We’re Tracking the Future of Security

Category: News

Current, event-driven reporting, announcements and industry developments.

  • RAND Europe Warns Security Biometrics and Digital ID Systems Risk Becoming Tools for Targeting Without Governance

    RAND Europe Warns Security Biometrics and Digital ID Systems Risk Becoming Tools for Targeting Without Governance

    A RAND Europe report, produced with the UK Foreign, Commonwealth and Development Office and RUSI, warns that biometrics, digital ID and AI decision-support tools used by police and border agencies risk becoming tools for discriminatory targeting and surveillance in the absence of independent governance, Biometric Update reported.

    The report, titled “Novel Technologies for Security Sector Governance and Management,” cites documented facial-recognition misidentification disparities and points to systems like EURODAC and Clearview AI as cautionary examples. It recommends pre-acquisition risk assessments and audit trails, arguing that relying on “human-in-the-loop” oversight alone is insufficient.

    Why it matters: The report adds to a growing body of institutional, non-vendor research pushing back against the assumption that human review of an AI system’s output is sufficient safeguard on its own — a distinction increasingly relevant as police and border agencies adopt biometric and AI decision-support tools faster than governance frameworks are being built around them.

    Source: Biometric Update, September 9, 2026, citing RAND Europe.

  • Investment Firm Knox Lane Acquires Majority Stake in SAGE Integration

    Investment Firm Knox Lane Acquires Majority Stake in SAGE Integration

    Investment firm Knox Lane has acquired a majority stake in SAGE Integration Holdings, a national enterprise security systems integrator founded in 1988, SecurityInfoWatch reported. Financial terms of the transaction were not disclosed.

    SAGE said it plans to use the new capital to expand its technical workforce, accelerate technology deployment for enterprise clients, and continue an acquisition strategy that already added Vital Installs and sudoVision Consulting to the group in August 2026.

    Why it matters: The deal is the latest in a wave of private-equity-backed consolidation among security systems integrators, following similar recent moves by Convergint and other national players — a trend that is reshaping who designs and maintains access control, video and fire systems for large enterprise and institutional clients.

    Source: SecurityInfoWatch.com, September 9, 2026.

  • Mistral AI Raises €3 Billion in Largest-Ever European Tech Funding Round

    Mistral AI Raises €3 Billion in Largest-Ever European Tech Funding Round

    Paris-based Mistral AI has raised €3 billion (about $3.5 billion) in a Series D funding round led by Samsung Electronics, pushing its post-money valuation above €21 billion in what the company describes as the largest equity fundraising round ever completed by a European technology company.

    Valuation Nearly Doubles in a Year

    Samsung led the round alongside co-leads Scaleup Europe Fund, managed by EQT, and existing investor PSG Equity. New investors including Advent, funds managed by BlackRock, and the Grand Duchy of Luxembourg joined the round, while existing backers a16z, ASML, General Catalyst, Lightspeed, Nvidia and Salesforce Ventures also participated. The step up is steep: Mistral was valued at roughly €11.7 billion in 2025 after a €1.7 billion Series C led by ASML, meaning its valuation has nearly doubled in about a year. Founded three years ago, Mistral says it now operates in twenty countries and counts more than 125 large enterprises among its customers, including Airbus and HSBC.

    Funding a European Compute Buildout

    Mistral said the capital will fund frontier AI research, continued international growth, and an expanding European compute footprint. The company is already spending roughly €4 billion on data centers across France and Europe, including a facility outside Paris built around 13,800 Nvidia GB300 GPUs and a second, €1.2 billion facility under construction in Sweden, with a target of roughly 200 megawatts of combined European capacity by the end of 2027. Both Microsoft and Nvidia, which are investors in Mistral, are also involved in supplying compute capacity to the buildout. The round positions Mistral as Europe’s best-funded answer to US-based AI labs including OpenAI and Anthropic, though its roughly $4 billion in total funding to date remains well behind either rival.

  • Palladyne AI and FANUC America Partner to Bring ‘Physical AI’ to Industrial Robots

    Palladyne AI and FANUC America Partner to Bring ‘Physical AI’ to Industrial Robots

    Palladyne AI and FANUC America have announced a strategic collaboration to combine FANUC’s industrial robot portfolio with Palladyne AI’s physical AI software platform, aiming to make robotic automation easier to deploy and more adaptable across manufacturing, warehousing and logistics operations.

    Pairing Industrial Hardware With Adaptive Software

    The companies plan to integrate Palladyne IQ, Palladyne AI’s software platform, with FANUC’s industrial robots to focus on AI-driven motion planning, adaptive behavior, teleoperation, human-assisted learning, simulation and model training. Palladyne IQ is designed to help industrial robots better perceive and adapt to changing conditions on the floor, moving deployments beyond rigid, single-purpose programming toward systems that can support a broader range of tasks without extensive reprogramming. The collaboration also includes joint customer validation and standardized deployment workflows intended to make it easier for manufacturers, warehouse operators, logistics providers and system integrators to bring robotic systems into production.

    Targeting Labor and Flexibility Pressures

    Both companies frame the effort as a response to persistent labor shortages and pressure for greater operational flexibility across manufacturing and logistics, where reprogramming robots for new tasks has traditionally been slow and costly. The collaboration, announced September 8, 2026, is still in a development phase; no customer deployment results, success rates or production benchmarks have yet been disclosed. The partnership adds to a broader wave of manufacturers pairing established industrial robot hardware with newer physical AI software layers as factories and warehouses expand automated operations.

  • ASUS Patches Critical Flaws Letting Attackers Seize Control Center Enterprise and Nearby Hosts

    ASUS Patches Critical Flaws Letting Attackers Seize Control Center Enterprise and Nearby Hosts

    ASUS has released security updates fixing critical vulnerabilities across two of its device-management products, including a maximum-severity flaw that let an unauthenticated attacker gain root access to the server managing an organization’s fleet of PCs and workstations.

    A Chained Path to Root on Control Center Enterprise

    The more severe issue, CVE-2026-75754, carries a CVSS score of 10.0 and affects ASUS Control Center Enterprise (ACC) version 4.0.0.2 and all earlier releases. It stems from a chain of missing authentication, server-side request forgery and hard-coded credentials: an attacker can send a crafted HTTP request to obtain the system’s encryption key, which causes a local service to open SSH on port 2222, then use hard-coded credentials to obtain a root shell on the ACC server. Successful exploitation gives an attacker full control of the platform, including the ability to read, modify or delete stored data and remotely manage every server, PC and workstation the platform oversees. ASUS published the fix on September 4, 2026.

    A Second, Separate Flaw in Control Center Express

    ASUS separately patched CVE-2026-19397, a missing-authentication vulnerability in the Control Center Express Agent affecting versions before 1.7.24. The flaw, classified as CWE-306, allows an unauthenticated nearby attacker with a direct connection to the agent to take control of a host that has an active login session, potentially executing code or performing any action available to the logged-in user. ASUS published updates for Control Center Express and its Armoury Crate software, which separately addressed a flaw that could expose a user’s NTLM hash, on September 8, 2026. Neither vulnerability has been reported as actively exploited, but organizations running either platform are advised to update immediately given the scope of access each flaw can grant.

  • Mercury Security Launches S4 I/O Module Family to Modernize Access Control Infrastructure

    Mercury Security Launches S4 I/O Module Family to Modernize Access Control Infrastructure

    Mercury Security, an HID brand and a longtime supplier of open-architecture access control hardware, has launched its Mercury S4 I/O Module family, a new generation of intelligent modules designed to help organizations expand and modernize physical access control systems built on existing Mercury infrastructure.

    More Capacity, Built-In Cryptographic Headroom

    According to Mercury, the S4 family delivers six times the memory and eight times the storage of prior-generation modules, along with support for post-quantum cryptography aimed at hardening access control communications against future cryptographic threats to critical infrastructure. The modules are built for forward and backward compatibility, letting integrators add doors, readers and other security devices to existing Mercury intelligent controllers without replacing them, while increasing door density and reducing the physical footprint of the resulting installation.

    Responding to Longer Infrastructure Lifecycles

    The company said its ongoing research into access control professionals’ priorities identified sustained emphasis on cybersecurity and data protection standards, alongside a need for hardware that supports both forward and backward compatibility as organizations plan access control investments over longer timeframes. The Mercury S4 I/O Modules are available now through Mercury’s OEM partner network, extending an open-architecture platform the company has developed since its founding in 1992.

  • Qualcomm and AWS Sign Multi-Generation Deal for Custom AI Inference Silicon

    Qualcomm and AWS Sign Multi-Generation Deal for Custom AI Inference Silicon

    Qualcomm and Amazon Web Services have signed a multi-generation collaboration agreement to develop customized silicon and optical connectivity for AWS’s AI data center infrastructure, marking one of Qualcomm’s most significant moves yet into the data-center chip market long dominated by Nvidia.

    Custom Inference Chips and High-Speed Optical Links

    Under the agreement announced September 8, 2026, Qualcomm Technologies will work with AWS to design customized silicon focused on AI inference workloads, alongside advanced optical connectivity solutions supporting interconnect speeds up to 1.6 terabits per second and future generations beyond that. “As AI demand accelerates, data center infrastructure will require advances in both computing and connectivity to deliver greater performance with more efficiency,” said Cristiano Amon, president and chief executive of Qualcomm, adding that the company aims to bring “decades of leadership in advanced processing and power-efficient compute” to AWS’s AI infrastructure.

    A Warrant Tied to Billions in Future Purchases

    As part of the deal, Qualcomm issued Amazon a warrant to acquire up to 25 million shares of Qualcomm common stock, vesting as AWS makes purchases under the agreement, up to a cap of $60 billion over a ten-year term. The warrant carries an exercise price of $161.26, roughly 4.4% below Qualcomm’s September 4 closing price, with 3.75 million shares vesting immediately at signing. Qualcomm shares rose sharply following the announcement. The agreement follows Qualcomm’s introduction of its AI200 and AI250 data-center inference chips last year and reflects the company’s broader push to diversify beyond smartphone processors into AI infrastructure, an area where hyperscalers including Amazon, Google and Microsoft have increasingly sought custom silicon to reduce reliance on Nvidia.

  • Pavion Expands Midwest Reach With Acquisition of Indiana-Based Communication Company

    Pavion Expands Midwest Reach With Acquisition of Indiana-Based Communication Company

    Pavion, a systems integrator specializing in fire, life safety, security and critical communications, has acquired Communication Company, a South Bend, Indiana-based technology solutions provider that has served the region for roughly five decades, the company announced.

    Regional Relationships and Healthcare Expertise

    Founded in 1976, Communication Company brings established local customer relationships, technical expertise and service capabilities to Pavion’s broader portfolio, which spans fire and life safety, security, critical communications, audiovisual and integrated technology solutions. Pavion said the deal also strengthens its healthcare capabilities, since Communication Company has experience supporting hospitals and healthcare systems, complementing Pavion’s existing work in nurse call, real-time location systems and life-safety technology for the sector.

    Part of a Broader Growth Strategy

    “Communication Company has built an impressive legacy by earning the trust of its customers through exceptional service, technical expertise and strong local responsiveness,” said Joe Oliveri, chief executive officer of Pavion, adding that the acquisition expands the combined company’s ability to help organizations across the Midwest “connect and protect their people, property and assets.” The Chantilly, Virginia-based company, backed by private equity firm Wind Point Partners since 2020, has built its growth strategy around acquiring regional integrators with strong customer relationships and local market leadership, continuing a multi-year acquisition run across the fire, life-safety and security integration sector.

  • Estonian Startup Unveils Self-Balancing Monowheel Robot for Autonomous Security Patrols

    Estonian Startup Unveils Self-Balancing Monowheel Robot for Autonomous Security Patrols

    Estonian startup Rollo Robotics has unveiled 1Rollo, a self-balancing, one-wheeled autonomous robot designed to patrol warehouses, factories, campuses and other large properties, offering what the company positions as a lower-cost alternative to traditional guard patrols and security vehicles.

    A Narrow Footprint Built for Estonian Winters

    Currently in functional prototype form, 1Rollo uses gyroscopic stabilization to balance and move on a single wheel, a design the company says gives it a narrower footprint than wheeled or tracked patrol robots. Rollo Robotics, based in Viljandi, Estonia, says the platform was developed and tested through the country’s harsh winters, addressing traction, battery performance and sensor reliability in snow and sub-zero temperatures. The robot is intended to operate around the clock without the breaks, shift changes or attention lapses associated with human patrols.

    Subscription Model, Open Cybersecurity Questions

    Rather than selling the hardware outright, Rollo Robotics plans to offer 1Rollo through a Robotics-as-a-Service subscription that would bundle current hardware, software updates and support, according to CEO and co-founder Sander Sebastian Agur. The company says the model removes a large upfront equipment cost and simplifies future upgrades and repairs for customers.

    As with other connected patrol robots, 1Rollo depends on wireless connectivity and a cloud platform, which raises questions buyers will need to ask about video encryption, footage retention, operator-account protection and how the robot behaves if it loses its connection. The launch also comes as US lawmakers consider legislation that would restrict government use of some foreign-made robots over national-security concerns, a debate that is likely to shape how autonomous patrol platforms built outside the United States are received by security buyers.

  • 12-Year-Old PostgreSQL Flaw ‘PostGREShell’ Lets Low-Privilege Accounts Seize Full Server Control

    12-Year-Old PostgreSQL Flaw ‘PostGREShell’ Lets Low-Privilege Accounts Seize Full Server Control

    A PostgreSQL vulnerability that has existed undetected for roughly 12 years can let a low-privileged database account escalate to complete, persistent control of the server, researchers have disclosed.

    A Decade-Old Gap in a ‘Low-Risk’ Privilege

    Tracked as CVE-2026-6471 and nicknamed PostGREShell by the Cyera Research team that found it, the flaw carries a CVSS score of 7.2 and stems from a missing authorization check in PostgreSQL’s logical decoding feature, present since the capability was introduced in version 9.4 in 2014. An account holding only the REPLICATION privilege — typically granted for backup or data-pipeline purposes and long treated as a low-risk, read-only permission — can use a logical decoding output plugin to make the server load an arbitrary shared library file. That library executes as native code inside the PostgreSQL server process, running with the privileges of the operating-system account that runs the database.

    Successful exploitation can lead to arbitrary code execution, privilege escalation to permanent superuser status, and installation of a persistent backdoor, effectively handing an attacker full control of the server and any data it holds.

    Patched in August, Disclosed in September

    The PostgreSQL project shipped a fix for CVE-2026-6471 on August 13, 2026, bundled with 27 other security patches in versions 18.6, 17.11, 16.15, 15.19 and 14.24. Branches earlier than version 14 do not receive a fix. Cyera reported the issue to the PostgreSQL security team on February 21, 2026, with the team confirming it six days later; discovery credit was given to researchers Vladimir Tokarev and Yu Kunpeng. Security researchers are advising organizations to update affected instances immediately, audit which accounts hold the REPLICATION attribute, and remove it from any account that does not strictly require it.