We’re Tracking the Future of Security

Category: News

Current, event-driven reporting, announcements and industry developments.

  • Tencent Brings Palmprint Verification to Standard Smartphone Cameras

    Tencent Brings Palmprint Verification to Standard Smartphone Cameras

    Tencent has introduced Palm X, a palmprint-verification capability designed to work with standard RGB cameras in smartphones and computers. The service analyzes visible surface patterns rather than relying on dedicated infrared illumination or palm-vein sensors.

    Software expands where palm recognition can be deployed

    Tencent says Palm X can support one-to-one verification and one-to-many searches through mobile software development kits and backend APIs. Removing specialized capture hardware may reduce deployment friction for applications that already have a suitable camera, but performance still depends on image quality and controlled capture.

    Visible palmprints are different from subsurface vascular patterns. Integrators should not treat the two modalities as interchangeable or transfer accuracy claims between them. Camera resolution, hand position, illumination, motion and background can influence whether a usable sample is obtained.

    Operational assurance remains essential

    Organizations should test presentation-attack resistance, enrollment quality, duplicate handling and behavior across representative devices. A consumer camera introduces more variation than a fixed reader, so device compatibility and minimum capture requirements need explicit acceptance criteria.

    The launch broadens the options discussed in SectechMedia’s Access Control & Identity coverage. Deployment governance should define consent, template protection, retention, fallback authentication and investigation procedures. The absence of dedicated hardware can simplify rollout, but it does not remove the need to validate the complete identity workflow.

    Sources

  • Revolut Pilots Face-Biometric Payments on New Retail POS Platform

    Revolut Pilots Face-Biometric Payments on New Retail POS Platform

    Revolut is piloting a face-authenticated payment service called Pay with Smile alongside a new point-of-sale platform aimed at UK hospitality businesses. The initial deployment is being tested at Kiss the Hippo cafes, according to reporting on the launch.

    Enrollment connects identity with a payment method

    The service is intended to let a registered customer authorize an in-store transaction by presenting their face at checkout. A practical deployment must bind the biometric enrollment to the correct customer and payment account, then confirm liveness and transaction intent at the point of use.

    Biometric convenience does not remove the need for fallback and dispute handling. Merchants and payment providers need a clear process for failed matches, changed appearance, shared accounts and customers who do not want to use the biometric option. Enrollment consent and template protection are also central to the risk model.

    Retail performance must be measured in context

    Lighting, camera position, customer movement and queue pressure can affect capture quality. Pilot evidence should therefore cover false acceptance, false rejection, transaction time, manual overrides and accessibility rather than relying only on successful demonstrations.

    The launch brings payment authentication into the wider Access Control & Identity discussion. Organizations considering similar systems should separate biometric matching from authorization policy, protect reference data, define retention limits and retain enough transaction evidence to investigate a disputed payment without exposing unnecessary biometric information.

    Sources

  • EU Sets Digital ID Rules for Cross-Border Health Data Exchange

    EU Sets Digital ID Rules for Cross-Border Health Data Exchange

    The European Union has adopted implementing rules for identity, authentication and interoperability in cross-border electronic health-data exchange. Commission Implementing Regulation (EU) 2026/2099 establishes technical and organizational requirements intended to support trusted access across national systems.

    Identity assurance becomes part of the exchange architecture

    Cross-border health services must determine who is requesting or providing data, which role the person holds and whether the relying system can trust the asserted identity. The regulation connects those checks with common interoperability and security requirements rather than treating authentication as an isolated login feature.

    The rules sit within the European Health Data Space framework and are designed to support consistent exchange while national identity and healthcare infrastructures remain different. Implementers must therefore map local credentials and professional roles into a shared trust model without weakening national safeguards.

    Deployment requires governance beyond technical connectivity

    Operators should document identity proofing, credential lifecycle, role assignment, consent and audit responsibilities across organizational boundaries. A successful connection does not by itself prove that the correct person received the correct level of access. Exception handling and revocation must work across the same chain.

    The regulation is relevant to broader Access Control & Identity programs because it demonstrates how identity assurance, authorization and interoperability meet in a regulated environment. Health-data exchange teams should test both normal and degraded workflows, preserve decision records and verify how trust changes when a credential or professional role expires.

    Sources

  • PamStealer macOS Malware Adds Live Decryption and Multi-Layer Persistence

    PamStealer macOS Malware Adds Live Decryption and Multi-Layer Persistence

    Jamf Threat Labs has documented a new PamStealer macOS campaign that changes how the main payload is recovered and persisted. The operation uses a bogus cryptocurrency-wallet site and an AppleScript-based lure, while payload decryption depends on communication with attacker-controlled infrastructure.

    Server-assisted decryption limits static recovery

    Earlier variants embedded more of the decryption material in the initial script. Jamf reported that the newer Wavel-themed chain downloads a purpose-built utility and completes a key exchange before the payload can be unpacked. Without the server’s cooperation, analysts cannot recover the final component from the first-stage file alone.

    The victim is directed to open a disk image and run an AppleScript through Script Editor. A JavaScript for Automation carrier then hands execution to a shell process. The campaign relies on user action and abuse of trusted operating-system tools rather than a single remote exploitation step.

    Persistence and credential exposure widen the impact

    The reported chain installs multiple persistence mechanisms and seeks browser, wallet and account information. Defenders should preserve the initial lure, process tree, downloaded utilities and network destinations because any one layer may disappear after infrastructure changes.

    Endpoint monitoring should flag unusual Script Editor-to-shell execution, new launch items and unsigned utilities retrieved from recently registered infrastructure. These controls complement the identity and endpoint concerns covered under Cyber-Physical Security. Users should install software only from verified vendor channels and avoid executing scripts presented by download pages.

    Sources

  • Compromised GitHub Actions Resume Mini Shai-Hulud Malware Execution

    Compromised GitHub Actions Resume Mini Shai-Hulud Malware Execution

    Two GitHub Actions previously compromised during the Mini Shai-Hulud campaign became accessible again in September while release tags still pointed to malicious content, according to research from Socket. GitHub has since disabled the affected repositories again.

    Availability reactivated an existing dependency risk

    The affected actions, actions-cool/issues-helper and actions-cool/maintain-one-comment, had been disabled after malicious code was introduced in May. Socket reported that the repositories returned on September 16 without the compromised release tags being cleaned. Workflows referencing those mutable tags could therefore download and execute the old payload even though no new malicious version was published.

    The payload was associated with credential theft from CI/CD environments. The event illustrates why containment cannot rely only on making a repository unavailable: tags, releases and downstream references must also be reviewed before access is restored.

    Consumers need immutable references and recovery checks

    Development teams should locate references to the affected actions, rotate exposed secrets and inspect workflow history after the repositories reappeared. Pinning third-party actions to reviewed commit hashes reduces dependence on mutable upstream tags, although the selected commit still needs security review.

    The incident extends the risk described in SectechMedia’s Cyber-Physical Security coverage. Organizations should inventory external workflow components, monitor ownership and availability changes, and treat repository restoration as a security-sensitive event rather than a purely operational one.

    Sources

  • Croatia Considers mGrađani Digital Identity for Online Age Verification

    Croatia Considers mGrađani Digital Identity for Online Age Verification

    Croatia is considering its mGrađani digital identity application as a tool for electronic age verification while European institutions develop new online child-protection rules. The government says the application already supports a privacy-preserving way to confirm that a user is over 18.

    Age proof without full identity disclosure

    The Croatian Ministry of Justice, Public Administration and Digital Transformation said more than 204,000 citizens use mGrađani. Its age-verification function is designed to provide an eligibility result rather than disclose a person’s full identity record to an online service. That distinction can reduce unnecessary data exposure when a service only needs proof of age.

    The proposal is being discussed as Croatia prepares its position on the emerging EU KIDS Act framework. The final European rules and the technical role of national identity applications are still developing, so the announcement should not be read as a completed mandatory deployment.

    Implementation questions remain

    Age-verification systems need clear legal purpose, data-minimization controls, accessible alternatives and testing against exclusion or circumvention. Operators also need assurance that relying services cannot silently expand the information requested beyond the age claim. SectechMedia follows related identity architecture in its access control and identity channel.

    Sources

  • Bitget Reports $351.6 Million Theft After Wallet Backend Compromise

    Bitget Reports $351.6 Million Theft After Wallet Backend Compromise

    Cryptocurrency exchange Bitget says attackers stole $351.6 million from a limited set of hot and warm wallets after compromising a critical backend system in its wallet infrastructure. The company detected unauthorized transfers on September 24 and temporarily suspended withdrawals while it investigated.

    What Bitget has disclosed

    Bitget said its cold wallets and most platform assets were not affected, and that customer account balances remained recorded correctly. According to the company, the attacker manipulated transaction data and triggered the authorization process to move funds. Bitget engaged Mandiant and SlowMist for outside investigation and contacted affected blockchain foundations about freezing addresses.

    The company attributed the activity pattern to suspected North Korean actors, but that attribution remains an assessment rather than an independently confirmed finding. The intrusion method also remains under investigation. Reporting should therefore separate confirmed unauthorized transfers and the disclosed backend compromise from still-developing attribution details.

    Security implications

    The incident highlights the need to isolate signing systems, require independent transaction verification, limit hot-wallet balances and test controls against compromised backend data. Exchanges also need rehearsed withdrawal suspension, chain-monitoring and customer-communication procedures. SectechMedia tracks connected risks in its cyber-physical security channel.

    Sources

  • CISA Adds Exploited WSO2 and Adobe Commerce Flaws to KEV Catalog

    CISA Adds Exploited WSO2 and Adobe Commerce Flaws to KEV Catalog

    The U.S. Cybersecurity and Infrastructure Security Agency has added two enterprise-software vulnerabilities to its Known Exploited Vulnerabilities catalog. The additions cover CVE-2026-5430 in WSO2 products and CVE-2026-71362 in Adobe Commerce and Magento.

    Two different attack paths

    The WSO2 issue is a path-traversal weakness that can enable unrestricted file upload and potentially remote code execution in affected API-management components. Security researchers reported exploitation attempts before the catalog update. The Adobe Commerce issue is an authorization flaw that can allow an attacker to reach another customer’s account context and sensitive information under vulnerable conditions.

    KEV inclusion means CISA has evidence that the vulnerabilities are being exploited, not merely that public proof-of-concept material exists. Federal civilian agencies received a remediation deadline, while private organizations can use the catalog as a prioritization signal alongside asset exposure, business impact and compensating controls.

    Prioritization for defenders

    Teams should inventory affected WSO2, Adobe Commerce and Magento deployments, compare versions against vendor advisories, apply fixes, and inspect logs for file-upload anomalies, forged tokens or unusual account switching. Internet-facing systems and identity-connected APIs deserve immediate attention. SectechMedia follows similar operational risk in its cyber-physical security channel.

    Sources

  • Cloudflare Fixes Cross-Tenant Disk Data Exposure in Container Platform

    Cloudflare Fixes Cross-Tenant Disk Data Exposure in Container Platform

    Cloudflare has disclosed and fixed a cross-tenant data exposure issue affecting its Containers and Sandboxes products. The flaw involved storage reuse: a newly provisioned workload could receive disk blocks that still contained residual data from a previous customer.

    How the isolation failure occurred

    Researchers at Accomplish demonstrated that discarded thin-provisioned storage was not reliably cleared before reuse. That created a path for one tenant to inspect fragments left by another. Cloudflare said the affected products were in beta and reported no evidence that the issue had been exploited maliciously.

    The company disabled the relevant storage behavior, introduced sanitization controls and reviewed the platform after receiving the report. Cloudflare’s account and the researchers’ technical write-up agree on the core risk, although they describe some affected service details differently. The incident illustrates that workload isolation depends on storage lifecycle controls as well as compute and network boundaries.

    Lessons for multi-tenant platforms

    Operators should include block-device reuse, snapshot handling and deprovisioning in tenant-isolation tests. Encryption, secure erase procedures and monitoring for unexpected reads can add defense in depth, but each control must be verified against the actual storage architecture. Customers should also avoid treating beta isolation guarantees as equivalent to mature production assurance. Related coverage appears in SectechMedia’s cyber-physical security channel.

    Sources

  • Roundcube Pre-Authentication SQL Injection Is Under Active Exploitation

    Roundcube Pre-Authentication SQL Injection Is Under Active Exploitation

    Canada’s Cyber Centre has warned that attackers are actively exploiting a patched Roundcube Webmail vulnerability. Tracked as CVE-2026-48842, the flaw affects the virtuser_query plugin and can permit SQL injection before a user authenticates.

    What the advisory confirms

    Roundcube released fixes in versions 1.6.16 and 1.7.1 on May 24. The project described the issue as a security defect involving query handling, while the Canadian advisory now adds evidence of exploitation in the wild. The available notices do not disclose a detailed campaign profile, so attribution and victim counts remain unconfirmed.

    The risk depends on whether the vulnerable plugin is enabled and how the database is configured. Successful injection could expose information held by the webmail backend, including data that may support further account compromise. Internet-facing email systems are especially sensitive because they combine identity, communications and recovery workflows.

    Immediate defensive actions

    Administrators should identify Roundcube versions and enabled plugins, upgrade to a fixed release, review web and database logs for unusual query patterns, and rotate affected credentials if compromise is suspected. Restricting unnecessary public exposure and applying least privilege to the database account can reduce impact. SectechMedia covers connected defensive controls in its cyber-physical security channel.

    Sources