We’re Tracking the Future of Security

Category: News

Current, event-driven reporting, announcements and industry developments.

  • Revolut Confirms Customer Data Breach After Falling for Spoofed Government Requests

    Revolut Confirms Customer Data Breach After Falling for Spoofed Government Requests

    British fintech Revolut confirmed it disclosed sensitive customer data — including birth dates, addresses, phone numbers, and copies of passports and driver’s licenses — to an unauthorized third party, TechCrunch and Reuters reported. The attacker spoofed a legitimate government agency’s email domain, passing SPF, DKIM and DMARC authentication checks, to submit fraudulent information requests that Revolut’s process treated as genuine.

    Revolut said customer funds and core systems were unaffected, and it has notified regulators and law enforcement.

    Why it matters: The breach illustrates a persistent weak point in data-request handling processes: even well-implemented email authentication (SPF/DKIM/DMARC) does not by itself verify that a request is legitimate if an attacker can obtain or spoof a domain that passes those technical checks, meaning verification of the requester’s actual authority remains a human-process problem, not just a technical one.

    Source: TechCrunch and Reuters, September 12, 2026.

  • TSA Details ‘Horizon 25’ Next-Gen Checkpoint Tech: Facial-Comparison E-Gates and 3D Bag Scanners

    TSA Details ‘Horizon 25’ Next-Gen Checkpoint Tech: Facial-Comparison E-Gates and 3D Bag Scanners

    TSA Administrator David Cummins detailed new checkpoint technology being rolled out under the agency’s Horizon 25 strategy, WTOP News reported. The technology includes “E-Gates” using facial-comparison to verify traveler identity, paired with 3D bag scanners that digitally examine the contents of carry-on bags — including items like laptops that currently must be removed — without requiring physical unpacking.

    TSA plans to roll out the configuration across all 400 PreCheck lanes nationwide in the coming months.

    Why it matters: Combining identity verification and 3D scanning at the checkpoint is aimed at simultaneously improving throughput and detection accuracy — two goals that have often traded off against each other in checkpoint design — and represents one of the larger technology refreshes to US aviation screening infrastructure in recent years.

    Source: WTOP News, September 2026, reporting on TSA’s Horizon 25 Strategy.

  • Optus Apologizes After Network Outage Disrupts Emergency Calls Across Three Australian States

    Optus Apologizes After Network Outage Disrupts Emergency Calls Across Three Australian States

    Optus, Australia’s second-largest telecommunications carrier, apologized for a 76-minute technical glitch on September 11 that disrupted voice calling — including some emergency-services calls — across Victoria, South Australia, Tasmania and the Northern Territory, Reuters reported.

    The outage follows a 2025 Optus emergency-calling failure that resulted in two deaths, drawing renewed government scrutiny of telecom resilience as a form of critical infrastructure.

    Why it matters: Repeated emergency-calling failures at a major national carrier underscore why telecom networks are increasingly treated as critical infrastructure in their own right, subject to resilience and redundancy requirements comparable to power and water utilities, rather than purely commercial service-quality standards.

    Source: Reuters, September 12, 2026.

  • Anthropic Says Accounts in Houthi-Held Yemen Used Claude to Pursue Weapons Programs

    Anthropic Says Accounts in Houthi-Held Yemen Used Claude to Pursue Weapons Programs

    Anthropic’s newest threat-intelligence report, covered by the Associated Press and SecurityWeek, says accounts operating from Houthi-controlled northern Yemen used its Claude Code tool to pursue three separate weapons-development programs, including work toward a hypersonic-glide multi-variant missile design. A field test of a guided rocket associated with the effort reportedly failed.

    Anthropic said the accounts involved have been banned and that, per its assessment, no operational weapon was fielded as a result of this activity.

    Why it matters: The disclosure is one of the more concrete public examples yet of state or non-state actors attempting to use general-purpose AI coding tools to accelerate weapons development, and underscores why AI providers’ own threat-intelligence and account-enforcement programs are increasingly functioning as a frontline layer of defense-relevant security — alongside, not instead of, traditional export-control and nonproliferation controls.

    Source: Associated Press via SecurityWeek, September 11, 2026.

  • Celero Communications Raises $275 Million for AI Data Center Networking Chips

    Celero Communications Raises $275 Million for AI Data Center Networking Chips

    Celero Communications raised a $275 million Series C funding round, valuing the company at $3 billion, Crunchbase News reported. Celero develops coherent digital signal processing (DSP) technology designed to move large volumes of data between chips and across data centers with lower power draw than conventional interconnects.

    The company positions its technology as addressing a growing bottleneck in AI infrastructure: as AI compute clusters scale, the power and bandwidth cost of moving data between chips and data center nodes is becoming a limiting factor alongside compute capacity itself.

    Why it matters: As data center operators race to add compute capacity, interconnect and networking efficiency is emerging as an equally important constraint — directly relevant to the power and cooling infrastructure planning that also shapes data center physical security and site design decisions.

    Source: Crunchbase News, September 11, 2026.

  • AI Agents and Machine Identities Are Now a Leading Initial-Access Vector, Report Finds

    AI Agents and Machine Identities Are Now a Leading Initial-Access Vector, Report Finds

    SpyCloud’s 2026 Identity Threat Report, based on a survey of 750 organizations and covered by SecurityInfoWatch, found that non-human identities — AI agents, service accounts, and API keys — were the leading initial-access vector in 31% of identity-related security incidents.

    The report found a significant confidence gap: 95% of surveyed organizations believe they have adequate visibility into their AI agents and non-human identities, but only 36% actually monitor those identities in practice.

    Why it matters: As enterprises deploy AI agents with their own credentials and permissions across more systems, the attack surface represented by non-human identities is growing faster than most organizations’ identity-governance programs, creating a widening gap between perceived and actual security posture — a pattern directly relevant to any critical-infrastructure operator now integrating AI agents into operational workflows.

    Source: SecurityInfoWatch.com, September 11, 2026, citing SpyCloud’s 2026 Identity Threat Report.

  • Defense Manufacturer Mach Industries Raises $600 Million Series C

    Defense Manufacturer Mach Industries Raises $600 Million Series C

    Huntington Beach, California-based defense manufacturer Mach Industries raised a $600 million Series C funding round led by Ribbit Capital and Sequoia, valuing the company at $3.7 billion, Crunchbase News reported. Mach develops unmanned aircraft, long-range weapons systems and propulsion technology.

    The company said the funding will go toward building infrastructure to produce defense systems at scale, part of a broader wave of venture capital flowing into defense-technology manufacturing in 2026.

    Why it matters: The scale of the round — among the largest for a pure defense-hardware manufacturer this year — reflects a broader shift in venture investment toward physical defense manufacturing capacity rather than purely software-based defense-tech, a trend with downstream implications for the unmanned-systems and counter-UAS markets this publication tracks closely.

    Source: Crunchbase News, September 11, 2026.

  • GitLab Critical Path-Traversal Flaw Exploited One Day After Disclosure

    GitLab Critical Path-Traversal Flaw Exploited One Day After Disclosure

    Security firm WatchTowr observed in-the-wild exploitation of CVE-2026-85706, a maximum-severity (CVSS 10) path-traversal vulnerability in GitLab Community and Enterprise Edition, just one day after GitLab released a patch, SecurityWeek reported. The flaw allows unauthenticated attackers to read arbitrary files from an affected server.

    The same GitLab release also patched a second critical vulnerability, CVE-2026-87719, an insecure-deserialization flaw in GitLab’s GraphQL implementation.

    Why it matters: A one-day gap between patch release and confirmed exploitation leaves almost no window for organizations to apply updates before attackers act, underscoring why source-code and DevOps infrastructure — not just perimeter network gear — needs to be included in any organization’s emergency-patching runbook.

    Source: SecurityWeek, September 11, 2026.

  • DHS Opens $440.7 Million Governmentwide Competition for Biometric Capture Devices

    DHS Opens $440.7 Million Governmentwide Competition for Biometric Capture Devices

    The Department of Homeland Security has opened bidding on a five-year, $440.7 million multiple-award IDIQ contract (solicitation 70RDA126R00000001) to standardize procurement of biometric capture devices — fingerprint, facial, iris, palmprint and multimodal systems — across DHS components and other federal agencies including the Departments of State and Justice, Washington Technology reported.

    The contract vehicle is intended to replace fragmented, one-off purchasing historically used by DHS’s Office of Biometric Identity Management. Proposals are due September 18, 2026.

    Why it matters: A single large, standardized federal contract vehicle for biometric hardware procurement gives vendors a much larger and more predictable addressable market than the agency-by-agency purchasing it replaces, and is likely to influence which biometric hardware standards and interoperability requirements become de facto norms across other government biometric deployments.

    Source: Washington Technology, September 11, 2026, corroborated by FedScoop and ID Tech Wire.

  • Check Point Patches Critical VPN Vulnerabilities in Security Gateway and Spark Firewall

    Check Point Patches Critical VPN Vulnerabilities in Security Gateway and Spark Firewall

    Check Point has patched two critical vulnerabilities, CVE-2026-85102 and CVE-2026-85103, both carrying a CVSS score of 9.8, in the VPN functionality of its Security Gateway and Spark Firewall products, SecurityWeek reported. The flaws stem from a certificate-validation issue and an ASN.1 heap overflow bug that together could allow unauthenticated remote code execution.

    Check Point said its own researchers discovered both vulnerabilities internally, and the company has not confirmed any in-the-wild exploitation to date. Fixes are available in versions R82.10, R82, and R81.20.

    Why it matters: VPN gateways sit at the network perimeter for a large share of enterprise and critical-infrastructure networks, making unauthenticated RCE flaws in this class of product a high-priority patch item regardless of whether active exploitation has been observed yet — the same category of flaw was exploited in the wild within days at other vendors this quarter.

    Source: SecurityWeek, September 11, 2026.