We’re Tracking the Future of Security

Category: News

Current, event-driven reporting, announcements and industry developments.

  • UK Expands Passkey Sign-In for GOV.UK One Login

    UK Expands Passkey Sign-In for GOV.UK One Login

    The UK government is broadening passkey sign-in for GOV.UK One Login, allowing users to authenticate with a device biometric or local passcode instead of entering a password and a separate security code. The option follows a trial and remains an alternative rather than the only sign-in route.

    Biometric Update reported that more than 300,000 users adopted passkeys during the trial. GOV.UK guidance explains that the biometric template used to unlock a credential stays with the user’s device or credential manager and is not sent to One Login.

    A passkey is distinct from the identity-checking process that may compare a selfie with an identity document. It authenticates possession of a cryptographic credential after an account has been established; it does not independently prove the civil identity behind that account.

    Why it matters

    Public-sector passkey deployments can reduce phishing exposure, but recovery and fallback paths remain part of the security boundary. A strong credential can be undermined if enrollment, account recovery or help-desk processes allow weaker impersonation routes.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • Cisco Secure Email Gateway Zero-Day Added to CISA Exploited Vulnerabilities Catalog

    Cisco Secure Email Gateway Zero-Day Added to CISA Exploited Vulnerabilities Catalog

    Cisco has disclosed CVE-2026-76461, a vulnerability affecting Secure Email Gateway and Secure Email and Web Manager software that can allow an unauthenticated attacker to execute commands with root privileges under vulnerable conditions. Cisco’s advisory provides the affected-version and remediation details.

    The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on September 14, confirming evidence of exploitation in the wild. That designation does not identify every victim or attacker, but it materially changes patch priority.

    Email gateways are high-value perimeter systems because they inspect untrusted content and often hold privileged network positions. Defenders should follow Cisco’s exact guidance, review appliance logs and avoid relying on exposure assumptions that have not been tested.

    Why it matters

    An exploited edge-device vulnerability can bypass controls deeper inside the network. Asset owners need authoritative version checks, rapid remediation and post-compromise review, because installing a fix does not by itself remove persistence created before patching.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • Compromised HBO Max Reddit Account Used in ClickFix Malware Campaign

    Compromised HBO Max Reddit Account Used in ClickFix Malware Campaign

    Researchers at ADAMnetworks and Hudson Rock have reported that a compromised Reddit account associated with HBO Max was used to distribute promoted posts leading to a ClickFix-style infection path. SecurityWeek published an independent summary of the findings on September 15.

    ClickFix campaigns rely on social engineering: victims are shown instructions that persuade them to copy or run commands presented as a repair or verification step. The technique abuses the user’s own trusted tools rather than depending only on a silent browser exploit.

    The incident also demonstrates the distribution power of a verified or recognizable brand account. When an attacker gains access to a marketing channel, paid promotion and brand familiarity can amplify malicious content before platform or account owners detect it.

    Why it matters

    Organizations need to protect social-media and advertising accounts with the same identity controls used for other business systems. Monitoring should include unexpected campaign creation, changed recovery settings and anomalous administrator sessions, not only public posts.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • Microsoft Publishes AI Code of Conduct for Cybersecurity Operations

    Microsoft Publishes AI Code of Conduct for Cybersecurity Operations

    Microsoft has published a Humanist AI Code of Conduct that addresses how advanced AI systems should be governed when used for cybersecurity. The document draws a line between defensive research and operational attack capability and emphasizes a clear chain of human responsibility.

    The code frames authorization, proportionality and escalation as design requirements rather than optional policy language. It also describes constraints intended to prevent autonomous systems from moving from analysis into harmful action without accountable decision-making.

    SecurityWeek’s coverage highlights the significance of the document for AI-enabled cyber operations. The code is a Microsoft policy position, not a statute or independent technical certification, and organizations adopting similar principles still need enforceable controls, logging and review.

    Why it matters

    AI systems can compress the time between discovery and action. Governance therefore has to be translated into identity controls, scoped permissions, audit trails and reliable stop conditions; a written code alone cannot provide those technical safeguards.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • Apple Releases iOS 27 and macOS 27 Security Updates Covering 200 Flaws

    Apple Releases iOS 27 and macOS 27 Security Updates Covering 200 Flaws

    Apple has published security notes for iOS 27, iPadOS 27 and macOS Golden Gate 27, documenting fixes across the kernel, WebKit and multiple system components. SecurityWeek’s review counted roughly 200 vulnerability entries across the releases.

    The issues span memory corruption, privilege escalation, information exposure and application or system termination. Counts across Apple bulletins can overlap because a vulnerability may affect more than one platform, so the figure should be read as the scale of the release set rather than 200 wholly separate attack paths on every device.

    Apple’s security-release page is the authoritative place to check which operating-system version addresses a specific CVE. Administrators should use that device-specific information instead of assuming every fix applies identically to all supported hardware.

    Why it matters

    Large coordinated update sets create an asset-management problem as much as a patching problem. Security teams need accurate device inventories, supported-version visibility and staged deployment plans that reduce exposure without interrupting critical mobile workflows.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • Japan Digital Agency Says VPN Exploit Exposed Data on About 240,000 People

    Japan Digital Agency Says VPN Exploit Exposed Data on About 240,000 People

    Japan’s Digital Agency has disclosed that a vulnerability in a virtual private network product was exploited to access data connected with approximately 240,000 people. The agency published an official notice and a separate public FAQ describing the incident and response.

    The affected information was held in systems supporting government digital services. Public statements attribute the initial access to the VPN vulnerability; they do not justify broader claims about compromise of every agency platform or identity record.

    The agency’s response illustrates the risk created when a remote-access gateway becomes an entry point to higher-value data. VPN appliances concentrate authentication and network reach, so vulnerability management and segmentation around them are core controls rather than routine maintenance tasks.

    Why it matters

    Government identity and service platforms depend on public trust. Clear scope statements, affected-person notification and evidence about the initial access path help distinguish a bounded breach from speculation about an entire national digital infrastructure.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • Researchers Detail Fortinet-Based Intrusion at Thai Broadband Provider

    Researchers Detail Fortinet-Based Intrusion at Thai Broadband Provider

    Threat-intelligence researchers at Hunt.io have documented an intrusion affecting a Thai broadband provider in which attackers targeted a FortiGate SSL VPN and later deployed the MeshCentral remote-management platform. SecurityWeek independently summarized the research on September 15.

    The observed infrastructure hosted reconnaissance scripts, vulnerability probes, brute-force utilities and privilege-escalation tools. Hunt.io’s account links the activity to exploitation of a Fortinet flaw, but attribution to a named threat group was not established in the public reporting.

    Remote-management software can have legitimate administrative uses, which makes context essential. In this case, its placement alongside offensive tooling and the intrusion path made it part of the incident evidence rather than proof that the software itself was malicious.

    Why it matters

    Broadband providers sit at the intersection of public communications and critical infrastructure. Internet-facing security appliances require rapid patching, while remote-administration activity needs monitoring that can distinguish expected maintenance from unauthorized persistence.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • CenterPoint Energy Confirms Customer Data Breach; Utility Services Unaffected

    CenterPoint Energy Confirms Customer Data Breach; Utility Services Unaffected

    Houston-based utility CenterPoint Energy has told regulators that an unauthorized third party obtained personal information relating to some customers through an external-facing system. The company opened an investigation after becoming aware of a claim that customer data had been obtained.

    In its filing with the U.S. Securities and Exchange Commission, CenterPoint said the incident had not affected delivery of electric or natural-gas services and that it did not expect a material effect on the company. The filing did not validate a hacker’s separate claim about the number of records involved.

    SecurityWeek reported that a threat actor had advertised an archive allegedly containing CenterPoint data. That claim remains unverified, so the confirmed facts are narrower: customer information was accessed, an investigation is underway, and operational utility delivery continued.

    Why it matters

    The separation between customer-facing systems and operational service delivery is important for critical infrastructure. A breach can create serious privacy and fraud exposure even when operational technology remains available, and incident reporting should keep those impacts distinct.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • Vercel Sandbox Challenge Finds Linux Kernel Flaws Without Customer Data Exposure

    Vercel Sandbox Challenge Finds Linux Kernel Flaws Without Customer Data Exposure

    Vercel’s focused sandbox security challenge generated 1,285 submissions during a two-week testing window that ran from August 18 to September 1. According to results reported by SecurityWeek, the company had validated one critical, seven high, 15 medium and 49 low-severity findings while triage continued.

    The most consequential report combined two Linux networking-stack defects: one could expose host-kernel memory and another could crash the host. Technical details remain private while fixes are reviewed and CVE identifiers are pending. Vercel said none of the submissions demonstrated access to real customer data.

    The volume also changed the triage process. Vercel moved from a separate human-reviewed chat for each report to an agent-assisted workflow that checks policy, searches for duplicates and runs proofs of concept in a sandbox. The company says it plans to open-source that triage tooling.

    Why it matters

    The exercise shows how AI-assisted vulnerability research can increase both useful findings and operational noise. Providers running untrusted code need isolation controls, but they also need evidence-driven triage that can keep pace without treating every automated report as a confirmed escape.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • Synology Launches ActiveProtect Manager 2.0 With Cross-Platform Recovery and Volume-Level Encryption

    Synology Launches ActiveProtect Manager 2.0 With Cross-Platform Recovery and Volume-Level Encryption

    Synology has launched ActiveProtect Manager 2.0 (APM 2.0), the latest software update for its ActiveProtect data protection appliances, adding expanded platform coverage, cross-platform recovery, and volume-level encryption for backup data at rest.

    APM 2.0 extends backup and recovery protection to Amazon EC2, Azure VM, Proxmox VE, Nutanix AHV, and Google Workspace, broadening the appliance’s reach beyond its existing coverage. Cross-platform recovery lets administrators back up a workload in one environment and restore it in another, which Synology says supports both disaster recovery and workload migration between on-premises and cloud infrastructure without re-architecting backup jobs.

    The release also adds software-based storage encryption at the volume level, so backup data and system configurations remain unreadable in the event of drive theft or hardware loss. Synology said future ActiveProtect updates will add AI-driven threat mitigation on top of the platform coverage introduced in this release.

    “Managing fragmented backup infrastructure drives up costs and slows recovery,” said Jia-Yu Liu, Executive Vice President of Synology’s Data Protection Group. “The ActiveProtect appliance unites purpose-built storage with powerful data management software into a single, predictable investment. APM 2.0 builds on that value, enabling organizations to safeguard their entire hybrid infrastructure through one centralized, scalable solution.”

    The update lands as enterprises increasingly run workloads across a mix of on-premises hypervisors, public cloud IaaS, and SaaS platforms, a fragmentation that has made unified backup and recovery tooling a growing purchasing priority for IT and security teams alike.

    Sources: Synology (official press release), Business Wire.