We’re Tracking the Future of Security

Category: Cyber-Physical Security

Coverage of the convergence between IT/cybersecurity and physical security systems, including networked device risk, secure system integration and unified threat response.

  • 153 Million Driver’s License Scans Offered on Dark Web, Likely Tied to IDScan.net

    153 Million Driver’s License Scans Offered on Dark Web, Likely Tied to IDScan.net

    A threat actor began offering digital scans of more than 153 million U.S. and Canadian driver’s licenses on the dark web this week, in what investigative journalist Brian Krebs has linked to a likely breach at identity-verification firm IDScan.net.

    A Large, Verified Identity Document Cache

    The documents surfaced on an identity-theft service called Nexus, while a threat actor simultaneously promoted the same data on a Russian-language cybercrime forum, claiming to hold identification documents for more than 170 million individuals. According to Krebs, a blank search on Nexus returned approximately 153 million driver’s license results, of which only around 1.1 million were Canadian, alongside more than 10 million identification cards, over 3 million travel documents and international IDs, and roughly 580,000 medical cards.

    Krebs reported that after confirming his own driver’s license, and those of other individuals, appeared on the platform, he concluded the documents were likely siphoned from IDScan.net, a Louisiana-based identity-verification provider whose services include ID fraud prevention, access management, age verification, ID-activated door locks and mobile ID scanners. The company says it performs more than 21 million verifications per month across more than 20,000 locations for clients spanning automotive, banking, gaming, education, transportation, hospitality, law enforcement, retail and security industries.

    FBI Investigation and Shutdown

    The Nexus platform was taken offline shortly after Krebs published his findings. Separately, the FBI opened an investigation into the suspected IDScan breach after determining that some of the exposed driver’s licenses belonged to its own agents. IDScan.net had not issued a public statement on the incident as of this writing.

    What Organizations Should Take From It

    NCC Group senior adviser Tim Rawlins said the incident underscores that identity systems should be designed on the assumption that identity evidence will eventually be compromised. “A genuine-looking document cannot remain sufficient proof of identity indefinitely,” Rawlins said, adding that organizations should inventory what identity data they hold, establish clear retention and deletion policies, and set contractual requirements with identity vendors covering logging, data segregation, incident notification and independent assurance. He also recommended monitoring for abnormal bulk access to identity systems, including unusual service-account and API activity.

  • HPE Patches Over 150 Flaws in Aruba AOS-CX Switches, Including Critical RCE Bugs

    HPE Patches Over 150 Flaws in Aruba AOS-CX Switches, Including Critical RCE Bugs

    Hewlett Packard Enterprise has released patches addressing more than 150 vulnerabilities in ArubaOS-CX (AOS-CX), the operating system used across its Aruba Networking enterprise switch line, including a group of critical-severity remote-code-execution flaws.

    A Critical Flaw Affecting Unauthenticated Attackers

    According to HPE’s advisory, nearly two dozen individual issues are tracked collectively under CVE-2026-73749, which carries a CVSS score of 9.8. The flaws stem from improper processing of malformed input sent to an unnamed service within AOS-CX, HPE’s database-centric switch operating system. HPE says an unauthenticated attacker could exploit the defects by sending specially crafted packets to the vulnerable service, achieving remote code execution with elevated privileges.

    The updates, released for AOS-CX versions 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190 and 10.10.1181, also resolve 22 high-severity vulnerabilities that could enable denial-of-service conditions, additional remote code execution, arbitrary command execution, cross-site scripting, authentication bypass, privilege escalation and information disclosure. Eleven remaining medium-severity issues cover access-control bypass, information disclosure, arbitrary file reads, denial-of-service and privilege escalation.

    No Known Exploitation, but Broad Exposure

    HPE says the majority of the vulnerabilities were found internally by its own security team and that it is not aware of any of them being exploited in the wild. As an interim mitigation, the company recommends restricting AOS-CX command-line and web-based management interfaces to a dedicated Layer 2 segment or VLAN, controlling access with firewall policies at Layer 3 and above, and maintaining accounting controls to track and log user activity and resource usage.

    Because AOS-CX switches sit at the network layer beneath cameras, access-control panels and other connected security devices in many enterprise deployments, unpatched management-interface exposure on this class of device can translate into risk for physical security systems that depend on the same network fabric, underscoring why prompt patching of core switching infrastructure matters beyond the IT network itself.

  • ‘StyleSmuggler’ Zero-Day Exploited to Backdoor Adobe Commerce and Magento Stores

    ‘StyleSmuggler’ Zero-Day Exploited to Backdoor Adobe Commerce and Magento Stores

    Threat actors are actively exploiting a zero-day vulnerability in Adobe Commerce and Magento to plant backdoors on online stores, according to research from cybersecurity firm Sansec. The flaw, which Sansec has named StyleSmuggler, affects Magento versions 2.4.7, 2.4.8 and 2.4.9, including stores already running the July and August 2026 security patches.

    How the Attack Works

    StyleSmuggler lets attackers inject PHP code into Magento’s template system by abusing the platform’s “styles” properties, evading detection in the process. Sansec describes a two-stage attack: the malicious code is first injected by generating a payment failure report, and Magento then executes that code when it sends out its standard “Payment Transaction Failed Reminder” email. No user interaction is required for the exploit to succeed.

    Once triggered, the exploit deploys a backdoor written in Rust that connects to a command-and-control server and waits for further instructions. Sansec says the malware disguises its C&C communication as NTP server replies and transmits host information, including an agent ID, hostname, username, memory and disk usage, operating system version, uptime, root-access status and the implant’s version, along with the store’s public IP address.

    Timeline and Detection

    Sansec says it first found the campaign on Sept. 4 at 22:40 UTC and reproduced the exploit chain on clean installations within hours. The initial backdoor disguised itself as a process named “kworker/u:8:0”; a second variant that emerged on Sept. 6 disguises itself as “fc-cache.”

    Because the exploit abuses a legitimate Magento email notification, Sansec recommends store operators watch for unexpected bursts of payment-failure reminder emails as a detection signal, while cautioning that legitimate declined payments can trigger the same notification. Adobe was expected to ship its regular monthly Patch Tuesday updates on Sept. 8, but as of this writing it was unclear whether that release would address StyleSmuggler specifically.

  • North Korean Hackers Deploy Stealthy Linux Backdoor Hidden Inside HAProxy

    North Korean Hackers Deploy Stealthy Linux Backdoor Hidden Inside HAProxy

    A North Korea-aligned threat actor has been using a new Linux-based espionage toolkit to target automotive and media organizations in South Korea, according to research published by Rapid7. The framework is designed for long-term, stealthy surveillance rather than smash-and-grab data theft.

    A Backdoor Compiled Into the Load Balancer Itself

    At the center of the toolkit is a custom HAProxy plugin the researchers call the “ted” backdoor, compiled directly into a HAProxy 2.8.12 instance running in the victim’s environment. Rather than running as a separate malicious process, it hooks into HAProxy’s native filter API, internal memory pools, event scheduler and HTTP parser, letting it intercept and inject traffic while genuine load-balancing operations continue normally, which helps it evade routine monitoring.

    The broader framework also includes trojanized versions of common Linux utilities, including agetty, atd, crond, polkitd and sshd, along with a curl-based remote access tool the researchers call CurlRAT and an SSH keylogger that doubles as a staging server. CurlRAT polls its command-and-control server roughly every 12 hours and can decrypt and execute stored commands, write new configuration payloads to disk, or spawn a full interactive shell.

    Initial Access and Attribution

    Rapid7 says the attackers first gained access to an edge server by exploiting a vulnerability in a groupware login portal, then used the SSH keylogger to harvest credentials for lateral movement into internal systems. Once installed, the ted backdoor let attackers redirect or serve malicious content to selected visitors browsing through the compromised load balancer, using low-cost commodity domains designed to blend in with legitimate traffic, in one case mimicking a Naver static-content domain.

    Rapid7 says the toolkit has likely been in use since late 2024, based on the release date of the first HAProxy version it was compiled against. Attack infrastructure and techniques observed overlap with watering-hole methods previously used by APT37 and Lazarus, and the campaign’s timeframe overlaps with Operation SyncHole, a watering-hole campaign against South Korean firms attributed to Lazarus in 2025 — pointing toward a North Korean state-linked actor, though Rapid7 stops short of formal attribution to a specific named group.

  • Researcher ‘Nightmare Eclipse’ Drops Three Zero-Day Exploits for CrowdStrike, Nvidia and Avast

    Researcher ‘Nightmare Eclipse’ Drops Three Zero-Day Exploits for CrowdStrike, Nvidia and Avast

    A security researcher who goes by the handle Nightmare Eclipse, also known as Chaotic Eclipse, Infinite Nightmare and MSNightmare, published three new zero-day proof-of-concept exploits within a single week, targeting security and driver software from Avast, CrowdStrike and Nvidia.

    Three Exploits, Three Vendors

    The first, dubbed PrettyPrague, targets the sandbox used by Avast Antivirus to spawn a shell with full system privileges, and the researcher says it may also affect other GenDigital products, including AVG and Norton. A GenDigital spokesperson told SecurityWeek the company was made aware of the issue, initiated its security response procedures, and has fixed it.

    The second, FalconFlank, exploits a bug in the Office malicious-macro remediation feature of CrowdStrike Falcon Sensor to escalate privileges. CrowdStrike said it is actively investigating the claims and has advised customers to disable a related Windows policy setting while pointing to guidance in its support portal.

    The third, GreenSection, targets an out-of-bounds memory write affecting a shared global memory section used by multiple Nvidia user-mode display driver components on Windows. Nvidia said it is reviewing the reported behavior through its established security processes.

    Part of a Broader Pattern

    Nightmare Eclipse became known for a series of zero-day exploits targeting Microsoft products before expanding to other vendors. In late August, the researcher released a separate privilege-escalation zero-day affecting a Kaspersky endpoint security product, which Kaspersky patched on Aug. 31. Independent security researcher Kevin Beaumont said he had confirmed that the Avast, CrowdStrike and Kaspersky exploits work as described.

    None of the three latest exploits are confirmed to grant SYSTEM-level access on their own; each requires local code execution as a starting point and functions as a privilege-escalation primitive rather than a full remote compromise chain. All three vendors said they are investigating or have already issued fixes.

  • CISA Flags Active Exploitation of LiteLLM and Starlette Flaws in First AI-Heavy KEV Batch

    CISA Flags Active Exploitation of LiteLLM and Starlette Flaws in First AI-Heavy KEV Batch

    The Cybersecurity and Infrastructure Security Agency added seven vulnerabilities to its Known Exploited Vulnerabilities catalog on Sept. 2, 2026, based on evidence of active exploitation. Three of the seven affect artificial intelligence and machine learning infrastructure — the first KEV batch in which AI-related components make up nearly half the additions.

    Authentication Bypass in a Widely Used AI Gateway

    The most significant of the AI-related entries is CVE-2026-59822, an improper-authentication flaw in LiteLLM, an open-source proxy server that routes calls to large language model APIs. According to the National Vulnerability Database, versions of LiteLLM prior to 1.84.0 allowed an unauthenticated attacker to submit a fabricated bearer token to the product’s Model Context Protocol Streamable HTTP endpoint, triggering an OAuth2 fallback path that granted access without a valid key. The flaw is fixed in version 1.84.0 and carries a CVSS score of 8.8.

    CISA also added CVE-2026-48710, an HTTP request/response smuggling vulnerability in the Starlette web framework that underlies the popular FastAPI toolkit used to build many AI agent and API services. Because Starlette typically ships as a transitive dependency of FastAPI rather than a direct one, researchers tracking the issue note it rarely appears in software inventories, making dependency lockfile scanning the more reliable way to detect exposure. A third AI-adjacent flaw affects JFrog Artifactory, a package repository manager widely used in AI development pipelines to store and distribute models and dependencies.

    Agentic Infrastructure Becomes a Target

    Security researchers at Microsoft and Wiz say the exploitation activity reflects a broader shift toward targeting AI infrastructure components — including LLM gateways, vector databases and MCP servers — to steal API keys, gain backend access, and monetize compromised hosts, in some cases through cryptocurrency mining.

    Under Binding Operational Directive 26-04, federal civilian agencies must remediate most of the newly added vulnerabilities by Sept. 5, 2026, while the Starlette and LiteLLM flaws carry a Sept. 16, 2026 deadline. CISA continues to recommend that all organizations, not just federal agencies, prioritize patching KEV Catalog entries as part of routine vulnerability management.

  • Maximum-Severity SAP Commerce Cloud Flaw Targeted Days After Patch

    Maximum-Severity SAP Commerce Cloud Flaw Targeted Days After Patch

    A maximum-severity vulnerability in SAP Commerce Cloud is facing active exploitation attempts, according to threat intelligence firm Defused and reporting by Cybersecurity Dive and The Hacker News, only days after SAP issued a fix.

    A Default-Authentication Bypass Rated CVSS 10.0

    The flaw, tracked as CVE-2026-58231, is described by SAP and CVE.org as an improper authorization issue in the Commerce Cloud Data Hub Adapter that allows an unauthenticated attacker to abuse a default authentication client and submit crafted input to functions that lack sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, according to CVE.org’s description, affecting confidentiality, integrity and availability. SAP Commerce Cloud is an enterprise e-commerce platform widely used by retailers to run online storefronts.

    From Patch to Exploitation in Days

    SAP shipped the fix, detailed in Security Note 3771065, as part of its August 2026 Security Patch Day on August 11, 2026. Defused CEO Simo Kohonen told Cybersecurity Dive that the firm’s honeypots began recording exploitation activity just three days after the patch was released, and that, as of the firm’s report, only one threat actor appeared to have attempted exploitation, suggesting the activity is not yet widespread. Defused said no proof-of-concept had circulated publicly before this exploitation was observed.

    Why It Matters

    No specific breached retailer had been publicly confirmed as of the most recent reporting; coverage has focused on exploitation attempts and defensive urgency. Prior SAP vulnerabilities, including CVE-2025-31324 in NetWeaver, have previously been weaponized by China-nexus espionage groups and ransomware actors such as BianLian and RansomExx, according to The Hacker News, underscoring the importance of applying SAP’s patch immediately rather than waiting for a confirmed incident.

  • Thomson Reuters Court Software Breach May Have Exposed SSNs and Sealed Records

    Thomson Reuters Court Software Breach May Have Exposed SSNs and Sealed Records

    Thomson Reuters disclosed on September 2, 2026 that an unauthorized party obtained files from C-Track, the court case management platform sold by its West Publishing Corporation unit, in an intrusion the company says occurred in March 2026, according to Thomson Reuters’ own disclosure and reporting by Reuters and The Hacker News.

    Scope: 11 States, the U.S. Virgin Islands and Ontario

    West Publishing said it discovered the unauthorized activity on June 30, 2026 and notified affected courts and Ontario’s Ministry of the Attorney General between July 23 and July 27. According to the company’s notice, a subset of affected court records could contain individuals’ names, Social Security numbers, driver’s license numbers, dates of birth, medical information and health insurance information. Some states reported that only backup data was involved, while Ohio said its production platform was accessed; Montana and Minnesota said court documents themselves were not part of the accessed data, though the vendor’s notice indicates sealed material may have been affected for certain courts.

    Coordinated, Delayed Public Disclosure

    Public disclosure came more than two months after the affected courts and Ontario were notified. Montana officials said the September 2 disclosure date was chosen so that the vendor and the various affected states could issue simultaneous announcements. Thomson Reuters said it has found no evidence to date that the exposed data has been misused.

    Why It Matters

    Court case management platforms sit at a sensitive intersection of physical and information security: they hold sealed records, victim and witness information, and identity data whose exposure carries legal as well as privacy consequences. The incident underscores the exposure created by shared third-party software used across many independent government bodies, where a single vendor compromise can cascade into simultaneous notifications across multiple jurisdictions.

  • Maximum-Severity SonicWall SMA 1000 Flaws Under Active Exploitation, CISA Warns

    Maximum-Severity SonicWall SMA 1000 Flaws Under Active Exploitation, CISA Warns

    SonicWall disclosed on September 1, 2026 that two vulnerabilities in its SMA 1000 series secure remote access appliances are being actively exploited in the wild, according to the vendor’s own advisory, SNWLID-2026-0016, and confirmed by CISA, Rapid7 and Qualys Threat Protect.

    A Chainable Path to Unauthenticated RCE

    The more severe flaw, CVE-2026-83548, is a pre-authentication server-side request forgery (SSRF) vulnerability in the SMA 1000 Appliance Work Place interface, carrying the maximum possible CVSS score of 10.0. According to SonicWall’s advisory, an unintended alternate access path causes the appliance to act as an unintended forward proxy, letting a remote unauthenticated attacker reach sensitive functionality. Rapid7’s analysis found that this SSRF flaw can be chained with a second, high-severity OS command injection vulnerability in the Appliance Management Console, CVE-2026-83549, which normally requires authenticated administrator access, to achieve full unauthenticated remote code execution.

    Federal Deadline and Wide Exposure

    CISA added the flaw to its Known Exploited Vulnerabilities catalog and set a September 5, 2026 remediation deadline for federal civilian agencies. SonicWall SMA 1000 appliances are widely deployed as VPN and zero-trust access gateways by large enterprises, government agencies and managed service providers, making the appliance an attractive target given the level of internal network access it typically brokers.

    Response

    SonicWall has released a hotfix addressing CVE-2026-83548; the company states no workaround is available for organizations that cannot immediately patch. Security researchers recommend organizations apply the hotfix without delay, review SMA 1000 logs for signs of the unauthorized proxy behavior described in the advisory, and treat any indicators of compromise found before the patch was applied as a potential breach requiring further investigation.

  • UK Aviation Cyber Assessment Finds Suppliers Are the Sector’s Weakest Link

    UK Aviation Cyber Assessment Finds Suppliers Are the Sector’s Weakest Link

    A new assessment of UK aviation’s external cyber exposure has found that third-party suppliers, not airport operators, account for the overwhelming majority of the sector’s cyber security weaknesses, according to research firm MyDomainRisk and coverage published by International Airport Review on September 3, 2026.

    Scanning 43 Operators and 51 Suppliers From the Outside

    MyDomainRisk said it examined the public web estate of 43 UK airport operators, covering 54 airports, alongside 51 organizations those airports depend on, using only externally visible, unauthenticated scanning. The firm emphasized that no airport operational technology, air-traffic, airline, baggage-handling or screening system was accessed or tested as part of the work; the scope was limited to what is visible to anyone on the public internet.

    Exposure Is Concentrated in the Supply Chain

    Of 1,152 exposed employee credential records identified across both groups, only 10 belonged to airport operators, according to MyDomainRisk; the remainder sat with suppliers, which also accounted for three leak-site mentions. Ground-operations providers were flagged as the weakest supplier class, with the firm reporting that 92 percent of staff-credential exposure across the study sits within three airside supplier categories. Gabriel Higgins, writing for International Airport Review, said suppliers’ average security posture score badly trailed that of the operators they serve.

    The One Place Airports Underperform

    The assessment identified a single measure where airport operators scored worse than their suppliers: email authentication. Seventeen of the 43 airport operators studied, or 40 percent, cannot instruct receiving mail systems to reject an email forged in their name, according to the research. Higgins quoted the study’s author describing this as both one of the sector’s simplest fixes and one of its most consequential, since an airport’s own domain is a far more attractive identity for attackers to spoof than that of a lesser-known supplier.