We’re Tracking the Future of Security

Category: News

Current, event-driven reporting, announcements and industry developments.

  • PSG and Mercury Security Partner to Extend Zero Trust to Physical Security’s Far Edge

    PSG and Mercury Security Partner to Extend Zero Trust to Physical Security’s Far Edge

    Prometheus Security Group Global (PSG) announced a technology partnership with Mercury Security on August 27, 2026, aimed at extending Zero Trust principles down to the field-device level of physical security systems, according to the companies’ announcement and independent reporting from Security Systems News.

    Combining Access Hardware With Edge Authentication

    The partnership pairs Mercury’s open-architecture access-control hardware platform with PSG’s patented technology for embedding cryptographic identity, authentication and verification directly into far-edge field devices, including door readers, sensors and cameras. PSG describes the goal as moving physical security systems away from assumed, unverified inputs toward authenticated and cryptographically verified data starting at the point where it is generated, rather than only securing the network layer above it.

    Why Now

    The move extends a Zero Trust architecture approach that IT security teams have used for years, in which every device and request is continuously authenticated rather than implicitly trusted once inside a network perimeter, into physical and operational technology environments. PSG has previously supplied Zero Trust physical security technology to U.S. Air Force, Navy and Department of Energy programs, and has positioned far-edge authentication as a way to close a gap security researchers have flagged in converging IT and physical access control systems, where edge hardware has often remained a weaker link than the software managing it.

    What It Means for Integrators

    For organizations running Mercury-based access control, the partnership is intended to let them add cryptographic device-level verification without replacing existing access-control investments, addressing a common friction point in critical-infrastructure and high-security environments where wholesale hardware replacement is often impractical.

  • NextNav and Tiami Networks Partner to Test 5G-Powered Counter-Drone Sensing

    NextNav and Tiami Networks Partner to Test 5G-Powered Counter-Drone Sensing

    Positioning company NextNav has named Tiami Networks as a sensing ecosystem partner to jointly develop and evaluate counter-UAS detection capabilities built on 5G infrastructure, the companies announced on August 25, 2026, according to NextNav’s own release and independent reporting from UASweekly and Unmanned Airspace.

    The Technology

    The partnership will use NextNav’s existing 5G Positioning, Navigation and Timing (PNT) network, deployed on the licensed lower 900 MHz band, as a testbed in Santa Clara County, California. Tiami is contributing its radio-frequency sensing technology to the effort, with the two companies evaluating whether the same 5G infrastructure that provides positioning services can simultaneously support wide-area sensing for drone detection without adding load to the network. The approach falls under what the companies describe as integrated sensing and communications, or ISAC.

    Why Range Matters

    “The need for longer range situational awareness has never been more urgent as drones continue to threaten large-scale events, critical infrastructure, and government and military facilities including airports,” said David Gell, NextNav’s vice president of business development, in the companies’ announcement. That framing echoes a wider push across the counter-UAS sector this year toward detection systems that can spot drones farther out and earlier, giving operators more time to assess and respond before an unmanned aircraft reaches a protected site.

    Early-Stage Evaluation

    NextNav and Tiami characterized the work as an evaluation of performance and applicability rather than a finished product, with the companies planning to assess whether the low-band 5G approach can support counter-UAS, critical-infrastructure and national-security use cases alongside its existing positioning role.

  • Ambient.ai Adds Agentic Video Monitoring and Case Management Tools Ahead of GSX 2026

    Ambient.ai Adds Agentic Video Monitoring and Case Management Tools Ahead of GSX 2026

    Ambient.ai, a physical security AI vendor, announced new agentic capabilities across its platform on August 26, 2026, adding AI agents that continuously monitor camera feeds and automated case-management tools that assemble scattered video clips into a single incident timeline, according to the company’s announcement carried via PR Newswire and confirmed by Security Systems News.

    What’s New

    The centerpiece of the release is an AI agent Ambient.ai describes as continuously monitoring every connected camera and surfacing the events operators are most likely to need to see, rather than requiring security teams to actively watch banks of live video feeds. Alongside it, the company introduced a new case-management workflow intended to turn clips from multiple cameras and time windows into a single connected incident narrative, cutting down the manual work of stitching together footage during investigations. Ambient.ai also said it made infrastructure upgrades to support the new features at scale.

    Timed to GSX 2026

    The company plans to demonstrate the new Agentic Video Wall and case-management tools live at its booth (#3923) during GSX 2026 in Atlanta, positioning the release as part of a broader wave of “agentic” AI marketing across the physical security industry this year, as vendors compete to move video analytics from passive alerting toward autonomous monitoring and response.

    Why It Matters

    The announcement reflects a broader industry shift already visible in the growing adoption of AI-assisted video management platforms, where vendors are racing to differentiate on how much investigative and monitoring work their software can take on autonomously rather than leaving it to human operators watching screens.

  • Two Unitree G1 EDU Humanoid Robot Flaws Enable Root-Level Takeover

    Two Unitree G1 EDU Humanoid Robot Flaws Enable Root-Level Takeover

    Security researchers have disclosed two vulnerability chains affecting the Unitree G1 EDU humanoid robot that can grant an attacker root-level control over the machine’s onboard computer, tracked as CVE-2026-76639 and CVE-2026-76640, according to The Hacker News and Security Affairs.

    Two Distinct Paths to Root

    The first chain is network-adjacent, reaching root through the robot’s chat_go and bashrunner components. The second begins over Bluetooth Low Energy proximity, exploiting the robot’s Wi-Fi provisioning process to reach a buffer overflow that grants root execution on the Locomotion PC — meaning an attacker within wireless range, without any network access, can potentially take full control of the robot. Researcher Kevin Finisterre, writing on the disclosure, noted the financial and operational stakes bluntly: “They also cost a lot! I’d be pissed off if someone hacked into my G1, took control of it, and walked it off my factory/campus.”

    No Confirmed Fix Yet

    As of the disclosure, no fixed firmware release could be independently verified in Unitree’s public guidance, leaving G1 EDU owners without a confirmed remediation timeline for either vulnerability. The Hacker News reported it had reached out to Unitree to confirm affected product scope and fix status but had not received a response as of publication. Unitree’s product page lists the G1 and G1 EDU as separate models, and researchers have not yet confirmed whether the flaws extend to other robots in Unitree’s lineup.

    Part of a Pattern With Consumer-Facing Robotics

    The disclosure follows earlier security research into Unitree hardware, including a September 2025 finding that a Bluetooth Low Energy exploit dubbed UniPwn could achieve wormable root-level compromise across multiple Unitree platforms, including its Go2 and B2 quadrupeds and G1 and H1 humanoids, using a single hardcoded key shared across the entire device fleet. Robotics cybersecurity researchers have separately raised concerns about undisclosed telemetry from Unitree devices. For organizations deploying humanoid or quadruped robots in factories, campuses or public-facing roles, the G1 EDU findings underscore that physical robotics platforms now carry the same remote-exploitation risk profile as any other networked, wireless-enabled endpoint.

  • Philippine Nuclear and Naval Targets Hit by Suspected Chinese-Speaking Operator

    Philippine Nuclear and Naval Targets Hit by Suspected Chinese-Speaking Operator

    A suspected Chinese-speaking threat actor breached Philippine nuclear research and naval-related organizations by exploiting known vulnerabilities in internet-facing ownCloud and WordPress systems, stealing sensitive data including nuclear reactor component databases and personnel records, according to Security Affairs and independent research from Hunt.io.

    Known Vulnerabilities, High-Value Targets

    The intrusions exploited two previously disclosed vulnerabilities — CVE-2023-49105 and CVE-2024-28000 — rather than a novel zero-day, underscoring how unpatched, internet-exposed systems remain a viable entry point into sensitive government and defense-adjacent networks years after fixes became available. Hunt.io researchers linked the activity to infrastructure including an IP address at 31.58.209[.]241, and found that stolen data was organized using Chinese-language folder and file names, including terms corresponding to “Nuclear Material Accounts” and “IT Planning,” along with code comments and docstrings that strongly suggest the operator is a native Chinese speaker or highly fluent in the language.

    Intelligence Collection, Not Opportunistic Crime

    Researchers characterized the operation as consistent with targeted intelligence collection against high-value defense and scientific institutions rather than financially motivated cybercrime. The theft of nuclear reactor component data and personnel records from two organizations raises particular concern given the sensitivity of nuclear material accounting information, which is typically subject to international safeguards and non-proliferation reporting requirements.

    Recommended Response

    Security Affairs and Hunt.io both recommend that organizations running ownCloud and WordPress promptly apply available patches, upgrade to supported versions, and enforce strong authentication measures given the continued exploitation of these older, publicly known flaws. The incident adds to a broader pattern of suspected Chinese state-linked operators targeting critical infrastructure and defense-adjacent organizations across the Indo-Pacific region, an area of persistent concern for U.S. and allied cybersecurity agencies monitoring pre-positioning activity ahead of potential regional conflict scenarios.

  • Love Electric Breach Exposes Up to 877,000 UK Driver Records for Sale

    Love Electric Breach Exposes Up to 877,000 UK Driver Records for Sale

    A seller on an English-language cybercrime forum claims to have obtained the driver database of Love Electric, a UK broker that runs electric-vehicle salary sacrifice schemes, offering approximately 877,000 driver records for $600, according to Security Affairs.

    What Was Allegedly Taken

    The seller, operating under the pseudonym “seraphims,” listed the database on August 26 and claims it includes sensitive personal information such as National Insurance numbers and driving license numbers, drawn from a table structured as dbo.drivers within a Microsoft SQL Server database. The seller claims the data was obtained through a zero-day vulnerability in a third-party system, though Security Affairs notes this claim remains unverified, and the actual scope and accuracy of the exposed record count has not been independently confirmed.

    A Third-Party Risk Story

    Love Electric operates as a broker for electric-vehicle salary sacrifice schemes, meaning the driver data it holds is typically supplied by employers on behalf of employees enrolling in the benefit — a structure that concentrates sensitive identity data (National Insurance and driving license numbers) with a third-party intermediary rather than the employer itself. If confirmed, the incident would highlight the identity-theft risk created when employee benefit administrators accumulate government identification data as a byproduct of otherwise routine benefits processing, a risk pattern security researchers have flagged repeatedly across payroll, salary-sacrifice and benefits-brokerage platforms.

    Risk to Affected Drivers

    Exposed National Insurance and driving license numbers are commonly used identity verification data points in the UK, meaning a confirmed breach of this scale could expose affected individuals to a heightened risk of convincing phishing attacks and identity fraud attempts that reference their real personal and vehicle information to appear legitimate. Love Electric has not yet issued a public statement confirming or denying the breach claim.

  • Lockheed Martin Ventures and Presidio Ventures Back Quantum Camera Startup Diffraqtion

    Lockheed Martin Ventures and Presidio Ventures Back Quantum Camera Startup Diffraqtion

    Diffraqtion, an MIT and University of Maryland spinout building quantum camera platforms for defense and space sensing, announced strategic investments from Lockheed Martin Ventures and Presidio Ventures — the venture arm of Japan’s Sumitomo Corporation — bringing the company’s total pre-seed funding to more than $10 million, according to the company’s announcement and SpaceNews.

    From Laboratory to Flight Demonstration

    The new investment follows roughly seven months of progress since the round’s first close in January 2026, led by Ground State Ventures. In that time, Diffraqtion completed on-sky demonstrations at a partner observatory distinguishing closely spaced objects, advanced its DARPA Direct-to-Phase-II SBIR contract into its second option period, and was selected by NASA for an SBIR Phase I award in orbital debris tracking, alongside winning NASA’s $100,000 Space to Soil Challenge for adaptive imaging. “This team’s rapid progress from laboratory development toward flight demonstration is particularly promising,” said Chris Moran, vice president and general manager of Lockheed Martin Ventures.

    Dual-Use Sensing for Defense and Industry

    Diffraqtion’s quantum imaging technology is designed to apply the same underlying physics advantage whether the camera is observing objects in orbit, tracking targets on Earth, or guiding a physical system in real time. “What drew us to Diffraqtion is that the same physics advantage applies whether the camera is observing the sky or the Earth, or guiding a physical system,” said Ross Leav, senior vice president at Presidio Ventures. “We see significant opportunity to bring this capability to industrial and commercial markets globally.”

    Part of a Broader Defense-Tech Investment Wave

    The round adds Lockheed Martin Ventures and Presidio Ventures to a syndicate that already included QDNL Participations, milemark·capital, Aether VC and ADIN from the January close, alongside new participants SBI US Gateway Fund with Plug and Play, Collaborative Fund and TekVentures. The investment reflects a broader surge of venture capital flowing into defense-adjacent sensing and space technology startups, as established defense primes increasingly use corporate venture arms to gain early access to dual-use technologies developed outside traditional defense contracting channels.

  • Axis Survey Finds Growing Public Comfort With Video Surveillance, But Privacy Expectations Remain High

    Axis Survey Finds Growing Public Comfort With Video Surveillance, But Privacy Expectations Remain High

    A new survey commissioned by Axis Communications finds that nearly six in ten U.S. adults are more comfortable with video surveillance today than they were five years ago, even as respondents continue to expect transparency, privacy safeguards and responsible use of AI in how that surveillance is deployed, according to reporting from SecurityInfoWatch.

    The Numbers

    The survey found that 58% of U.S. respondents said they are more comfortable with video surveillance in both public and private spaces than they were five years ago. Within that figure, 20% described themselves as significantly more comfortable, while a further 23% reported being somewhat more comfortable. Comfort levels varied depending on where surveillance is deployed, with respondents generally more accepting of cameras in transportation hubs, retail environments and workplaces than in more private or ambiguous settings.

    Comfort Is Conditional, Not Unconditional

    Despite the overall upward trend in acceptance, the research makes clear that public tolerance for video surveillance is not unconditional. Respondents continued to cite transparency about how footage is used and stored, clear privacy policies, and confidence that AI-driven video analytics are applied responsibly as prerequisites for their comfort. That combination — rising baseline acceptance paired with persistent conditions attached to it — mirrors a pattern security researchers have observed across other public-facing surveillance and biometric technologies as AI-powered analytics become standard in commercial video management platforms.

    Why It Matters for Operators

    For security integrators and end users, the findings suggest that expanding camera coverage or adding AI analytics capabilities is unlikely to trigger the public backlash it might have several years ago, provided organizations pair those deployments with clear signage, published data-retention policies and visible governance over how video and derived analytics are used. The survey adds to a growing body of industry research suggesting that public perception of video surveillance is shifting from a binary privacy-versus-security debate toward a more nuanced expectation of accountable deployment.

  • Hackers Abuse npm Mirrors to Host Phishing Redirect Pages Disguised as Cloudflare Verification

    Hackers Abuse npm Mirrors to Host Phishing Redirect Pages Disguised as Cloudflare Verification

    Security researchers at OX Security have identified 24 npm packages that exist solely to host phishing redirect pages disguised as Cloudflare Turnstile verification screens, exploiting the way mirror services like unpkg and npmmirror expose individual package files directly in a browser, according to BleepingComputer.

    How the Technique Works

    Attackers upload npm packages containing nothing more than a malicious HTML file and a package.json file declaring it as the main entry point. Because mirroring platforms such as unpkg.com let individual files inside a published package be opened directly through a browser URL, the malicious HTML renders as though it were served from a trusted, legitimate domain rather than from attacker-controlled infrastructure — a distinction that can help the page evade security software trained to flag suspicious hosts. Installing the package itself causes no harm; the payload is the standalone HTML file, not executable code bundled with the package.

    Security researcher inf0stache first spotted the technique in July 2026 in a package named “china_airlines,” which used a fake Cloudflare verification page to redirect visitors to a malicious domain. OX Security subsequently found the same HTML template reused across 24 separate packages. Some of the malicious packages reference api.keyval.org, allowing operators to change the ultimate redirect destination remotely without needing to publish a new version of the package. OX also warned that packages removed from the official npm registry can persist indefinitely on third-party mirrors, meaning takedown at the source does not guarantee the malicious content disappears.

    Part of a Broader Pattern

    The campaign echoes an earlier technique documented by Socket in October 2025, when researchers found 175 malicious npm packages — collectively downloaded more than 26,000 times — using unpkg to host redirect scripts rather than full phishing pages, targeting Microsoft 365 accounts that lacked multi-factor authentication. “Threat actors keep finding and using new and novel techniques not just to deliver malware, but to use legitimate infrastructure to store their payloads and data,” OX Security concluded. For organizations relying on npm and its mirrors as part of their software supply chain, the finding underscores that package registries have become a persistent target for abuse well beyond traditional malicious-dependency attacks.

  • TDSi by Hirsch Releases GARDiS 3.3 Access Control Software Update With New Intruder Integration and Credential Model

    TDSi by Hirsch Releases GARDiS 3.3 Access Control Software Update With New Intruder Integration and Credential Model

    Integrated access control manufacturer TDSi by Hirsch has released GARDiS version 3.3, a major update to its access control software platform introducing new intruder-detection integrations, a redesigned credential model and expanded security and data-governance controls, according to Security Info Watch.

    A Unified Credential Model

    The centerpiece of the release is a redesigned credential model built around a universal “Card or Fob” type that works across virtually all reader and card technologies, removing the need for administrators to manually select and match credential types to specific decode formats. Existing credentials are migrated automatically during the upgrade process and can be verified before changes take effect. Biometric credentials and IP lock whitelisting are included within the same unified approach, simplifying what has traditionally been one of the more error-prone parts of access control administration.

    Expanded Security and Governance Controls

    GARDiS 3.3 adds configurable password rules, banned-word lists and automatic account lockout to strengthen login security, alongside new event-dashboard permissions that control which users can view live and archived security events. Organization-based filtering further restricts user access to information tied only to the people they are authorized to manage — a feature aimed at larger, multi-tenant or multi-site deployments where over-broad visibility has historically been a governance concern. Saved reports can now be kept private to their creator or explicitly shared with designated colleagues, giving administrators finer control over sensitive operational data.

    Ajax Cloud Integration for Intruder Detection

    The release also introduces new intruder-system integration with Ajax Cloud, allowing GARDiS to incorporate intrusion-detection alerts alongside access control events within a single management interface. Combining access control and intrusion alarm data in one platform reflects a broader industry trend toward converged physical security management, where operators increasingly expect a single pane of glass rather than separate systems for access, video and intrusion detection.