We’re Tracking the Future of Security

Category: News

Current, event-driven reporting, announcements and industry developments.

  • HKCERT Warns VPNs, Firewalls and Remote Access Devices Face Rising Attacks

    HKCERT Warns VPNs, Firewalls and Remote Access Devices Face Rising Attacks

    Hong Kong’s computer emergency response team is warning organizations that VPN appliances, firewalls, routers and remote-access systems remain high-value entry points for attackers. The guidance, issued on 15 September and reported by Industrial Cyber, stresses that installing a patch does not prove an already-exposed device is clean.

    Why patching may be only the first step

    An attacker can exploit an edge device before remediation, steal credentials, create an account or establish another persistence mechanism. Closing the original vulnerability does not automatically remove those access paths. HKCERT therefore recommends reviewing accounts, active sessions, privilege changes, logs and suspicious data transfers after patching, particularly when a vulnerability is known to have been exploited.

    The issue matters in industrial environments because remote-access systems often bridge corporate and operational networks. An edge compromise can expose credentials or routes that would otherwise remain unavailable from the public internet. Asset owners need an accurate inventory of external interfaces, including systems installed by contractors or retained after projects end.

    Operational response

    Defenders should prioritize exploited vulnerabilities, enforce multifactor authentication, revoke suspect sessions and investigate for unauthorized accounts or backdoors. Monitoring should continue after the immediate incident. These measures fit a broader cyber-physical security program that treats identity, network architecture and recovery planning as connected controls.

    Sources

  • Google Says Gemini Security Test Reached Three Companies’ Systems

    Google Says Gemini Security Test Reached Three Companies’ Systems

    Google has disclosed that a security assessment involving Gemini reached systems belonging to three companies after test infrastructure was associated with domains the researchers did not actually control. The event was part of an authorized evaluation, but it demonstrates how autonomous or highly assisted testing can move beyond its intended boundary when scope assumptions are wrong.

    A scoping failure, not an AI permission model

    Reporting by The Record and The Hacker News says the test environment treated certain domains as controlled assets. Gemini then followed the available paths and interacted with external systems. Google said it contained the activity and contacted affected organizations. The episode is a reminder that a model can obey its task while still producing an unsafe result if inventory and ownership data are inaccurate.

    Traditional penetration tests already require written scope, target validation and stop conditions. Agentic tooling increases the need for those controls because it can enumerate and act faster than a human tester. Domain ownership should be verified immediately before execution, and high-impact actions should require an independent approval step.

    Lessons for production AI

    Security teams should place agentic test systems inside constrained networks, maintain explicit allowlists and log every action. A kill switch is useful only if operators can see that a boundary has been crossed. The incident also reinforces the value of separating simulation from live infrastructure when evaluating emerging security technologies.

    Sources

  • TASK#STOMP Backdoor Steals Wi-Fi Credentials, Screenshots and Business Files

    TASK#STOMP Backdoor Steals Wi-Fi Credentials, Screenshots and Business Files

    Security researchers have described a Windows backdoor tracked as TASK#STOMP that uses PowerShell to collect sensitive information from compromised computers. Reported capabilities include stealing stored Wi-Fi credentials, capturing screenshots and clipboard data, and searching for business documents that may be useful for espionage or follow-on intrusion.

    Living-off-the-land tradecraft

    According to Securonix research summarized by Help Net Security, the operation relies heavily on native Windows components and scripted execution. That approach can reduce the number of obvious malicious binaries placed on disk. The backdoor also uses scheduled-task behavior for persistence, giving defenders a reason to examine task creation and modification alongside PowerShell logging.

    The collection profile is notable because it combines access information with operational context. Wi-Fi credentials can help an attacker understand trusted networks, while screenshots and clipboard captures may reveal session tokens, internal tools or information that users never intended to save as files. Document discovery then broadens the impact beyond the initially compromised endpoint.

    Defensive implications

    Organizations should monitor suspicious PowerShell ancestry, encoded or unusual command lines, new scheduled tasks and unexpected access to credential stores. Endpoint telemetry should be correlated with identity and network events rather than reviewed in isolation. This is especially important where office networks connect to cyber-physical systems, because stolen administrative credentials can create a path toward operational environments.

    Sources

  • Sentry AI Deploys 100th Solar-Powered Mobile Security Unit

    Sentry AI Deploys 100th Solar-Powered Mobile Security Unit

    Sentry AI has deployed its 100th SolarGuard mobile security unit, marking a scale milestone for a model that combines solar-powered field hardware, cloud video analytics and remote human review. The trailers are designed for construction sites and other temporary locations where wired power, fixed connectivity and permanent camera infrastructure may be unavailable.

    Mobile monitoring for changing sites

    Security Today reported that alerts are reviewed by remote personnel against each site’s response plan. Depending on the event, the operator can dismiss harmless activity, issue a voice warning or escalate to site contacts or law enforcement. The architecture illustrates why analytics alone do not constitute a complete response: a useful deployment also needs verification, communications and documented escalation rules.

    Construction security presents unusual design constraints. Perimeters move, materials create new blind spots, and lighting or network conditions can change as work progresses. A trailer that was correctly positioned one week may require relocation after the next phase of construction. Solar generation and battery condition also need routine inspection rather than being assumed to remain adequate throughout a project.

    Operational lessons

    The milestone reflects broader demand for relocatable surveillance, but buyers should assess coverage, communications resilience, privacy zones and alarm-handling capacity. Mobile units are best treated as part of an intrusion and perimeter security plan with scheduled field verification, not as unattended appliances.

    Sources

  • Hong Kong and Singapore Expand Facial Recognition for In-Vehicle Border Clearance

    Hong Kong and Singapore Expand Facial Recognition for In-Vehicle Border Clearance

    Hong Kong and Singapore are expanding the use of facial recognition for border checks that can be completed while travelers remain inside their vehicles. The initiatives are intended to shorten processing at high-volume land crossings while retaining identity checks that are normally performed at a staffed booth.

    How the approach changes border processing

    Biometric Update reported that Hong Kong is preparing in-car clearance at the Hong Kong–Zhuhai–Macao Bridge and examining related arrangements at the new Huanggang Port. Singapore has also been extending automated immigration clearance, including vehicle-lane processes. The common design objective is to link a traveler’s face with an authorized travel record without requiring every occupant to leave the vehicle.

    Such systems depend on controlled capture conditions, reliable document and watchlist integration, and clear procedures for exceptions. A failed match must route the traveler to a secondary process rather than be treated automatically as evidence of wrongdoing. Operators also need controls for children, passengers whose appearance has changed, poor lighting and partial occlusion inside a vehicle.

    Security and governance questions

    In-vehicle biometrics can improve throughput, but border agencies still have to manage retention, access logging and false-match risk. The technology should be evaluated as one layer within a broader access-control and identity architecture, not as a substitute for trained officers. Independent performance testing and transparent fallback procedures will be important as deployment expands.

    Sources

  • Honeywell Modernizes Access Management Across U.S. Marine Corps Barracks

    Honeywell Modernizes Access Management Across U.S. Marine Corps Barracks

    Honeywell Technologies has announced a modernized access-management program for U.S. Marine Corps barracks worldwide. The deployment is intended to replace fragmented mechanical-key and local access processes with connected electronic controls and centralized management.

    The program is designed to give authorized personnel a consistent way to issue, revoke and audit access across geographically distributed facilities. A centralized model can reduce the delay between a change in authorization and enforcement at the door, while producing records that support investigations and compliance reviews.

    Neither the company announcement nor secondary reporting provides a complete public architecture, device count or cybersecurity assessment. Those details matter because a global access platform must protect credentials, administrative privileges, network paths and offline operation as carefully as it protects doors. Local emergency procedures must remain workable during network or power disruption, including reliable override, accountability and recovery controls.

    Why it matters

    Barracks access is an identity-lifecycle problem as much as a lock problem. The program highlights the value of centralized governance while reinforcing the need for resilient local operation, auditable credential changes and disciplined key and credential management.

    Sources

  • Arcjet Launches Runtime Security Controls for Production AI Agents

    Arcjet Launches Runtime Security Controls for Production AI Agents

    Arcjet has launched a runtime security product designed to monitor and govern artificial-intelligence agents while they execute production workflows. The service creates an execution record and returns policy decisions before selected protected actions are allowed to continue.

    Developers can use those decisions to block an operation or require human approval. Arcjet says available controls include usage limits, automation detection, prompt-injection screening and measures intended to prevent or redact exposure of personally identifiable and other sensitive information.

    The product addresses a gap between pre-deployment model testing and live operational behavior. An agent may call tools, retrieve data and trigger business processes in combinations that are difficult to predict from static testing alone. Runtime controls can reduce that uncertainty, but their effectiveness depends on how comprehensively protected actions are instrumented and whether bypass paths remain in production environments.

    Why it matters

    AI-agent security increasingly resembles privileged-access and transaction monitoring: high-impact actions need explicit policy, traceable decisions and a reliable human escalation path. The same principle applies when AI is connected to physical-security workflows and command-and-control platforms, where an automated action can have physical consequences.

    Sources

  • Niger Starts National Enrollment for Alliance of Sahel States Biometric Passport

    Niger Starts National Enrollment for Alliance of Sahel States Biometric Passport

    Niger has begun public biometric enrollment for the Alliance of Sahel States passport. The campaign launched on September 15 in Niamey, with the government planning additional enrollment centers across the country and services for citizens abroad.

    Officials also plan to add online pre-enrollment through domestic payment platforms. The ordinary passport is priced at FCFA 45,000, while a reduced price applies to children and students, according to the Niger News Agency and Biometric Update. Authorities say the document is designed to align with International Civil Aviation Organization requirements, although detailed certification evidence was not included in the public announcement.

    Niger follows Burkina Faso and Mali in rolling out the common AES passport. The government is presenting the program as part of a wider modernization of civil registration, identity verification and border processes. Regional expansion will also require dependable enrollment equipment, training and document supply.

    Why it matters

    A biometric passport program is not only a document project. It requires secure enrollment, trusted issuance, protected biometric data, inspection-system interoperability and accessible service delivery. Those operational controls determine whether a new credential improves border and airport security in practice.

    Sources

  • Malaysia Opens Applications for New MyKad With Restricted Biometric QR Verification

    Malaysia Opens Applications for New MyKad With Restricted Biometric QR Verification

    Malaysia has opened applications for a new generation of its MyKad national identity card. The updated credential includes a QR-based verification mechanism and is designed to support live facial matching against National Registration Department records when authorized equipment is used.

    The department has stressed that the QR code is restricted to authorized enforcement use, cannot be read by an ordinary smartphone camera and is not currently intended for payments. That clarification narrows broader claims by supplier NexG about possible future commercial verification and optional wallet functions. Those additional capabilities have not been announced as active government services.

    Reporting by Malay Mail says the card includes 53 security features that will be introduced progressively. The new design removes the Touch ‘n Go function included in the previous card, directing users to a separate card or wallet instead. Enrollment and verification governance will determine how consistently those controls operate.

    Why it matters

    The rollout shows how physical identity documents are becoming gateways to digital verification while still retaining strict control over who may read protected data. Clear separation between deployed functions and supplier roadmaps is essential when evaluating identity and access-control systems.

    Sources

  • Northrop Grumman Advances 50mm Proximity-Fuzed Round for Raid Hunter Air Defense

    Northrop Grumman Advances 50mm Proximity-Fuzed Round for Raid Hunter Air Defense

    Northrop Grumman says it has completed an aeroballistic test of a new 50mm projectile for Raid Hunter, the company’s gun-based air-defense system. The test used an XM913 Chain Gun and generated flight data intended to support development of a guided, proximity-fuzed round.

    The company said the rounds produced high-fidelity data for nearly every shot and broadly matched pre-test predictions. Raid Hunter is being positioned as a short-range option for engaging mixed raids that can include low-cost uncrewed aircraft. Northrop Grumman has not published enough test data for independent assessment of accuracy, engagement envelope or cost effectiveness.

    Proximity fuzing is intended to improve the probability of effect without requiring a direct projectile impact. In a counter-UAS role, however, overall performance also depends on sensor quality, target classification, fire-control integration and the safety constraints surrounding the defended area. Follow-on testing will need to demonstrate the complete engagement chain.

    Why it matters

    Gun-based systems are attracting attention as operators look for repeatable defenses against larger drone salvos. The test is a development milestone, not proof of field performance, and should be assessed as one element in a layered airspace-security architecture.

    Sources