We’re Tracking the Future of Security

Category: Cyber-Physical Security

Coverage of the convergence between IT/cybersecurity and physical security systems, including networked device risk, secure system integration and unified threat response.

  • Critical Flaw in Siemens Reyrolle Grid Protection Relays Allows Authentication Bypass

    Critical Flaw in Siemens Reyrolle Grid Protection Relays Allows Authentication Bypass

    CISA published an advisory disclosing 14 vulnerabilities in Siemens Reyrolle 7SR5 protection relays, devices used in electrical substations worldwide to detect faults and trigger circuit breakers. The most severe, CVE-2026-62645, carries a CVSS score of 9.8 out of 10 and stems from the relay’s web interface exposing information that lets an attacker calculate current and past session IDs — enough to bypass authentication entirely without any privileges or user interaction.

    The advisory also describes a related flaw allowing predictable session-ID generation from insufficient entropy, an out-of-bounds write reachable through crafted URLs that can force the device to reboot, and a physical-access vector that could allow unsigned code execution through a maintenance-mode key sequence. Siemens has released firmware version 2.70 to address the vulnerabilities; earlier versions remain exposed.

    Why it matters

    Protection relays are a core safety component of the electrical grid — an attacker who can bypass authentication on one gains the ability to interfere with fault detection and circuit-breaker operation, which is exactly the kind of access that grid-security planners worry about most.

    Sources

  • Wireless Mesh Networking for Security System Backhaul

    Wireless Mesh Networking for Security System Backhaul

    Not every security deployment has the luxury of a conduit run or existing fiber path. Large campuses, agricultural sites, construction projects, parking lots, and remote infrastructure locations often need to connect cameras, sensors, and access control points across distances or terrain where trenching cable is expensive, disruptive, or simply impossible on the project timeline. Wireless mesh networking has become one of the standard answers to this problem, offering a way to extend a security network’s reach without a continuous physical cable path.

    Point-to-Point, Point-to-Multipoint and True Mesh

    Wireless backhaul for security systems generally falls into three topologies. Point-to-point links connect two fixed locations directly, useful for bridging a single gap such as across a road or between two buildings. Point-to-multipoint extends one central node’s connectivity out to several remote locations, common when a single equipment room serves multiple outlying camera clusters. True mesh networking goes further: every node can relay traffic for its neighbors, and the network automatically recalculates routing paths if a node fails or a link degrades. This self-healing property makes mesh particularly attractive for large or irregularly shaped sites where a single point of failure in a point-to-multipoint design could take an entire branch of cameras offline.

    Bandwidth, Latency and Video Traffic

    Video is a demanding payload for wireless infrastructure. Unlike simple sensor telemetry, camera streams require sustained bandwidth and are sensitive to latency and jitter, particularly for live monitoring or analytics that depend on consistent frame delivery. Mesh network design for security applications has to account for the cumulative bandwidth each hop needs to carry as traffic aggregates back toward the wired network edge. Designers typically size wireless links with meaningful headroom above camera bitrate requirements, and may selectively favor point-to-point links for the highest-bandwidth camera clusters while reserving mesh for lower-bandwidth sensor and access control traffic.

    Spectrum, Interference and Environmental Factors

    Outdoor wireless security links operate in either licensed or unlicensed spectrum, each with trade-offs. Unlicensed bands are cheaper to deploy but share spectrum with other users and consumer devices, creating interference risk in dense environments. Licensed spectrum offers more predictable performance but adds cost and regulatory lead time. Weather, foliage growth, and physical line-of-sight obstructions all affect wireless link reliability over time in ways a buried cable simply doesn’t experience, which is why wireless security deployments typically include a maintenance plan for periodic link health verification rather than a one-time installation.

    Securing the Wireless Link Itself

    A wireless backhaul link is also a network attack surface that a buried cable is not. Security-grade wireless deployments use strong encryption on every hop, disable unnecessary management interfaces on outdoor radios, and monitor for rogue access points or unauthorized devices attempting to join the mesh. Because these radios are often physically accessible in a way core network switches are not, mounted on poles, roofs, or perimeter fencing, physical tamper resistance and secure mounting are treated as part of the cybersecurity posture, not just the mechanical installation.

    Where Mesh Makes Sense

    Wireless mesh is rarely the first choice when wired infrastructure is feasible; fiber and copper remain more predictable in bandwidth and less susceptible to environmental interference. Its value is clearest in scenarios where wired installation costs or timelines are prohibitive: temporary event security, construction sites with cameras that need to relocate as the project progresses, large agricultural or logistics yards, and remote infrastructure sites where trenching across the full distance simply isn’t economical relative to the value of the assets being monitored.

    Reference sources

  • Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Model Distillation Attacks Against Claude

    Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Model Distillation Attacks Against Claude

    Anthropic said it identified and disrupted industrial-scale “distillation” attacks against its Claude models originating from seven China-based AI labs, according to a threat intelligence report the company released on September 11, 2026, and covered by The Hacker News. The company named Alibaba, Moonshot AI, DeepSeek, Xiaomi and Zhipu, also known as Z.ai, among the labs involved, saying they routed user conversations through Claude and used its responses as training data to improve their own models in violation of Anthropic’s terms of service.

    Anthropic said the campaigns specifically targeted Claude’s most commercially valuable capabilities, including agentic reasoning, coding and tool use, and that some of the intercepted exchanges contained sensitive information belonging to individual users, multinational companies and state-affiliated actors. According to reporting on the report, Moonshot alone routed nearly 300,000 customer requests to Claude over a 10-day period through a network of more than 5,000 fraudulent accounts, with total distillation activity exceeding 23 million exchanges between May and July.

    Anthropic said labs used commercial proxy services and account networks to evade detection, allowing new fraudulent accounts to replace banned ones without interruption. The disclosure adds to a pattern of Western frontier labs publicly accusing competitors of extracting model capabilities without authorization, a dynamic that is intensifying as US and Chinese AI companies compete for enterprise and developer market share.

    Why it matters

    Routing third-party traffic through a commercial model’s API to harvest its outputs is itself a data-handling risk for the end users caught in the middle, since their prompts and outputs can transit infrastructure they never consented to; enterprises building on any AI API should ask vendors directly what abuse-detection and data-isolation controls apply to their traffic.

    Sources

  • Knightscope Debuts Full Autonomous Security Force Lineup at GSX 2026

    Knightscope Debuts Full Autonomous Security Force Lineup at GSX 2026

    Knightscope brought its full Autonomous Security Force lineup together under one roof for the first time this week at GSX 2026, the Global Security Exchange, at the Georgia World Congress Center in Atlanta. The Sunnyvale, California-based company’s booth displayed its K7 and K5 Autonomous Security Robots, the K1 Hemisphere, K1 Capsule and K1 Super Tower stationary units, a first public look at its H1 Augmented Security Agent prototype, and Signals, the company’s forthcoming command-and-control software platform.

    Alongside the live debut, Knightscope published “Human Capabilities,” the fifth in a series of field briefs describing its ASF-7 model, which pairs autonomous machines and software with licensed security agents employed directly by the company rather than through third-party staffing contractors. The company said its agents handle alert verification, executive protection, armed and unarmed security response, and de-escalation, according to the field brief.

    Knightscope said it currently serves 434 clients across 42 states, with its machines logging more than 4.4 million autonomous hours in the field. GSX 2026, which ran September 14-16, drew more than 14,000 security professionals, according to show organizers cited in the company’s announcement.

    Why it matters

    Knightscope’s move to combine hardware, software and directly-employed human responders under a single contract structure is a bet that integrated accountability, not just more autonomous hardware, is what will differentiate robotic security offerings going forward.

    Sources

  • Acronis Backup Plugins for cPanel and Plesk Carry Actively Exploited Privilege-Escalation Flaw

    Acronis Backup Plugins for cPanel and Plesk Carry Actively Exploited Privilege-Escalation Flaw

    Acronis has disclosed a high-severity local privilege-escalation vulnerability in its backup plugin for cPanel, WebHost Manager (WHM) and Plesk, warning that it has detected exploitation in the wild. The flaw, tracked as CVE-2026-87886, carries a CVSS severity score of 7.8 and allows a low-privileged attacker to increase their permission level on a vulnerable Linux server without user interaction, potentially enabling access to or modification of sensitive data, according to Acronis’s advisory.

    The plugins connect the widely used cPanel and Plesk hosting control panels to Acronis’s backup infrastructure, letting administrators back up and restore websites, databases, mailboxes and hosting accounts. Acronis said exploitation “has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments,” though it told BleepingComputer the assessment is based on a single report from a potentially affected customer.

    Affected versions include the Acronis Backup plugin for cPanel & WHM prior to build 1.9.3.1021, fixed in version 1.9.3 HF3, and the Acronis Backup extension for Plesk prior to build 1.8.11.638, fixed in version 1.8.11. Acronis is urging all users of the affected integrations to update immediately.

    Why it matters

    Backup plugins run with elevated privileges by design, which is exactly what makes a privilege-escalation flaw in one valuable to an attacker who already has limited server access; hosting operators should treat the patch as time-sensitive rather than routine.

    Sources

  • CISA Warns of Critical Flaws in Digital Watchdog VMAX Video Recorders

    CISA Warns of Critical Flaws in Digital Watchdog VMAX Video Recorders

    The Cybersecurity and Infrastructure Security Agency (CISA) published an advisory on September 15 detailing six vulnerabilities in Digital Watchdog’s VMAX A1 G4 and VMAX IP G4 digital and network video recorder lineups, including its VA1G4 and VG4 recorder models. According to CISA, successful exploitation could grant an attacker full administrative control of an affected device, enabling access to live and recorded surveillance footage, alteration of device configurations, and use of the recorder as a pivot point into a broader network.

    Two of the flaws, tracked as CVE-2026-66890 and CVE-2026-66887, received a CVSS v3.1 severity score of 9.6 out of 10, in the critical range. CISA said the issues include missing authentication for critical functions, use of hard-coded credentials, missing authorization checks on state-changing requests, and a predictable random-number generator used to create session tokens. The vulnerabilities were reported to CISA by researcher Scot Berner of TrustedSec.

    Digital Watchdog products are deployed worldwide across commercial facilities, government buildings, healthcare and transportation sites, according to CISA’s sector tagging. The company has released updated firmware addressing the vulnerabilities, available through its website, CISA said. The agency recommends isolating control system devices from the internet and placing them behind firewalls, and noted that no public exploitation of the flaws has been reported to date.

    Why it matters

    Recorders sit at the center of a facility’s video evidence chain; a fully compromised DVR/NVR can expose live and archived footage and serve as a foothold into the wider network. Operators running affected VMAX models should prioritize the firmware update and confirm the devices are not internet-exposed.

    Sources

  • Network Redundancy for IP Security Systems: Failover Without Blind Spots

    Network Redundancy for IP Security Systems: Failover Without Blind Spots

    IP cameras, access controllers, intercoms and analytics depend on the network as a shared transport layer. Redundancy can reduce a single point of failure, but duplicated hardware alone does not guarantee continuity. The design must define what service survives, how quickly it returns and what evidence exists after the switchover.

    Define the Required Service

    A camera may continue recording to local storage while live viewing is unavailable. A door controller may enforce cached permissions even when the central server is offline. Write resilience requirements in operational terms: recording continuity, alarm delivery, credential decisions, voice communication and investigation access.

    Map Failure Domains

    Two links routed through the same conduit are vulnerable to one cable cut. Two switches powered by the same unprotected circuit share an electrical failure. Trace power, fiber, copper, wireless backhaul, server, storage, DNS and identity dependencies to find common points that a simple network diagram may hide.

    Path and Device Redundancy

    Critical aggregation points may use diverse paths, resilient switching and redundant power. Servers and storage can use clustering or replicated services, but compatibility with the VMS or access-control platform must be tested. Avoid assuming that generic network failover automatically preserves application sessions or video streams.

    Edge Continuity

    Local camera recording and controller decision caches can bridge a central outage. Recovery behavior matters: the system should reconcile events and recordings without overwriting evidence or creating duplicate alarms. Monitor synchronization queues and storage capacity before an outage occurs.

    Test Degraded Modes

    Commissioning should disconnect links, stop services and remove power in controlled scenarios. Confirm what operators see, which alarms arrive and how recovery is logged. Planned tests often reveal slow routing convergence, missing licenses, certificate dependencies or manual steps that were absent from design documents.

    Practical Checklist

    • State which security functions must survive each failure.
    • Separate physical routes and power sources where required.
    • Verify edge recording and cached access decisions.
    • Monitor failover state and reconciliation queues.
    • Repeat tests after firmware, topology or platform changes.

    Conclusion

    Useful redundancy is measured by preserved security outcomes, not duplicated boxes. Mapping shared dependencies and testing real failure modes produces a system that degrades predictably instead of creating silent blind spots.

    Reference sources

  • Video Evidence Chain of Custody: Export, Hashing and Audit Trails

    Video Evidence Chain of Custody: Export, Hashing and Audit Trails

    Surveillance footage becomes evidence only when an organization can explain where it came from, how it was exported, who handled it and whether it changed. Image quality matters, but a clear chain of custody is what allows another person to evaluate the recording’s integrity and context.

    Preserve the Original Context

    Record the camera identifier, system name, location, requested time window and timezone. Note any known clock offset. Export enough time before and after the incident to show context, while preserving the original recording in the VMS according to retention policy and legal instructions.

    Use a Controlled Export Process

    Limit export privileges to authorized users and make the VMS audit their actions. Where possible, create both a native export with metadata and a standard playable copy for review. Native formats may preserve signatures, timestamps and camera information that a transcoded clip loses.

    Hashing and Integrity

    A cryptographic hash provides a repeatable fingerprint of a file. Calculate it when the export is created, record the algorithm and value, and verify it after copying or transfer. A matching hash supports file integrity; it does not by itself prove that the original camera view or system clock was accurate.

    Handling Log

    Maintain a log of every transfer, including date, person, purpose, source and destination. Use controlled storage with access records. Avoid passing the sole copy through consumer messaging services that may recompress video or remove metadata.

    Playback and Disclosure

    Include required player software or documented instructions for native files, and test the package on a separate workstation. Redact faces or private areas only in a derivative copy, preserving the unredacted original under appropriate controls. Document every transformation.

    Practical Checklist

    • Confirm camera, time window, timezone and clock offset.
    • Export native and review formats where appropriate.
    • Hash files at acquisition and after transfer.
    • Log custody, access and each derivative.
    • Test playback before releasing the package.

    Conclusion

    A chain of custody is a process, not a watermark. Consistent export records, integrity verification, controlled storage and documented derivatives make video easier to investigate and more defensible when decisions depend on it.

    Reference sources

  • PoE Power Budgeting for Security Cameras and Access Control

    PoE Power Budgeting for Security Cameras and Access Control

    Power over Ethernet simplifies security installations by carrying data and electrical power over the same structured cabling. Simplicity at the endpoint can hide a system-level constraint: the switch or injector still has a finite power budget, and the connected load changes with heaters, infrared illumination, motors and door hardware.

    Start With the Powered Device

    Use the manufacturer’s declared power class and maximum consumption for each camera, reader, intercom or controller. A camera that draws modest power in daylight may require more when infrared LEDs, a heater, a wiper or pan-tilt-zoom motors operate. Design against the credible maximum operating state, not the average shown on a quiet bench.

    Separate Port Capacity From Total Budget

    A switch can support a particular power level on an individual port while lacking enough total capacity to deliver that level on every port simultaneously. Add the endpoint requirements, reserve capacity for startup and future change, and check the power supply actually fitted to the switch. Modular switches may have different budgets depending on installed supplies.

    Cabling and Distance

    Voltage loss rises with cable resistance. Use compliant cabling, connectors and installation practice, especially for long outdoor runs or bundles exposed to heat. Extenders and intermediate devices add their own consumption and failure points. For distant perimeter equipment, local fiber plus a properly protected remote power source may be more resilient than stretching copper beyond its intended design.

    Backup Power Changes the Calculation

    If the security network must operate during a mains failure, the UPS has to support both network electronics and the PoE load. Runtime calculations should include worst-case device demand and conversion losses. Load-shedding priorities can preserve critical entrances and cameras while disabling lower-priority devices.

    Commissioning Tests

    • Verify negotiated power class and actual draw at each port.
    • Force night mode, heaters and moving mechanisms where practical.
    • Test restart behavior after a complete power interruption.
    • Confirm UPS runtime with the operational PoE load.
    • Set monitoring alerts for overload, port denial and supply failure.

    Conclusion

    PoE reliability depends on more than selecting a switch with enough ports. A defensible design matches endpoint maxima, total supply capacity, cable conditions and backup-power objectives so security devices remain available during the operating states that create the greatest demand.

    Reference sources

  • Time Synchronization in Physical Security Systems: Why NTP Matters

    Time Synchronization in Physical Security Systems: Why NTP Matters

    A camera records motion at 14:03, an access-control panel logs a door opening at 14:01, and an intrusion sensor reports an alarm at 14:05. If those clocks are drifting, investigators cannot reliably determine whether the events belong to one incident. Time synchronization is therefore a security control, not a cosmetic system setting.

    Why a Common Clock Matters

    Video, access, intrusion, intercom and building systems create separate event streams. A common time source allows a management platform to reconstruct sequence, correlate alarms and support an audit trail. NIST guidance on log management treats consistent timestamps as part of useful event records, while NTP is the widely deployed protocol for synchronizing networked clocks.

    Designing the Time Architecture

    Define approved time sources, then make intermediate servers or controllers distribute time to field devices. Avoid letting every camera or panel reach arbitrary internet servers. Critical sites may use redundant internal sources backed by a trusted external reference. Network rules should allow only the required protocol paths.

    Time Zones and Daylight Saving

    Store or correlate events in a stable reference such as UTC, while displaying local time to operators. Document how daylight-saving changes are handled. Otherwise, repeated or skipped local times can make exported evidence ambiguous.

    Drift and Failure Monitoring

    Synchronization can fail silently because of blocked traffic, configuration errors, expired credentials or a device reset. Monitor offset, source reachability and last successful synchronization. An alarm threshold should reflect the investigative needs of the site rather than an arbitrary universal value.

    Security Considerations

    A false time source can disrupt logs and certificate checks. Use authenticated mechanisms where supported, restrict management access and protect the authoritative servers. Record configuration changes so an investigator can establish whether a clock was trustworthy during an incident.

    Operational Checklist

    • Maintain an inventory of devices and their configured source.
    • Use redundant, monitored time servers for critical systems.
    • Test exported video and access reports for consistent timestamps.
    • Document UTC, local-time and daylight-saving behavior.
    • Include clock health in commissioning and maintenance.

    Conclusion

    Time synchronization turns isolated records into a defensible event sequence. Treating NTP architecture, clock monitoring and timezone handling as part of commissioning prevents avoidable uncertainty when operators and investigators need the record most.

    Reference sources