We’re Tracking the Future of Security

Category: News

Current, event-driven reporting, announcements and industry developments.

  • NIOSH Report Details Toxic Exposure During Electric-Vehicle Battery Fire

    NIOSH Report Details Toxic Exposure During Electric-Vehicle Battery Fire

    A new National Institute for Occupational Safety and Health investigation examines an electric-vehicle fire in California where firefighters experienced symptoms after exposure to smoke and vapors from a lithium-ion battery thermal-runaway event. The report reconstructs the response and identifies lessons for respiratory protection, hazard control and post-incident monitoring.

    Battery events can remain hazardous after visible flames

    The incident involved an electric vehicle whose battery continued to produce heat and toxic products as cells failed. NIOSH’s analysis highlights the need to treat the atmosphere around a damaged high-voltage battery as potentially hazardous throughout suppression, overhaul, towing and storage. A decline in visible fire does not by itself establish that respiratory risk has ended.

    Fire departments also need clear coordination with towing operators, hazardous-material teams and medical personnel. The handoff should document battery condition, isolation distances, re-ignition indicators and exposure concerns for everyone who may approach the vehicle later.

    Respiratory protection needs objective release criteria

    Departments should maintain self-contained breathing apparatus until monitoring and incident conditions support a documented transition. Training should cover thermal runaway, decontamination, symptom reporting and delayed medical evaluation. SectechMedia tracks related systems and operational controls in its fire and life-safety coverage.

    Sources

  • Research Finds Data Exposure Across More Than 16,000 Supabase Databases

    Research Finds Data Exposure Across More Than 16,000 Supabase Databases

    UpGuard researchers say they identified more than 16,000 Supabase databases with publicly readable tables that exposed personal information, passwords, authentication tokens or other application data. The findings point to recurring configuration failures in projects built on the popular backend platform rather than a single breach of Supabase itself.

    Client-side keys can expose weak access controls

    Supabase applications commonly include a public anonymous key so browsers and mobile clients can reach approved data. Security depends on row-level security policies and database permissions limiting what that key can retrieve. The research found applications where those controls were absent or incomplete, allowing unauthenticated queries to return sensitive records.

    UpGuard linked the scale of exposure partly to rapid application development and AI-assisted coding, where teams may deploy a functional backend before validating authorization rules. The affected applications covered multiple sectors and data types, so risk must be assessed project by project.

    Testing should use an external attacker view

    Developers should inventory Supabase projects, enable row-level security and test every exposed table with the same anonymous credentials shipped to clients. Secrets should never be stored in readable application tables, and exposed tokens must be revoked rather than merely hidden. SectechMedia follows cloud and application risk in its cybersecurity coverage.

    Sources

  • Single Malformed Packet Can Crash TDengine Industrial Database Servers

    Single Malformed Packet Can Crash TDengine Industrial Database Servers

    Security researchers have disclosed a pre-authentication vulnerability in TDengine that can allow an unauthenticated attacker to crash the time-series database with a single malformed packet. The issue, tracked as CVE-2026-42542, is relevant to industrial, energy, IoT, building-automation and connected-vehicle environments that rely on continuous telemetry.

    The flaw targets an operational data layer

    Ridge Security says the weakness occurs while the server processes network data before authentication. A specially formed packet can trigger an integer-underflow condition and terminate the database process. Even without data theft or code execution, repeated crashes can disrupt dashboards, alarms, analytics and other services that depend on current time-series data.

    Industrial databases are often treated as internal infrastructure, but remote access paths, flat networks and exposed management services can make them reachable from less trusted zones. Availability loss can also obstruct operators during a separate physical or cyber incident.

    Segmentation and recovery testing matter

    Asset owners should identify TDengine deployments, review vendor remediation guidance and restrict database ports to necessary systems. Monitoring should alert on repeated process termination and abnormal packets, while recovery exercises should verify that dependent applications reconnect safely. SectechMedia covers related controls in its OT and cyber-physical security coverage.

    Sources

  • Microsoft Details NeedyMantis Malware Used for Long-Term Network Access

    Microsoft Details NeedyMantis Malware Used for Long-Term Network Access

    Microsoft Threat Intelligence has documented a post-compromise malware family named NeedyMantis that attackers have used to preserve long-term access inside selected organizations. The activity has affected a small number of telecommunications providers, universities, medical nonprofits, intergovernmental bodies and government contractors.

    The malware supports modular follow-on activity

    Microsoft says NeedyMantis has been observed since at least 2023 and is deployed after an attacker already gains entry. Its components can collect system information, execute commands and maintain communications that support later objectives. That role makes the malware a persistence and operational-access tool rather than the initial intrusion vector.

    The reported targeting spans sectors with valuable communications, research and policy data. Defenders therefore need to investigate how the first compromise occurred while also searching for the malware’s artifacts, related credentials and lateral movement across the environment.

    Removal requires more than deleting a payload

    Incident responders should scope affected identities, scheduled tasks, services and remote-management paths, then rotate credentials from a known-clean system. Historical endpoint and network telemetry can help establish dwell time and identify systems that no longer show an active implant. SectechMedia follows related defense measures in its cybersecurity coverage.

    Sources

  • Apple Patches CoreGraphics Zero-Day Used in Targeted Attacks

    Apple Patches CoreGraphics Zero-Day Used in Targeted Attacks

    Apple has released security updates for older iPhone, iPad and Mac software branches to address a CoreGraphics vulnerability that the company says may have been exploited in an extremely sophisticated attack against specific individuals. The issue is tracked as CVE-2026-86950 and affects image-processing code used across Apple platforms.

    A crafted file could trigger code execution

    Apple describes the vulnerability as an out-of-bounds write in CoreGraphics. Processing a maliciously crafted file could lead to arbitrary code execution. The company credited Google Threat Analysis Group researchers Benoît Sevens and Clément Lecigne with reporting the issue, a detail consistent with the warning that exploitation was targeted rather than broadly opportunistic.

    The fixes were issued for iOS and iPadOS 26.7.1 and supported macOS releases, including Tahoe 26.7.1 and Sequoia 15.8.1. Organizations should verify device eligibility and deployment status rather than assume older managed endpoints received an update automatically.

    Image parsers remain a high-risk boundary

    Security teams should prioritize the updates for users exposed to untrusted documents, messaging attachments and web content. Mobile-device and endpoint management reports should be checked for installation failures and unsupported hardware. SectechMedia tracks related patching and endpoint risks in its cyber-physical security coverage.

    Sources

  • Honeywell OT Benchmark Finds Asset Visibility Lagging Security Confidence

    Honeywell OT Benchmark Finds Asset Visibility Lagging Security Confidence

    A Honeywell benchmark survey has found a gap between industrial organizations’ confidence in their operational-technology cybersecurity programs and the asset records and monitoring controls they report having in place. Security Today published the findings on September 28.

    Complete inventories remain uncommon

    The report surveyed more than 600 leaders responsible for cybersecurity risk, compliance or operations across energy, oil and gas, healthcare, maritime and manufacturing. Security Today reported that 88% described their programs as mature, while 21% said they maintained complete OT asset records.

    Only one-third of surveyed organizations reported complete OT integration with centralized security operations centers. Continuous oversight of connected cameras, sensors and other IoT devices was less common, illustrating how physical and operational technology can remain outside enterprise monitoring.

    Confidence should be tested against evidence

    Self-assessed maturity is useful only when it is supported by current inventories, documented ownership, network visibility and tested incident procedures. Unknown engineering workstations, unmanaged remote links and unsupported controllers can undermine segmentation and response even when governance frameworks appear complete.

    Operators can begin by reconciling discovery data with approved asset registers, assigning a business owner to every device and recording software, support and recovery dependencies. The benchmark reinforces a recurring theme in Cyber-Physical Security: resilience depends on knowing which systems exist, how they communicate and which operational consequences follow when they fail.

    Sources

  • US Justice Department Selects ROC Platform for Digital Evidence and Video Analytics

    US Justice Department Selects ROC Platform for Digital Evidence and Video Analytics

    The US Department of Justice has selected ROC technology to support a digital-evidence review platform used in federal criminal investigations, according to a September 28 report by Biometric Update. The contract combines evidence ingestion and review with facial recognition and other video-analytics capabilities.

    The platform is intended for mixed digital evidence

    The reported scope includes e-discovery material from sources such as mobile devices and social-media accounts. ROC is responsible for developing and supporting the platform used to ingest, review and analyze that information. The company describes the award as a one-year base contract followed by optional annual extensions.

    Biometric Update reported a guaranteed base value of $7 million and a possible value of $64.3 million if all options are exercised. Those optional years are not guaranteed spending and should not be treated as the current contract value.

    Evidence workflows require more than recognition software

    Large investigative systems need access controls, audit trails, retention rules, model-performance monitoring and reproducible evidence exports. Facial recognition can narrow review workloads, but candidate results require trained human assessment and documented handling rather than automatic identity conclusions.

    Procurement teams should also test image quality limits, demographic performance, false-positive handling and chain-of-custody controls before operational acceptance. The award sits at the intersection of Video Surveillance & Imaging and digital forensics, where analytics must preserve evidentiary integrity as well as search speed.

    Sources

  • US Lawmakers Reintroduce Federal Biometric Surveillance Moratorium Bill

    US Lawmakers Reintroduce Federal Biometric Surveillance Moratorium Bill

    US lawmakers have reintroduced legislation intended to restrict federal use of facial recognition and other biometric surveillance technologies. Senator Edward Markey announced the bill with Senator Jeff Merkley and Representatives Pramila Jayapal, Rashida Tlaib and Ayanna Pressley on September 25.

    The proposal covers multiple biometric modalities

    According to the sponsors and Biometric Update, the proposal would prevent federal agencies from using or acquiring facial recognition, voice recognition and other biometric surveillance systems without explicit congressional authorization. It also addresses access to biometric data held by state, local and private entities.

    The measure revives an earlier moratorium proposal with broader language. Supporters argue that federal use should pause until Congress establishes enforceable rules for civil rights, due process, transparency and oversight. The bill is a proposal rather than current law, and its provisions remain subject to the legislative process.

    Procurement teams face continuing policy uncertainty

    Public-sector security programs should distinguish technical capability from legal authority. Agencies considering biometric deployments need documented purpose, data retention rules, performance testing, human review and an appeal process, while suppliers must avoid presenting pilot results as universal accuracy guarantees.

    The debate also affects interoperability and lifecycle planning because restrictions can influence which databases, cameras and identity services may be connected. SectechMedia tracks these issues within Access Control & Identity, where privacy governance and operational performance need to be evaluated together.

    Sources

  • FBI and CISA Warn Critical Infrastructure Operators About ICS Integrator Access

    FBI and CISA Warn Critical Infrastructure Operators About ICS Integrator Access

    The FBI and the Cybersecurity and Infrastructure Security Agency issued guidance on September 23 about cybersecurity risks created when third-party industrial control system integrators receive access to critical-infrastructure environments. The agencies urged operators to treat integrator connections as governed, monitored access paths rather than permanent trusted links.

    A provider breach exposed customer information

    According to the guidance summarized by Security Today, a 2025 breach of a US industrial automation provider affected an organization serving power and transportation customers. Foreign actors searched the provider network for customer and supervisory control and data acquisition material, then placed hundreds of items into compressed archives.

    The episode illustrates how a compromise at one engineering or support company can create visibility into multiple operators. Drawings, device information and customer SCADA data can help attackers understand industrial environments even when they have not yet reached an operational network.

    Access should be limited and observable

    The agencies recommended limiting each integrator to the access required for its work, recording remote sessions and documenting supplied technology. Contracts should define cybersecurity obligations, while operators should maintain offline copies of software needed to run equipment and prepare for a provider becoming unavailable.

    Organizations should also review dormant accounts, shared credentials, remote-access gateways and support pathways after projects end. These controls align supplier governance with technical segmentation and operational resilience. The warning is especially relevant to SectechMedia readers responsible for Industrial Safety & Monitoring, where maintenance access can cross the boundary between business systems and essential processes.

    Sources

  • Carbonato Botnet Deploys Telegram-Controlled AI Agent on Exposed Docker Hosts

    Carbonato Botnet Deploys Telegram-Controlled AI Agent on Exposed Docker Hosts

    ThreatDown researchers have documented a botnet called Carbonato that targets Docker daemons exposed without authentication and deploys an open-source AI agent framework for operator-controlled activity. The research was first published on September 22, with additional technical reporting appearing on September 28.

    Exposed Docker APIs provide the entry point

    The operation searches for Docker services reachable on port 2375 without authentication. After finding one, the malware launches a privileged container, mounts the host filesystem and uses the container to execute commands on the underlying host. It then establishes persistence and scans nearby networks for more exposed daemons.

    ThreatDown traced the infrastructure through an unauthenticated registry that exposed repositories, image tags and configuration data. The researchers said the same environment supported a separate operation involving trojanized cryptocurrency wallet applications.

    Hermes Agent becomes the operator interface

    Carbonato installs Hermes Agent without modifying the framework itself, then replaces its persona file with instructions that prioritize persistence, command execution and credential collection. Operators submit tasks through Telegram, while the agent connects to a model gateway and converts those instructions into terminal activity.

    The research highlights a practical cloud-security failure rather than a novel Docker vulnerability: administrative APIs should not be directly exposed without authentication. Organizations can reduce risk by restricting daemon access, authenticating registries, reviewing privileged containers and monitoring for unexpected persistence. The incident adds another example to SectechMedia coverage of Cyber-Physical Security as AI tooling moves into real attack chains.

    Sources