We’re Tracking the Future of Security

Category: News

Current, event-driven reporting, announcements and industry developments.

  • CISA Launches 2026 Cybersecurity Campaign Focused on Critical Infrastructure

    CISA Launches 2026 Cybersecurity Campaign Focused on Critical Infrastructure

    The US Cybersecurity and Infrastructure Security Agency has opened Cybersecurity Awareness Month 2026 with a campaign aimed at turning security awareness into operational resilience. Released on October 1 under the theme Securing the Next 250, the initiative places particular emphasis on organizations that own, operate or support critical infrastructure.

    Guidance moves from basic hygiene to continuity

    CISA’s starting points remain familiar: train employees to recognize phishing, require strong and unique passwords, use multifactor authentication and keep software updated. The agency then extends the checklist to logging, tested backups, encryption, incident reporting and rehearsed response plans.

    The 2026 material adds explicit attention to disruption planning. Organizations are encouraged to identify how mission-essential functions could continue when critical systems or even internet access are unavailable. That turns an awareness campaign into a practical continuity exercise rather than a collection of security slogans.

    Critical-infrastructure teams can use the month as a control review

    CISA frames its infrastructure guidance around three actions: reduce attack surfaces, replace end-of-support devices and recover quickly enough to sustain operations. These are recommendations rather than evidence that any individual organization has met a security standard, so owners should translate them into measurable local work: asset inventories, accountable remediation dates, recovery objectives and exercises involving technical, legal and operational leaders.

    The National Cybersecurity Alliance, which co-leads the wider annual campaign, likewise emphasizes strong authentication, software updates and recognizing suspicious activity. For operators, the useful test is whether those behaviors are embedded in routine maintenance and incident procedures after October ends. Related operational-security coverage is available in SectechMedia’s cyber-physical security channel.

    Sources

  • CISA Details High-Risk Flaws in Malcolm Network Analysis Platform

    CISA Details High-Risk Flaws in Malcolm Network Analysis Platform

    CISA has published advisory ICSA-26-254-01 covering multiple vulnerabilities in Malcolm network analysis platform releases earlier than v26.06.0. The advisory, dated October 1, assigns a maximum CVSS v3 base score of 8.8 and recommends moving to an appropriate September 2026 or later release.

    Broad weakness classes increase review scope

    The reported issues span cross-site scripting and open redirect, command injection, path traversal, server-side request forgery, authentication and authorization flaws, default credentials, improper certificate validation, a vulnerable dependency, and weak password hashing. This breadth means remediation planning should account for more than a single defect or attack path.

    CISA identifies Energy, Information Technology, and Water and Wastewater Systems as affected sectors and describes deployment as worldwide. Because Malcolm supports network analysis, weaknesses in the platform can be relevant to teams overseeing monitoring infrastructure and the larger cyber-physical security domain. The advisory facts do not establish exploitation, and organizations should avoid treating severity alone as evidence of compromise.

    Upgrade and exposure-reduction priorities

    CISA recommends updating to the latest September 2026 or later release. It also advises normal safeguards around network exposure, segmentation, access control, and monitoring. Operators should first identify deployed Malcolm versions and confirm the correct upgrade path for their environment, then review exposure and privileged access while the update is planned. Monitoring before and after remediation can help teams detect anomalous activity and verify that defensive controls continue to operate as intended.

    Sources and further reading

  • DIVD Says Zammad Zero-Days Enabled an AI-Driven Network Breach

    DIVD Says Zammad Zero-Days Enabled an AI-Driven Network Breach

    DIVD disclosed on September 30 that two Zammad zero-days were used in a September 21 breach. Its investigation remains ongoing, so the account should be treated as preliminary. DIVD said an AI agent chained the flaws within seconds, while network segmentation limited further movement inside the affected environment.

    Two vulnerabilities with different roles

    CVE-2026-102489 can allow session hijacking followed by remote code execution as the zammad service user. It affects versions 6.3.0 through 6.5.4. The issue is also present in 7.0.0 through 7.1.3, but the supplied record says it is not exploitable there under the stated environmental conditions. Its reported CVSS score is 9.4.

    CVE-2026-102490 can allow a local zammad user to escalate privileges to root. It affects releases from 1.5.0 to before 7.1.0-alpha, and reporting described all released versions at disclosure as affected. Its reported CVSS score is also 9.4. Together, the issues illustrate why application-layer weaknesses can matter to the wider cyber-physical security landscape.

    Response while guidance develops

    Operators should follow current Zammad and DIVD guidance and apply a fixed release when one becomes available. While the investigation and remediation advice continue to evolve, isolating vulnerable systems can reduce exposure. The reported use of an AI agent is based on DIVD’s preliminary incident account; it should not be generalized into a broader claim about attacker capability or automation. Defenders should focus on the verified vulnerability boundaries, access paths, segmentation, and observable evidence in their own environments.

    Sources and further reading

  • Researchers Find 543,699 Live Credentials in Public GitHub Data

    Researchers Find 543,699 Live Credentials in Public GitHub Data

    Truffle Security reports that 543,699 credentials discovered in public GitHub data still authenticated when tested. The finding comes from the company’s analysis of The Stack v3, a dataset containing 224.6 million public repositories and 58.47 billion files, and points to a long-lived operational problem rather than only recent accidental disclosure.

    Scale and age of the exposure

    The researchers identified 1,103,438 exposed credential candidates and tested them on July 27 and 28, 2026. They said 543,699 remained live. The median exposure age was 784 days, while the oldest valid credential dated to 2009. These figures are research findings reported by Truffle Security and should be understood within the methodology described in its primary report.

    The study also found 199,843 live credentials exposed after GitHub enabled default push protection in February 2024. According to the report, 51.8 percent of live credentials used formats that default push protection did not block. For teams managing broader cyber-physical security risks, the result illustrates how software supply-chain weaknesses can create access paths into operational environments.

    Control implications for security teams

    The research indicates that preventive scanning alone does not close the exposure window. Organizations need detection across repositories and development workflows, but they also need a reliable process to revoke and replace discovered secrets. Historical repositories and older commits deserve attention because a credential’s age does not establish that it has expired. Asset owners should treat a confirmed live credential as an incident requiring containment, scope assessment, rotation, and a review of associated access rather than merely removing the visible string from a repository.

    Sources and further reading

  • CISA Flags Exploited FortiMail Zero-Day Requiring Urgent Mitigation

    CISA Flags Exploited FortiMail Zero-Day Requiring Urgent Mitigation

    CISA has added CVE-2026-104286, a critical FortiMail vulnerability, to its Known Exploited Vulnerabilities catalog. The October 1 action gives covered organizations an October 4 due date and calls for forensic triage alongside mitigation, reflecting confirmed exploitation rather than a theoretical risk.

    Affected FortiMail releases and exposure

    Fortinet assigns the flaw a CVSS score of 9.8 and describes it as an unauthenticated path-traversal and null-byte handling issue. According to its advisory, an attacker can use HTTP or HTTPS to write arbitrary files. The affected ranges are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9.

    Fixed builds were listed as upcoming when the advisory was issued. This creates an immediate operational decision for teams responsible for internet-facing mail infrastructure and the wider cyber-physical security environment: reduce reachable attack surface while also checking systems for evidence of compromise.

    Immediate defensive priorities

    Fortinet’s stated workaround is to disable IBE or restrict management access to a trusted private network. Administrators should follow the vendor’s current guidance, preserve relevant evidence from mail and management interfaces before making changes, and conduct the forensic triage requested by CISA. Because fixed builds had not yet been listed in the supplied advisory facts, teams should verify the latest vendor notice before making assumptions about patch availability. The watchTowr analysis offers additional technical context, but remediation decisions should remain anchored to current Fortinet and CISA instructions.

    Sources and further reading

  • Meari IoT Cloud Authorization Flaws Expose Device and Owner Data

    Meari IoT Cloud Authorization Flaws Expose Device and Owner Data

    CISA has warned about two missing-authorization vulnerabilities in the Meari IoT Cloud Platform OpenAPI. The flaws could let an authenticated user cross account boundaries, alter another owner’s device configuration or obtain sensitive device-shadow data.

    What an authenticated attacker could access

    CVE-2026-101104 concerns authorization checks around device configuration. CVE-2026-96613 affects access to the complete device shadow, which CISA says can include device credentials, owner information, network details and telemetry. The advisory lists a maximum CVSS v3 base score of 7.7 and marks all versions as affected.

    The issue is relevant to connected cameras and other cloud-managed devices because the cloud control plane often stores both operational state and credentials. CISA says it is not aware of public exploitation targeting these vulnerabilities.

    No vendor fix was available at publication

    CISA reports that Meari did not respond to coordination attempts and that no fix was planned when the advisory was released. Users are advised to contact the vendor for information. In the meantime, organizations should review whether affected devices are necessary, isolate them from sensitive networks and monitor cloud-account activity for unexpected configuration changes.

    Teams should also rotate exposed credentials where feasible, restrict who can access the management tenant and document an exit plan if risk cannot be reduced. SectechMedia’s video surveillance and imaging coverage explores security considerations for connected camera ecosystems.

    Sources

  • Johnson Controls Fixes Two EasyIO Neo Controller Security Flaws

    Johnson Controls Fixes Two EasyIO Neo Controller Security Flaws

    Johnson Controls has released updates for EasyIO Neo controllers after two security issues were documented in separate coordinated advisories. The vulnerabilities concern exposure of sensitive information and transmission of credentials or session information without adequate encryption.

    What the two advisories cover

    CVE-2026-64892 involves information that can be obtained through physical debugging interfaces. CISA gives it a maximum CVSS v3 base score of 3.5. CVE-2026-64893 addresses cleartext transmission of credentials and session data and carries a maximum CVSS v3 base score of 5.4.

    The affected devices are used in building-control environments, where controller credentials can provide a path into operational functions. CISA says it is not aware of public exploitation targeting either issue. Johnson Controls lists the related product advisories JCI-PSA-2026-20 and JCI-PSA-2026-30 on its security-advisory portal.

    Updates and compensating controls

    The vendor identifies EC version 3.3b64 and CW version 3.3b26 as fixed releases. For the network issue, operators should use HTTPS and disable HTTP where their deployment allows it. Physical access to debugging interfaces should also be restricted, with controller locations monitored as part of the site’s security plan.

    Before updating controllers, building operators should document current logic and configuration, confirm a rollback path and schedule functional testing. Network teams should check that management traffic stays on trusted segments. SectechMedia’s industrial safety and monitoring coverage includes further guidance for operational technology estates.

    Sources

  • ABB PCM600 Flaws Could Enable Privilege Escalation and File Overwrite

    ABB PCM600 Flaws Could Enable Privilege Escalation and File Overwrite

    ABB has addressed two vulnerabilities in PCM600, its protection and control engineering tool. CISA says the flaws could let a local attacker elevate privileges or cause project-archive files to be written outside the intended extraction directory.

    Two different local attack paths

    CVE-2026-15952 concerns permissions around a scheduler component running as LocalSystem. Under the conditions described by the advisory, a local user could exploit that arrangement to gain higher privileges. CVE-2026-15953 is a path-traversal issue in project archive handling that could place files beyond the selected extraction folder.

    CISA lists PCM600 versions through 2.14 as affected and gives the vulnerabilities a maximum CVSS v3 base score of 6.4. The agency says it is not aware of public exploitation. ABB has published product security advisories and provides workaround guidance for affected deployments.

    Why engineering workstations need special care

    PCM600 is used in energy-sector protection and control engineering. An engineering workstation can therefore hold trusted project files and privileged access to operational assets even when it is not directly exposed to the internet. Organizations should apply ABB’s guidance, limit local administrator rights and treat imported project archives as untrusted until validated.

    Before remediation, teams should back up projects and confirm recovery procedures. Afterward, review scheduled tasks, extraction directories and endpoint telemetry for unexpected files or privilege changes. SectechMedia’s energy-security coverage examines the wider operational context for protecting utility and industrial environments.

    Sources

  • CISA Details Critical Authentication Flaws in Monta EV Charging Platform

    CISA Details Critical Authentication Flaws in Monta EV Charging Platform

    CISA has disclosed four vulnerabilities affecting Monta’s electric-vehicle charging platform. The agency says the issues could allow unauthorized administrative actions or denial-of-service activity, making identity controls and session handling a priority for charging operators.

    Where the weaknesses appear

    The advisory identifies missing authentication and rate-limiting controls, weaknesses involving sessions, and the use of publicly accessible identifiers. CISA assigns the group a maximum CVSS v3 base score of 9.4 and lists monta.app as affected across all versions at the time of publication.

    The practical risk extends beyond a conventional web account. EV charging platforms coordinate users, chargers and operational services, so unauthorized administrative access can affect a distributed physical service. CISA says it is not aware of public exploitation targeting these vulnerabilities.

    Mitigation and operational checks

    Monta is working toward authenticated connections and says its platform supports OCPP 1.6 Security Profile 2. The company also applies throttling and rate limits. Operators should confirm which controls are active in their own tenant and charger estate instead of assuming that a supported feature is already enabled everywhere.

    Security teams should review privileged accounts, revoke stale sessions, monitor failed authentication patterns and segment charger-management services from unrelated business systems. Any configuration change should be tested against charger availability and field-support procedures. Related developments in connected transport can be followed through SectechMedia’s vehicle and transportation security coverage.

    Sources

  • CISA Warns Armatura One Flaws Could Expose Physical Access-Control Systems

    CISA Warns Armatura One Flaws Could Expose Physical Access-Control Systems

    The US Cybersecurity and Infrastructure Security Agency has published an advisory covering several vulnerabilities in Armatura One, a platform used to administer physical access-control systems. CISA says successful exploitation could expose database information, enable code execution or allow an attacker to take control of access-control functions.

    Affected versions and security impact

    The advisory covers Armatura One versions earlier than 4.7.2 and the US edition earlier than 4.6.1. The reported issues include embedded ActiveMQ vulnerability CVE-2023-46604 as well as four newly assigned CVEs affecting the platform. CISA lists a maximum CVSS v3 base score of 9.8.

    The agency notes that CVE-2023-46604 appears in its Known Exploited Vulnerabilities catalog because it has been used against other products. CISA says it is not aware of public exploitation specifically targeting Armatura One. That distinction matters: operators should treat the exposure seriously without assuming that every installation has already been compromised.

    What access-control operators should do

    Armatura recommends upgrading to version 4.7.2, or 4.6.1_USA for the US edition. Owners should first inventory management servers, restrict administrative interfaces to trusted networks and preserve configuration backups before changing production systems.

    Because the platform can influence doors and credentials, remediation should be coordinated with physical-security teams, not handled as an isolated IT patch. Administrators should also review service accounts, database access and logs for unexpected changes. SectechMedia’s access-control and identity coverage provides additional context for securing controller and credential-management environments.

    Sources