as respondents continue to expect transparency, privacy safeguards and responsible use of AI in how that surveillance is deployed, according to reporting from SecurityInfoWatch.

    The Numbers

    The survey found that 58% of U.S. respondents said they are more comfortable with video surveillance in both public and private spaces than they were five years ago. Within that figure, 20% described themselves as significantly more comfortable, while a further 23% reported being somewhat more comfortable. Comfort levels varied depending on where surveillance is deployed, with respondents generally more accepting of cameras in transportation hubs, retail environments and workplaces than in more private or ambiguous settings.

    Comfort Is Conditional, Not Unconditional

    Despite the overall upward trend in acceptance, the research makes clear that public tolerance for video surveillance is not unconditional. Respondents continued to cite transparency about how footage is used and stored, clear privacy policies, and confidence that AI-driven video analytics are applied responsibly as prerequisites for their comfort. That combination — rising baseline acceptance paired with persistent conditions attached to it — mirrors a pattern security researchers have observed across other public-facing surveillance and biometric technologies as AI-powered analytics become standard in commercial video management platforms.

    Why It Matters for Operators

    For security integrators and end users, the findings suggest that expanding camera coverage or adding AI analytics capabilities is unlikely to trigger the public backlash it might have several years ago, provided organizations pair those deployments with clear signage, published data-retention policies and visible governance over how video and derived analytics are used. The survey adds to a growing body of industry research suggesting that public perception of video surveillance is shifting from a binary privacy-versus-security debate toward a more nuanced expectation of accountable deployment.

  • Hackers Abuse npm Mirrors to Host Phishing Redirect Pages Disguised as Cloudflare Verification

    Hackers Abuse npm Mirrors to Host Phishing Redirect Pages Disguised as Cloudflare Verification

    Security researchers at OX Security have identified 24 npm packages that exist solely to host phishing redirect pages disguised as Cloudflare Turnstile verification screens, exploiting the way mirror services like unpkg and npmmirror expose individual package files directly in a browser, according to BleepingComputer.

    How the Technique Works

    Attackers upload npm packages containing nothing more than a malicious HTML file and a package.json file declaring it as the main entry point. Because mirroring platforms such as unpkg.com let individual files inside a published package be opened directly through a browser URL, the malicious HTML renders as though it were served from a trusted, legitimate domain rather than from attacker-controlled infrastructure — a distinction that can help the page evade security software trained to flag suspicious hosts. Installing the package itself causes no harm; the payload is the standalone HTML file, not executable code bundled with the package.

    Security researcher inf0stache first spotted the technique in July 2026 in a package named “china_airlines,” which used a fake Cloudflare verification page to redirect visitors to a malicious domain. OX Security subsequently found the same HTML template reused across 24 separate packages. Some of the malicious packages reference api.keyval.org, allowing operators to change the ultimate redirect destination remotely without needing to publish a new version of the package. OX also warned that packages removed from the official npm registry can persist indefinitely on third-party mirrors, meaning takedown at the source does not guarantee the malicious content disappears.

    Part of a Broader Pattern

    The campaign echoes an earlier technique documented by Socket in October 2025, when researchers found 175 malicious npm packages — collectively downloaded more than 26,000 times — using unpkg to host redirect scripts rather than full phishing pages, targeting Microsoft 365 accounts that lacked multi-factor authentication. “Threat actors keep finding and using new and novel techniques not just to deliver malware, but to use legitimate infrastructure to store their payloads and data,” OX Security concluded. For organizations relying on npm and its mirrors as part of their software supply chain, the finding underscores that package registries have become a persistent target for abuse well beyond traditional malicious-dependency attacks.

  • TDSi by Hirsch Releases GARDiS 3.3 Access Control Software Update With New Intruder Integration and Credential Model

    TDSi by Hirsch Releases GARDiS 3.3 Access Control Software Update With New Intruder Integration and Credential Model

    Integrated access control manufacturer TDSi by Hirsch has released GARDiS version 3.3, a major update to its access control software platform introducing new intruder-detection integrations, a redesigned credential model and expanded security and data-governance controls, according to Security Info Watch.

    A Unified Credential Model

    The centerpiece of the release is a redesigned credential model built around a universal “Card or Fob” type that works across virtually all reader and card technologies, removing the need for administrators to manually select and match credential types to specific decode formats. Existing credentials are migrated automatically during the upgrade process and can be verified before changes take effect. Biometric credentials and IP lock whitelisting are included within the same unified approach, simplifying what has traditionally been one of the more error-prone parts of access control administration.

    Expanded Security and Governance Controls

    GARDiS 3.3 adds configurable password rules, banned-word lists and automatic account lockout to strengthen login security, alongside new event-dashboard permissions that control which users can view live and archived security events. Organization-based filtering further restricts user access to information tied only to the people they are authorized to manage — a feature aimed at larger, multi-tenant or multi-site deployments where over-broad visibility has historically been a governance concern. Saved reports can now be kept private to their creator or explicitly shared with designated colleagues, giving administrators finer control over sensitive operational data.

    Ajax Cloud Integration for Intruder Detection

    The release also introduces new intruder-system integration with Ajax Cloud, allowing GARDiS to incorporate intrusion-detection alerts alongside access control events within a single management interface. Combining access control and intrusion alarm data in one platform reflects a broader industry trend toward converged physical security management, where operators increasingly expect a single pane of glass rather than separate systems for access, video and intrusion detection.

  • RapidFire Safety & Security Acquires Black Fire & Security Services in West Texas Expansion

    RapidFire Safety & Security Acquires Black Fire & Security Services in West Texas Expansion

    RapidFire Safety & Security has acquired Black Fire & Security Services, an El Paso, Texas-based provider of fire protection, electronic security and life-safety solutions, expanding the St. Louis-based platform’s footprint into West Texas, according to Security Info Watch.

    What the Deal Adds

    Black Fire & Security Services brings a broad service portfolio to the combined company, including fire alarm systems, video surveillance, access control and monitoring services, alongside fire extinguisher inspection and kitchen exhaust hood cleaning — specialized service lines that expand RapidFire’s capabilities beyond its existing fire, life-safety and security offerings. The acquisition is RapidFire’s latest in a series of Texas-focused deals as the company builds out a multi-regional presence across the Southwest and Midwest United States.

    Part of a Broader Consolidation Trend

    RapidFire, backed by Concentric Equity Partners, has pursued a “buy, build, grow” strategy since its founding in 2022, acquiring a string of regional fire, security and life-safety integrators to build a larger multi-state platform. The company’s prior Texas acquisitions include Texas Star Fire Systems, Progressive Protection Security Systems and ACT Low Voltage, reflecting a broader wave of private-equity-backed consolidation reshaping the fragmented fire and security integration market, where family-owned regional providers are increasingly being folded into larger platforms that can offer national account support alongside local service relationships.

    Terms of the transaction were not disclosed. Black Fire & Security Services’ existing customers and technicians are expected to remain in place to support continuity of service as the integration proceeds.

  • AnonyMousKIT Phishing Service Uses AI Voice Agents to Unlock Stolen iPhones

    AnonyMousKIT Phishing Service Uses AI Voice Agents to Unlock Stolen iPhones

    A phishing-as-a-service platform called AnonyMousKIT, active since early 2024, automates the process of retrieving Activation Lock unlock codes from stolen iPhones by using AI voice agents to impersonate Apple support staff, according to research from SOCRadar reported by BleepingComputer.

    How the Scheme Works

    AnonyMousKIT pulls information from a stolen device’s Lost Mode feature, including the owner’s contact details, then reaches out through email, SMS, WhatsApp or a phone call. The messages impersonate Apple and claim the missing device has been located, citing the correct model and IMEI details to make the outreach appear legitimate. When a victim engages by phone, a commercial voice AI agent built on the VAPI.ai platform takes over the call, running under a persona — researchers identified one named “Alice from Apple Support” speaking Portuguese — that asks the victim to confirm ownership by dictating their four- or six-digit device passcode before directing them to a fake Find My or Apple login page.

    SOCRadar found the operation connected to 506 domains and 168 reseller storefronts, and recovered logs of roughly 200 calls made between August 2025 and May 2026 across 55 interaction transcripts, with call volume concentrated mostly in Brazil alongside activity in South Africa, Indonesia, Italy, India and Kenya. Each AI-driven call reportedly costs the operators only about $0.10.

    The Stakes Extend Beyond a Single Stolen Phone

    Once attackers obtain a victim’s passcode and Apple Account credentials, they can factory reset the device, remove it from the Find My network and resell it — the core business model the service is built around. But SOCRadar warns the exposure runs deeper than device resale: a compromised Apple ID can expose iCloud backups, Keychain-stored passwords, work email and other corporate data synced to the device, particularly on employer-issued phones enrolled in bring-your-own-device or corporate mobility programs.

    The case adds to a growing pattern of cybercrime platforms integrating conversational AI to scale social-engineering operations that previously required human callers, following the earlier emergence of AI-driven voice phishing platforms such as ATHR, reported by Abnormal Security. For security teams, it underscores that mobile device management and lost-device response procedures now need to account for AI-generated voice impersonation as a credible, low-cost attack vector rather than a theoretical one.

  • Independent Analysts Rank Genetec the Global Leader in Video Management Software for Another Year

    Independent Analysts Rank Genetec the Global Leader in Video Management Software for Another Year

    Genetec has once again been named the world’s leading vendor of video management software, according to separate market analyses published this week by Omdia and Novaira Insights. Both research firms found that the Montreal-based physical security software company grew its market share in 2025, extending a leadership position it has held for several years running.

    Two Independent Rankings, One Conclusion

    Omdia’s Video Surveillance and Analytics Spotlight Service and Novaira Insights’ 2026 World Market for Video Surveillance Hardware and Software both placed Genetec first globally in VMS revenue. Novaira Insights additionally ranked the company number one worldwide in total video surveillance software and service agreements, excluding China, and credited it with the number one spot in the Americas for the fifteenth consecutive year. The research also found Genetec posted the largest share growth among the top ten vendors in EMEA and holds a top-three position in Asia Pacific outside China.

    “Growth in this market is not evenly distributed,” said Paul Bremner, practice leader for physical security at Omdia, in comments accompanying the report. “Buyers are consolidating around vendors that can deliver cloud, on-premises, and hybrid from a single open platform, and those vendors are taking share from ones that cannot.”

    Why the Category Keeps Consolidating

    Both analyst firms point to the same underlying dynamic reshaping the video management software market: enterprise and public-sector buyers are increasingly unwilling to run separate systems for cloud-hosted and on-premises cameras, and are instead favoring vendors whose platforms can span both deployment models without forcing a migration. Genetec has positioned its Security Center platform around that hybrid architecture for several release cycles, and the new rankings suggest the strategy is translating into measurable share gains rather than just marketing positioning.

    The video surveillance software and hardware market remains one of the larger and more competitive segments within physical security, spanning everything from small retail deployments to citywide public-safety camera networks. Independent share data from firms like Omdia and Novaira Insights is closely watched by integrators and end users evaluating long-term platform commitments, since VMS selection typically locks organizations into a vendor relationship spanning camera hardware, storage infrastructure and access control integrations for years.

    Neither report disclosed specific revenue figures for individual competitors, and Genetec did not release exact dollar-share numbers in its announcement of the findings.

  • O.W.L. Launches Extended-Range GA7360LR 3D Radar for Perimeter and Counter-Drone Surveillance

    O.W.L. Launches Extended-Range GA7360LR 3D Radar for Perimeter and Counter-Drone Surveillance

    Observation Without Limits (O.W.L.) has launched the GA7360LR, a 3D, 360-degree radar system built for ground surveillance and low-altitude airspace monitoring, extending the detection range and classification accuracy of the company’s original GA7360 model first introduced in 2024.

    What the New Radar Adds

    According to O.W.L., the GA7360LR is a solid-state system with no moving parts, backed by a full warranty, and operates using pulsed Doppler processing in the S frequency band between 3.0 and 3.3 GHz. The company lists detection ranges of 7.5 kilometers for aircraft the size of a Cessna 172 and for vehicles, 4 kilometers for a walking person, and 3 kilometers for a small consumer drone such as a DJI Phantom IV. The unit is rated to operate across a wide temperature range, from -20°C to 60°C, making it suitable for outdoor perimeter deployments in varied climates.

    “Building on the success of the original GA7360 radar model introduced in 2024, the GA7360LR extends detection ranges, improves accuracy and consistency of target tracking and enhances the accuracy and reliability of target classification in a single 360-degree radar,” O.W.L. CEO Adam Robinett said in the company’s announcement.

    Applications Span Perimeter Defense and Counter-UAS

    O.W.L. positions the GA7360LR for a broad set of ground and airspace situational-awareness use cases, including counter-UAS systems both with and without electronic or kinetic countermeasures, drone-as-first-responder programs, bird-detection systems for airports and wind farms, and beyond-visual-line-of-sight operations. The single-radar design that covers both ground-level intrusion detection and low-altitude drone tracking reflects a broader trend in the perimeter security market, where facility operators are increasingly looking to consolidate what used to be separate ground radar and counter-drone radar systems into one sensor.

    The GA7360LR is now available, according to the company, and can be integrated into existing command-and-control and video management platforms as an additional detection layer alongside cameras and other perimeter sensors.