We’re Tracking the Future of Security

Category: Cyber-Physical Security

Coverage of the convergence between IT/cybersecurity and physical security systems, including networked device risk, secure system integration and unified threat response.

  • CISA Flags Exploited FortiMail Zero-Day Requiring Urgent Mitigation

    CISA Flags Exploited FortiMail Zero-Day Requiring Urgent Mitigation

    CISA has added CVE-2026-104286, a critical FortiMail vulnerability, to its Known Exploited Vulnerabilities catalog. The October 1 action gives covered organizations an October 4 due date and calls for forensic triage alongside mitigation, reflecting confirmed exploitation rather than a theoretical risk.

    Affected FortiMail releases and exposure

    Fortinet assigns the flaw a CVSS score of 9.8 and describes it as an unauthenticated path-traversal and null-byte handling issue. According to its advisory, an attacker can use HTTP or HTTPS to write arbitrary files. The affected ranges are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9.

    Fixed builds were listed as upcoming when the advisory was issued. This creates an immediate operational decision for teams responsible for internet-facing mail infrastructure and the wider cyber-physical security environment: reduce reachable attack surface while also checking systems for evidence of compromise.

    Immediate defensive priorities

    Fortinet’s stated workaround is to disable IBE or restrict management access to a trusted private network. Administrators should follow the vendor’s current guidance, preserve relevant evidence from mail and management interfaces before making changes, and conduct the forensic triage requested by CISA. Because fixed builds had not yet been listed in the supplied advisory facts, teams should verify the latest vendor notice before making assumptions about patch availability. The watchTowr analysis offers additional technical context, but remediation decisions should remain anchored to current Fortinet and CISA instructions.

    Sources and further reading

  • Meari IoT Cloud Authorization Flaws Expose Device and Owner Data

    Meari IoT Cloud Authorization Flaws Expose Device and Owner Data

    CISA has warned about two missing-authorization vulnerabilities in the Meari IoT Cloud Platform OpenAPI. The flaws could let an authenticated user cross account boundaries, alter another owner’s device configuration or obtain sensitive device-shadow data.

    What an authenticated attacker could access

    CVE-2026-101104 concerns authorization checks around device configuration. CVE-2026-96613 affects access to the complete device shadow, which CISA says can include device credentials, owner information, network details and telemetry. The advisory lists a maximum CVSS v3 base score of 7.7 and marks all versions as affected.

    The issue is relevant to connected cameras and other cloud-managed devices because the cloud control plane often stores both operational state and credentials. CISA says it is not aware of public exploitation targeting these vulnerabilities.

    No vendor fix was available at publication

    CISA reports that Meari did not respond to coordination attempts and that no fix was planned when the advisory was released. Users are advised to contact the vendor for information. In the meantime, organizations should review whether affected devices are necessary, isolate them from sensitive networks and monitor cloud-account activity for unexpected configuration changes.

    Teams should also rotate exposed credentials where feasible, restrict who can access the management tenant and document an exit plan if risk cannot be reduced. SectechMedia’s video surveillance and imaging coverage explores security considerations for connected camera ecosystems.

    Sources

  • Johnson Controls Fixes Two EasyIO Neo Controller Security Flaws

    Johnson Controls Fixes Two EasyIO Neo Controller Security Flaws

    Johnson Controls has released updates for EasyIO Neo controllers after two security issues were documented in separate coordinated advisories. The vulnerabilities concern exposure of sensitive information and transmission of credentials or session information without adequate encryption.

    What the two advisories cover

    CVE-2026-64892 involves information that can be obtained through physical debugging interfaces. CISA gives it a maximum CVSS v3 base score of 3.5. CVE-2026-64893 addresses cleartext transmission of credentials and session data and carries a maximum CVSS v3 base score of 5.4.

    The affected devices are used in building-control environments, where controller credentials can provide a path into operational functions. CISA says it is not aware of public exploitation targeting either issue. Johnson Controls lists the related product advisories JCI-PSA-2026-20 and JCI-PSA-2026-30 on its security-advisory portal.

    Updates and compensating controls

    The vendor identifies EC version 3.3b64 and CW version 3.3b26 as fixed releases. For the network issue, operators should use HTTPS and disable HTTP where their deployment allows it. Physical access to debugging interfaces should also be restricted, with controller locations monitored as part of the site’s security plan.

    Before updating controllers, building operators should document current logic and configuration, confirm a rollback path and schedule functional testing. Network teams should check that management traffic stays on trusted segments. SectechMedia’s industrial safety and monitoring coverage includes further guidance for operational technology estates.

    Sources

  • ABB PCM600 Flaws Could Enable Privilege Escalation and File Overwrite

    ABB PCM600 Flaws Could Enable Privilege Escalation and File Overwrite

    ABB has addressed two vulnerabilities in PCM600, its protection and control engineering tool. CISA says the flaws could let a local attacker elevate privileges or cause project-archive files to be written outside the intended extraction directory.

    Two different local attack paths

    CVE-2026-15952 concerns permissions around a scheduler component running as LocalSystem. Under the conditions described by the advisory, a local user could exploit that arrangement to gain higher privileges. CVE-2026-15953 is a path-traversal issue in project archive handling that could place files beyond the selected extraction folder.

    CISA lists PCM600 versions through 2.14 as affected and gives the vulnerabilities a maximum CVSS v3 base score of 6.4. The agency says it is not aware of public exploitation. ABB has published product security advisories and provides workaround guidance for affected deployments.

    Why engineering workstations need special care

    PCM600 is used in energy-sector protection and control engineering. An engineering workstation can therefore hold trusted project files and privileged access to operational assets even when it is not directly exposed to the internet. Organizations should apply ABB’s guidance, limit local administrator rights and treat imported project archives as untrusted until validated.

    Before remediation, teams should back up projects and confirm recovery procedures. Afterward, review scheduled tasks, extraction directories and endpoint telemetry for unexpected files or privilege changes. SectechMedia’s energy-security coverage examines the wider operational context for protecting utility and industrial environments.

    Sources

  • CISA Details Critical Authentication Flaws in Monta EV Charging Platform

    CISA Details Critical Authentication Flaws in Monta EV Charging Platform

    CISA has disclosed four vulnerabilities affecting Monta’s electric-vehicle charging platform. The agency says the issues could allow unauthorized administrative actions or denial-of-service activity, making identity controls and session handling a priority for charging operators.

    Where the weaknesses appear

    The advisory identifies missing authentication and rate-limiting controls, weaknesses involving sessions, and the use of publicly accessible identifiers. CISA assigns the group a maximum CVSS v3 base score of 9.4 and lists monta.app as affected across all versions at the time of publication.

    The practical risk extends beyond a conventional web account. EV charging platforms coordinate users, chargers and operational services, so unauthorized administrative access can affect a distributed physical service. CISA says it is not aware of public exploitation targeting these vulnerabilities.

    Mitigation and operational checks

    Monta is working toward authenticated connections and says its platform supports OCPP 1.6 Security Profile 2. The company also applies throttling and rate limits. Operators should confirm which controls are active in their own tenant and charger estate instead of assuming that a supported feature is already enabled everywhere.

    Security teams should review privileged accounts, revoke stale sessions, monitor failed authentication patterns and segment charger-management services from unrelated business systems. Any configuration change should be tested against charger availability and field-support procedures. Related developments in connected transport can be followed through SectechMedia’s vehicle and transportation security coverage.

    Sources

  • CISA Warns Armatura One Flaws Could Expose Physical Access-Control Systems

    CISA Warns Armatura One Flaws Could Expose Physical Access-Control Systems

    The US Cybersecurity and Infrastructure Security Agency has published an advisory covering several vulnerabilities in Armatura One, a platform used to administer physical access-control systems. CISA says successful exploitation could expose database information, enable code execution or allow an attacker to take control of access-control functions.

    Affected versions and security impact

    The advisory covers Armatura One versions earlier than 4.7.2 and the US edition earlier than 4.6.1. The reported issues include embedded ActiveMQ vulnerability CVE-2023-46604 as well as four newly assigned CVEs affecting the platform. CISA lists a maximum CVSS v3 base score of 9.8.

    The agency notes that CVE-2023-46604 appears in its Known Exploited Vulnerabilities catalog because it has been used against other products. CISA says it is not aware of public exploitation specifically targeting Armatura One. That distinction matters: operators should treat the exposure seriously without assuming that every installation has already been compromised.

    What access-control operators should do

    Armatura recommends upgrading to version 4.7.2, or 4.6.1_USA for the US edition. Owners should first inventory management servers, restrict administrative interfaces to trusted networks and preserve configuration backups before changing production systems.

    Because the platform can influence doors and credentials, remediation should be coordinated with physical-security teams, not handled as an isolated IT patch. Administrators should also review service accounts, database access and logs for unexpected changes. SectechMedia’s access-control and identity coverage provides additional context for securing controller and credential-management environments.

    Sources

  • Google Rolls Out Gemini 4 Argon to Trusted Cyber Defenders

    Google Rolls Out Gemini 4 Argon to Trusted Cyber Defenders

    Google has announced Gemini 4 Argon, a model it is initially making available to selected cyber defenders through the company’s Fairwind Program. Google says the system is intended to help find, validate and patch software vulnerabilities.

    Access begins with a restricted defender program

    The company is not presenting the initial rollout as unrestricted public availability. Google says trusted participants may receive access tailored to defensive research, and that selected defenders could work with a version without the cyber guardrails applied in broader settings. Those statements describe Google’s access model and claimed capabilities; they are not independent proof of performance in every environment.

    Human validation remains necessary

    Security teams evaluating an AI-assisted research system should define test scope, protect sensitive code and credentials, and require reproducible evidence before accepting a reported vulnerability or patch. Suggested fixes still need code review, regression testing and deployment controls. Organizations should also document who can use less-restricted capabilities and how resulting artifacts are retained. Unsupported benchmark comparisons should not substitute for testing against an organization’s own applications and threat model. More AI-security developments are available in the SectechMedia Technology News archive.

    Sources

  • Sucuri Finds Self-Rebuilding WordPress Backdoor Across Files, Database and Memory

    Sucuri Finds Self-Rebuilding WordPress Backdoor Across Files, Database and Memory

    Sucuri researchers have documented a WordPress backdoor designed to rebuild itself when defenders remove only part of the infection. The company calls the malware SC and describes a mesh of cooperating components distributed across the site’s files, database and operating environment.

    Persistence extends beyond a single malicious file

    Sucuri said copies or recovery logic can reside in WordPress files, database options, archives, scheduled tasks and System V shared memory. A surviving component can restore removed pieces during a later request. The command mechanism also uses blockchain infrastructure, reducing its dependence on a conventional command domain that defenders could block or seize.

    Cleanup requires a full-system investigation

    Deleting one suspicious loader is unlikely to be sufficient. Responders should preserve evidence, enumerate web files and database options, inspect scheduled jobs and drop-ins, review memory-related artifacts where the platform permits it, and compare the installation with a trusted baseline. Credentials for WordPress, hosting, databases and deployment systems may also require rotation. Sites should be rebuilt from known-good components when integrity cannot be established. Further application-security reporting is available in the SectechMedia Technology News archive.

    Sources

  • Europol Seizes KillSec Ransomware Infrastructure in Operation KillSwitch

    Europol Seizes KillSec Ransomware Infrastructure in Operation KillSwitch

    Law-enforcement agencies have taken control of servers and a leak site associated with the KillSec ransomware operation in an action Europol called Operation KillSwitch. Europol said three suspects were arrested and that a 16-year-old was suspected of leading the group.

    Servers and leak infrastructure were seized

    The takedown occurred on September 30. Authorities said they secured at least 110 terabytes of data against further unauthorized publication. Taking control of leak infrastructure can interrupt extortion activity and preserve evidence, but it does not by itself prove that every affiliate, credential or victim-facing access path has been removed.

    Claims remain subject to judicial process

    The people identified in the investigation are suspects, not convicted offenders. Organizations previously affected by KillSec should preserve evidence, coordinate with the appropriate authorities and continue rotating credentials or rebuilding systems where incident-response findings require it. A public takedown should not be treated as a substitute for checking persistence, exposed data and third-party access. Security teams can follow additional law-enforcement and ransomware developments in the SectechMedia Technology News archive.

    Sources

  • Kiteworks Patches Maximum-Severity Email Protection Gateway Flaw

    Kiteworks Patches Maximum-Severity Email Protection Gateway Flaw

    Kiteworks has released security updates addressing 126 vulnerabilities, including a maximum-severity flaw in its Email Protection Gateway. The most serious issue, tracked as CVE-2026-54154, can enable remote code execution without authentication when several weaknesses are chained together.

    The attack path crosses multiple weaknesses

    According to the public reporting and CVE record, the chain combines path traversal, code injection and missing authentication. An attacker able to reach a vulnerable gateway could potentially execute code remotely. The risk is significant because email-security gateways commonly sit near an organization’s external boundary and may process untrusted content.

    Use the vendor’s release guidance

    Administrators should identify every deployed Email Protection Gateway, consult Kiteworks guidance for the applicable supported release and apply the prescribed fixes. The public sources reviewed for this report do not justify inventing affected or fixed version numbers. Teams should also restrict management exposure, review gateway logs for unexpected activity and verify that credentials or trust relationships available to the appliance cannot be used for lateral movement. Patch validation should include service health and security logging, not only a successful installation message. Additional vulnerability updates are tracked in the SectechMedia Technology News archive.

    Sources