We’re Tracking the Future of Security

Category: News

Current, event-driven reporting, announcements and industry developments.

  • Sri Lanka Plans In-House Digital ID Pilot While Full Procurement Remains Delayed

    Sri Lanka Plans In-House Digital ID Pilot While Full Procurement Remains Delayed

    Sri Lanka is preparing a limited in-house pilot of its digital identity program while procurement for the full national system remains unresolved. Reporting on the government plan says bids for the master systems integrator role exceeded the Indian grant allocated to support the broader deployment.

    The pilot separates early testing from full procurement

    The planned Sri Lanka Unique Digital Identity system is based on the open-source MOSIP architecture. Officials are pursuing a phased approach so that identity issuance and operational testing can begin while financing and procurement discussions continue. Earlier public statements placed initial issuance before the end of 2026.

    The larger program involves biometric enrollment, identity lifecycle management and integration with government services. A limited pilot can test registration workflows and service interoperability, but it does not by itself resolve national-scale capacity, privacy governance, procurement or long-term support requirements.

    Identity infrastructure needs transparent acceptance criteria

    Before expansion, program owners should publish measurable controls for biometric quality, duplicate detection, consent, audit logging, credential recovery and data access. Independent security testing and clear retention rules are important when a pilot becomes a production identity platform. SectechMedia follows related systems in its access control and identity coverage.

    Sources

  • UK CertifID Trust Mark Goes Live With Five Digital Verification Providers

    UK CertifID Trust Mark Goes Live With Five Digital Verification Providers

    The United Kingdom has put its UK CertifID trust mark into operational use, with five digital verification service providers becoming the first organizations authorized to display it for registered services. The mark is intended to help users identify providers assessed against the national digital verification services trust framework.

    The mark is tied to registered services

    A government digital identity update names Orchestrating Identity, TrustID, CDD Services, Mistho and GBG as the first providers. Eligibility is linked to certification against version 1.0 of the trust framework and registration under the country’s digital identity governance system; it is not a general endorsement for every product offered by a company.

    Government usage guidance sets conditions for how the mark may appear and is designed to prevent presentation that could mislead customers about the scope of certification. The launch follows the broader move toward reusable digital verification services in regulated and public-facing transactions.

    Relying parties still need technical due diligence

    A visible trust mark can support procurement and user confidence, but organizations must still assess authentication strength, privacy controls, recovery processes, fraud monitoring and interoperability for each deployment. Contracts should identify exactly which registered service is being used. SectechMedia follows related developments in its access control and identity coverage.

    Sources

  • Cloudflare Announces Public Certificate Authority for Post-Quantum TLS

    Cloudflare Announces Public Certificate Authority for Post-Quantum TLS

    Cloudflare has announced plans to operate a public certificate authority capable of issuing both conventional and post-quantum digital certificates. The company says the service is intended to help website operators prepare public key infrastructure for future cryptographic threats without waiting for a separate migration project.

    The program targets the certificate layer

    Post-quantum TLS requires more than changing the key exchange used during a connection. Certificate signatures, issuance workflows, validation software and hardware security modules also need compatible algorithms and operational controls. Cloudflare said its authority will support standards-based certificates as browser and ecosystem requirements mature.

    The company already uses post-quantum key agreement on parts of its network, but a public certificate authority introduces a different trust role. Certificate issuance requires audited identity validation, key protection, revocation services, public logging and browser-root program acceptance.

    Deployment must follow ecosystem readiness

    Organizations should inventory certificate lifetimes, automation dependencies, TLS inspection devices and embedded clients before adopting new signature schemes. Larger keys and signatures can affect constrained devices and network paths. Hybrid testing and rollback plans remain essential while standards and client support evolve. SectechMedia follows related controls in its cybersecurity coverage.

    Sources

  • Mercury Survey Finds Wider Cybersecurity Gaps in Physical Access Controllers

    Mercury Survey Finds Wider Cybersecurity Gaps in Physical Access Controllers

    A new Mercury Security survey indicates that cybersecurity requirements are outpacing parts of the installed physical access control controller base. The company’s 2026 Trends in Access Controllers Report surveyed 561 physical security and cybersecurity professionals, including administrators, integrators, installers and end users.

    Reported cybersecurity gaps increased year over year

    Thirty-two percent of respondents said cybersecurity features were missing from their current controller systems, compared with 21% in the 2025 survey. Mercury also reported that 74% found coordination between cybersecurity and IT more difficult to manage, even as 86% said their organizations work to keep pace with changing security and data-protection requirements.

    Interoperability remained central to purchasing decisions. Sixty-nine percent described it as critical, while 82% considered backward and forward compatibility important to future planning. Interest in cloud connectivity also exceeded deployment: 56% cited it as a purchase consideration, but 41% reported cloud-enabled controllers.

    Modernization needs verifiable controls

    Survey results describe respondent perceptions rather than an independent audit of installed systems. Even so, they reinforce the need to verify secure boot, encrypted communications, credential protection, patch support, logging and network segmentation during controller selection. SectechMedia follows related architecture in its access control and identity coverage.

    Sources

  • OpenSSL Patches High-Severity DTLS Flaw That Can Expose Server Memory

    OpenSSL Patches High-Severity DTLS Flaw That Can Expose Server Memory

    The OpenSSL project has fixed a high-severity vulnerability in its Datagram Transport Layer Security implementation that can disclose portions of server memory. CVE-2026-84782 affects applications using DTLS listening functionality and may expose data before a peer has been authenticated.

    An invalid cookie could trigger an oversized response

    According to the project advisory, a server processing a malformed ClientHello with an invalid cookie could calculate the length of its HelloVerifyRequest incorrectly. The resulting message could include uninitialized heap memory and transmit it without encryption. OpenSSL said the issue primarily affects DTLS servers built around BIO_s_datagram and DTLSv1_listen.

    The project released corrected versions across supported branches, including OpenSSL 3.0.22, 3.3.7, 3.4.5, 3.5.5 and 3.6.1. Distribution advisories from Ubuntu and Debian provide package-level guidance for affected systems.

    Operators need an application-level inventory

    Teams should identify services that actually use DTLS server-listening functions, not assume every installed OpenSSL package has the same exposure. Internet-facing gateways, communications systems and embedded services deserve priority. After upgrading, operators should restart dependent processes and verify the loaded library version. SectechMedia follows related risks in its cybersecurity coverage.

    Sources

  • Pentagon Personnel Agency Data Breach Exposes Records of About Three Million People

    Pentagon Personnel Agency Data Breach Exposes Records of About Three Million People

    The US Defense Manpower Data Center has begun notifying people that unauthorized users accessed files containing personal information on one of its file-sharing servers. Reporting based on the agency’s notification and a Defense Department official places the affected population at roughly three million living and deceased individuals.

    The exposed server held unencrypted personnel data

    The notification says a vulnerability discovered on July 16, 2026 allowed unauthorized access to files. Investigators found that a small number of users had accessed the server between October 2025 and discovery. The center patched the file-sharing system and restored service after identifying the weakness.

    Records varied by person and could include names, Social Security numbers, dates of birth, contact details, demographic information and military occupational specialties. The agency said it had not identified misuse when notices were issued.

    Long exposure windows increase investigation demands

    Incident teams must determine which files were reached, which identities were exposed and whether access persisted across credential or server changes. Sensitive government repositories require encryption, least privilege and alerting on abnormal file access. SectechMedia follows related controls in its cybersecurity coverage.

    Sources

  • Microsoft Says Star Blizzard Used Fake Event Invitations to Deliver CosmicPulse Backdoor

    Microsoft Says Star Blizzard Used Fake Event Invitations to Deliver CosmicPulse Backdoor

    Microsoft Threat Intelligence says the Russia-linked actor Star Blizzard has refined its phishing and malware delivery operations with a technique the company calls RedFlick. The group used fake invitations and follow-up correspondence to persuade selected targets to open password-protected archives that ultimately installed a backdoor named CosmicPulse.

    The campaign blended social engineering with scheduled execution

    Microsoft identified at least 13 larger campaigns during 2026, in addition to more narrowly targeted activity. The emails impersonated recognized organizations and event hosts, while compromised WordPress and cPanel webmail accounts helped make messages appear more credible. The archive password was presented separately, encouraging recipients to treat the file as protected material.

    After execution, RedFlick used scheduled tasks to establish persistence and launch CosmicPulse. Microsoft said the activity focused heavily on organizations and individuals connected to Ukraine, policy research and international affairs.

    Defenders should investigate the conversation, not only the attachment

    Security teams should review multi-message exchanges, unusual password-protected archives and new scheduled tasks together. Compromised third-party mailboxes can defeat simple sender-reputation checks, so identity telemetry and endpoint evidence remain essential. SectechMedia tracks related campaigns in its cybersecurity coverage.

    Sources

  • Signal Expands End-to-End Encrypted Backups Across Mobile and Desktop Platforms

    Signal Expands End-to-End Encrypted Backups Across Mobile and Desktop Platforms

    Signal has expanded its encrypted backup system across Android, iOS, Linux, macOS and Windows. The update adds on-device backups to iOS and desktop clients, aligns local backups around a cross-platform format and improves restoration when users move between operating systems.

    Users can choose hosted or self-managed storage

    On-device backups preserve an end-to-end encrypted copy at a destination selected by the user, such as local storage or a network-attached device. Signal now stores media separately from the main archive and avoids duplicate local copies, reducing the storage needed for recurring snapshots.

    The hosted service remains optional. Signal says its paid tier can hold up to 100 gigabytes of media, while the free plan retains text and a limited period of media. A supplemental key stored in a trusted execution environment rotates daily, but restoration still requires the user’s recovery key.

    Recovery keys become a high-value security asset

    Organizations and individual users should protect backup recovery keys separately from devices and cloud accounts. Backup policies must also consider disappearing messages, endpoint compromise and recovery testing. SectechMedia tracks related identity and communications controls in its cybersecurity coverage.

    Sources

  • Custom ChatGPTs Used in ClickFix Campaign to Deploy Remote Access Malware

    Custom ChatGPTs Used in ClickFix Campaign to Deploy Remote Access Malware

    Threat researchers at Huntress have documented a campaign that abused custom ChatGPT configurations and sponsored search results to steer users toward ClickFix pages. The pages presented a fake verification step and instructed visitors to run PowerShell commands that installed remote access malware.

    Legitimate platforms supplied credibility to the lure

    The malicious GPTs were hosted on the legitimate ChatGPT domain and directed users to a backup page on Google Sites. That page imitated a Cloudflare check, then supplied a command that downloaded an MSI package. The installation chain used a signed application and a modified DLL to load the payload.

    Huntress said the remote access trojan supported desktop control, audio and camera capture, file searches, host reconnaissance and delivery of additional payloads. Persistence relied on a registry Run key and a scheduled task.

    AI-hosted instructions require the same scrutiny as email links

    Organizations should block untrusted command execution, monitor suspicious PowerShell and investigate signed binaries loading unexpected DLLs. Search advertisements and AI-hosted guidance should not be treated as trusted software support. Administrators should also review published custom assistants and remove unapproved models from enterprise workflows. SectechMedia follows related risks in its cybersecurity coverage.

    Sources

  • ANSSI Finds Stolen Passwords and Monitoring Gaps Behind French Tax Data Theft

    ANSSI Finds Stolen Passwords and Monitoring Gaps Behind French Tax Data Theft

    France’s national cybersecurity agency ANSSI has published its investigation into cyberattacks affecting the country’s tax administration, the DGFiP. The agency found that attackers used legitimate staff credentials and exploited weaknesses in authentication, network architecture and monitoring to reach sensitive systems and remove data.

    Valid accounts reduced the attacker’s visibility

    ANSSI traced unauthorized activity between May and August 2026 across the tax portal and a separate land-registry environment. Credentials had been exposed after use on unmanaged personal devices, while some access portals lacked strong authentication. Sensitive applications were also reachable through government network paths without sufficient segmentation.

    The report says neither DGFiP monitoring nor ANSSI’s network sensors detected the two data-exfiltration waves. One portal used by the attacker was not monitored, application logs were unavailable to ANSSI and suspicious signals were not correlated across systems.

    Session control and application telemetry are central

    The case shows why password resets must revoke active sessions across every connected portal. Public-sector operators should combine phishing-resistant authentication, application-level logging, data-volume alerts and segmentation between agencies. Retrospective searches should also connect identity, application and network evidence across administrative boundaries. SectechMedia follows related controls in its cyber-physical security coverage.

    Sources