We’re Tracking the Future of Security

Category: Cyber-Physical Security

Coverage of the convergence between IT/cybersecurity and physical security systems, including networked device risk, secure system integration and unified threat response.

  • ServiceNow Patches Three Maximum-Severity Flaws That Allowed Unauthenticated Code Execution

    ServiceNow Patches Three Maximum-Severity Flaws That Allowed Unauthenticated Code Execution

    ServiceNow disclosed and patched three maximum-severity vulnerabilities in its Now Platform and AI Platform on August 28, 2026, each exploitable by an unauthenticated attacker with low complexity and no user interaction, according to the company’s own security advisories and reporting from BleepingComputer and The Hacker News.

    Two of the flaws, CVE-2026-18885 and CVE-2026-18886, are code-injection vulnerabilities in the ServiceNow AI Platform that could let an attacker execute arbitrary code, access or modify instance data beyond intended permissions, or escalate privileges. A third, CVE-2026-74820, is a SQL-injection flaw in the same platform that could allow an unauthenticated user to run arbitrary SQL statements against the underlying database and alter instance data. A separate, high-severity sandbox-escape bug, CVE-2026-6876, was disclosed alongside the three critical issues.

    No Confirmed Exploitation, but a Pattern of Prior Abuse

    ServiceNow said it is “not currently aware of malicious exploitation against ServiceNow instances” tied to the newly disclosed flaws. The company has hosted-instance customers already patched, while partners and self-hosted customers running on-premises deployments are responsible for applying fixes themselves across the affected Xanadu, Yokohama, Zurich, and Aspen release families.

    The disclosure follows a related ServiceNow flaw, CVE-2026-6875, that researchers confirmed was actively exploited in July 2026, and echoes a pattern from 2024 in which several ServiceNow vulnerabilities were chained together in attacks against government and private-sector targets. Given ServiceNow’s widespread use for enterprise workflow and identity-adjacent processes, security teams are advised to prioritize patching self-hosted instances even in the absence of confirmed in-the-wild exploitation.

  • Iran-Linked Hackers Disable UK Power Plant for Four Days as US Water Utilities Report Coordinated Attacks

    Iran-Linked Hackers Disable UK Power Plant for Four Days as US Water Utilities Report Coordinated Attacks

    A small power generation facility in the United Kingdom was disabled for four days after a suspected Iran-linked cyberattack, in a window that overlapped with a wider wave of intrusions against wastewater treatment plants across roughly a dozen US states, according to reporting from Security Affairs and The Register published August 23–24, 2026, citing UK government and industry sources.

    The UK facility, not named publicly for security reasons, was small enough that its outage did not affect the wider national power supply, and staff were able to restore operations without formal notification thresholds being triggered. A UK government source told reporters the plant fell below the legal reporting threshold for “important generators,” while the National Cyber Security Centre declined to comment on the specific incident. NCSC chief Richard Horne said in June that the agency had handled more than 200 attacks on UK critical national infrastructure over the preceding year.

    US Wastewater Plants Hit Across Multiple States

    In parallel, US authorities traced a separate series of intrusions affecting dozens of wastewater treatment facilities, with the earliest reports emerging from Minnesota on July 26 and subsequent incidents confirmed in Michigan, Georgia, South Dakota, New Jersey, and Alabama. Several affected utilities reported flooding and loss of water pressure, and some jurisdictions issued boil-water advisories as a precaution. The FBI has attributed the water-sector intrusions to “malicious cyber actors,” and US government sources cited by Security Affairs indicated the activity likely originated in Iran.

    Researchers characterize both incidents as capability demonstrations rather than attempts to cause lasting damage, consistent with a broader pattern of suspected Iranian probing reported in recent months against infrastructure operators in Germany, Poland, Finland, Belgium, and Albania. UK officials have said the activity has accelerated since February airstrikes involving the United States and Israel against Iranian targets.

    The incidents add to a year in which operational technology at water and wastewater facilities has faced sustained scrutiny, and follow a separate US executive action restricting foreign-made equipment in bulk-power systems over cybersecurity concerns.

  • Securing the Video Surveillance Network: Camera and VMS Cybersecurity Hardening

    Securing the Video Surveillance Network: Camera and VMS Cybersecurity Hardening

    A video surveillance deployment is, from a network architecture standpoint, a fleet of embedded computers with microphones and lenses attached. Every IP camera runs firmware, exposes management interfaces, and communicates over the network with a video management system (VMS) that itself typically runs on general-purpose server infrastructure. That reality has made surveillance infrastructure an increasingly attractive target: camera botnets, credential-stuffing campaigns against exposed device management ports, and compromises of large fleets of network video recorders have all been documented by security researchers in recent years, with campaigns targeting tens of thousands of devices at a time through weak default credentials, unpatched authentication bypasses, and exposed peer-to-peer discovery services.

    Where the Attack Surface Actually Lives

    Camera and VMS security incidents tend to cluster around a small number of recurring weaknesses:

    • Default and weak credentials. Cameras and NVRs shipped with default administrative passwords, or deployed without forcing a credential change during commissioning, remain one of the most common initial-access vectors documented in mass-compromise campaigns.
    • Exposed management interfaces. Web-based camera configuration portals and VMS admin consoles left reachable from the public internet — whether through direct exposure or through port-forwarding and peer-to-peer relay services intended to simplify remote viewing — substantially expand the attack surface beyond what a properly segmented deployment would allow.
    • Unpatched firmware and software. Camera firmware and VMS platforms both accumulate disclosed vulnerabilities over their service life; devices that are difficult to patch at scale, or that are past vendor support, accumulate risk the longer they remain in service.
    • Flat network architecture. Surveillance devices placed on the same network segment as general IT infrastructure, without VLAN segmentation or firewall rules restricting camera-to-camera and camera-to-internet traffic, allow a single compromised device to become a pivot point into the broader network.

    Baseline Hardening Practices

    Network Segmentation

    Placing surveillance devices on a dedicated VLAN, with firewall rules limiting traffic to only the VMS server and required management systems, is widely regarded as the single highest-value control. Properly segmented deployments prevent a compromised camera from being used as a stepping stone to reach payroll systems, building automation, or other unrelated infrastructure.

    Credential and Access Management

    Forcing unique, strong credentials at commissioning, disabling unused default accounts, and integrating camera and VMS authentication with centralized identity management where supported all reduce the practical value of credential-based attacks. Multi-factor authentication on VMS administrative accounts is increasingly treated as a baseline expectation rather than an optional enhancement.

    Patch and Lifecycle Management

    Maintaining an inventory of camera models, firmware versions and support end-dates allows security teams to prioritize patching and plan replacement of end-of-life devices before they become the weakest link in the deployment. Vendor security advisories should be monitored on an ongoing basis, not just at initial deployment.

    Disabling Unnecessary Services

    Many cameras ship with peer-to-peer discovery, UPnP, and remote-access features enabled by default to simplify consumer setup. In enterprise deployments, these services are frequently unnecessary and expand the attack surface without a corresponding operational benefit; disabling them where not explicitly required is standard hardening guidance.

    FAQ

    Are IP cameras less secure than older analog systems?

    Not inherently — but IP cameras carry cybersecurity risks that analog systems did not, because they are addressable network devices. The security question is less about IP versus analog and more about whether the network deployment follows segmentation, credential and patch-management practices appropriate to a networked device fleet.

    Who is responsible for camera cybersecurity in most organizations?

    This varies significantly. In organizations where physical security and IT/cybersecurity functions remain siloed, camera and VMS hardening can fall into a gap between the two teams. Organizations further along in cyber-physical convergence typically assign shared or explicit ownership of surveillance-network security to avoid this gap.

    Conclusion

    Video surveillance infrastructure has moved from being a passive physical-security tool to being an active part of the enterprise attack surface. Treating cameras and VMS platforms with the same network segmentation, credential hygiene and patch discipline applied to other networked IT assets — rather than as a separate, lower-scrutiny category — is now a baseline expectation for any organization operating surveillance infrastructure at scale.

  • Iranian State-Backed Nimbus Manticore Expands Toolset With New Backdoor and SSH Tunneler

    Iranian State-Backed Nimbus Manticore Expands Toolset With New Backdoor and SSH Tunneler

    Cybersecurity researchers at Group-IB have identified additional operational infrastructure and previously undocumented malware associated with Nimbus Manticore, an Iranian state-sponsored hacking group affiliated with the Islamic Revolutionary Guard Corps. In an analysis published August 26, 2026, and reported the same day by The Hacker News, Group-IB described the group as among the most active Iranian advanced persistent threat actors of 2026.

    Nimbus Manticore — also tracked as GalaxyGato, Mirage Kitten, Screening Serpens, Smoke Sandstorm, Subtle Snail, and UNC1549 — is assessed by Group-IB to be linked to the Tortoiseshell cluster (also known as Imperial Kitten and Unyielding Wasp), itself part of the broader Charming Kitten activity cluster. The group has a documented history of using social-engineering campaigns, including fake recruitment and “Dream Job” lures, to deliver malware to targets in aerospace, defense, IT services, and telecommunications.

    New Backdoor and Tunneling Infrastructure Found Across Two Regions

    Group-IB researchers Mansour Alhmoud and Mohamed Emam identified a C++ backdoor with characteristics similar to the group’s existing TWOSTROKE implant, along with an SSH-based tunneling utility, deployed across newly discovered infrastructure spanning both Europe and the Middle East. “The discovered Tortoiseshell infrastructure potentially suggests an expanded targeting profile, focusing on Middle Eastern countries, alongside European countries,” the researchers wrote.

    The findings follow earlier reporting on the group’s NightLedger backdoor and custom WebSocket tunnelers, which Group-IB said have been used to turn compromised systems into covert network relays capable of executing commands, uploading files, and capturing screenshots while tunneling traffic through victim networks. Group-IB said the continued development of new tools alongside the expanding infrastructure footprint “demonstrates a threat actor that is steadily evolving its toolset and adapting its techniques to maintain access across a growing number of targets.”

    Organizations in the aerospace, defense, telecommunications, and critical-infrastructure-adjacent sectors that operate in Europe or the Middle East are advised to review indicators associated with the Tortoiseshell/Nimbus Manticore cluster as part of routine threat-intelligence monitoring.

  • Critical cPanel Flaw Could Let a Hosting Customer Take Root Control of a Whole Server

    Critical cPanel Flaw Could Let a Hosting Customer Take Root Control of a Whole Server

    cPanel published a security advisory on August 27, 2026, disclosing a critical vulnerability in the domain-parking and addon-domain functionality of cPanel & WHM. Tracked as CVE-2026-65643, the flaw allows an authenticated account holder with permission to add parked or addon domains to create arbitrary files on the server, which can ultimately be abused to achieve code execution as the root user.

    According to cPanel’s own advisory, successful exploitation “leads to code execution as the root user, giving an attacker full control of the server and every account, website, and database on it.” The vulnerability affects all currently supported versions of cPanel & WHM. Patched versions are 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2, and WP2 build 11.138.1.7 or later; servers running end-of-life cPanel releases must first upgrade to a supported version before they can receive the fix.

    Particularly Severe for Shared and Multi-Tenant Hosting

    Security researchers covering the disclosure noted that the flaw’s impact is amplified in shared-hosting environments, where a single low-privilege tenant account with domain-management permissions could serve as a stepping stone to compromising every other customer hosted on the same server — including the ability to deploy persistent backdoors, alter website content, exfiltrate databases, and manipulate server configuration across multiple unrelated hosted accounts.

    cPanel has not disclosed evidence of active exploitation, and as of the August 27, 2026 update to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog, CVE-2026-65643 was not listed. The advisory also carries no published CVSS score; as of August 28, 2026, the CVE Program’s own record store had not yet published a formal record for the vulnerability, even though two unrelated cPanel plugin flaws disclosed on July 31 already had entries at the time of the check.

    Given how widely cPanel is deployed across web and hosting infrastructure, administrators are advised to prioritize the update, particularly on multi-tenant servers where the domain-parking feature is exposed to lower-trust account holders.

  • McKesson Confirms Cyberattack as ShinyHunters Claims Theft of 284 Million Patient Records

    McKesson Confirms Cyberattack as ShinyHunters Claims Theft of 284 Million Patient Records

    McKesson Corporation, the pharmaceutical distributor that moves roughly a third of prescription drugs sold in the United States, confirmed on August 28, 2026, that it suffered a cybersecurity incident involving unauthorized access to third-party applications. In a Form 8-K filed with the U.S. Securities and Exchange Commission, McKesson said it discovered the incident on August 25, 2026, and that its investigation “remains in the early stages,” with updates being posted to the company’s website.

    Hours after McKesson’s disclosure, the extortion group ShinyHunters told BleepingComputer it had exfiltrated approximately one terabyte of data from the company’s Salesforce and Snowflake environments over a four-day window between August 21 and August 25, 2026. According to the group, initial access came through vishing attacks that compromised multiple employees’ Okta single sign-on accounts, which were then used to reach the Salesforce and Snowflake platforms.

    ShinyHunters claimed the stolen data includes roughly 284 million patient-related records, and said it contacted McKesson after completing the theft to demand a ransom of $55,236,150, giving the company 72 hours to respond. The group said McKesson did not negotiate or respond to the demand.

    Part of a Broader Pattern Targeting Healthcare and SaaS Platforms

    The McKesson incident is the latest in an ongoing wave of data-theft attacks attributed to ShinyHunters against healthcare and health-technology organizations, several of which have involved compromised third-party SaaS and cloud-data platforms rather than direct breaches of core clinical systems. As with earlier incidents in this pattern, the exposure risk here centers on identity providers and cloud data warehouses that sit adjacent to, but outside, an organization’s primary operational infrastructure — a distinction that matters for how healthcare and pharmaceutical enterprises prioritize identity security and third-party risk monitoring alongside traditional network defenses.

    McKesson has not confirmed the scope of data exposed or verified ShinyHunters’ record-count claim. The company said additional updates would be provided as the investigation progresses.

  • Cosmos EVM Flaw Drains $5.72 Million From Six Blockchains After Patch Shipped Without a Security Advisory

    Cosmos EVM Flaw Drains $5.72 Million From Six Blockchains After Patch Shipped Without a Security Advisory

    Cosmos Labs disclosed in a post-mortem published August 28, 2026 that a critical balance-handling flaw in the shared Cosmos EVM module, used by more than 115 known public blockchains, was exploited on six chains between August 20 and August 25, 2026, draining roughly $5.72 million in assets, according to the company’s writeup and reporting by The Hacker News. The vulnerability allowed an attacker to manipulate token balances through a supply-overflow condition on older chain versions and a type-conversion issue on newer ones, both exploitable within a single transaction carrying a net supply change of zero.

    According to The Hacker News, a fix for the flaw was made public in May 2026 but was not distributed as a security release until August 19, and the release notes for the patched versions did not disclose that they contained a security fix. Cosmos Labs has said it does not maintain a complete registry of the networks running its software, meaning some chain operators may not have known a security-relevant update was available. Attackers moved roughly $2.87 million of the stolen funds through decentralized exchanges and an estimated $2.85 million through centralized exchanges, whose accounts have reportedly been frozen pending investigation.

    The incident highlights a recurring weakness in open-source infrastructure that underlies widely used platforms: a patch is only protective if downstream operators know it addresses a security issue, and shared modules used across dozens of independently operated networks can leave a long window of exposure when disclosure practices lag behind development timelines. Cosmos Labs has since urged all EVM chains running unpatched versions to halt operations until they upgrade.

  • Attackers Chain Two PaperCut Flaws to Achieve Unauthenticated Remote Code Execution

    Attackers Chain Two PaperCut Flaws to Achieve Unauthenticated Remote Code Execution

    Malicious actors are exploiting a newly patched vulnerability in PaperCut NG and PaperCut MF print management software to execute arbitrary code on affected servers, according to research from Huntress and reporting by The Hacker News. PaperCut released an emergency fix with additional hardening after the flaw, which does not yet have an assigned CVE identifier, was found being exploited in the wild.

    Huntress researchers John Hammond and Andrew Brandt said the vulnerability gives an unauthenticated attacker remote control over PaperCut’s trusted configuration, which can be used to execute arbitrary Java code inside the application’s process. The flaw stems from how PaperCut’s authorization check handles a specifically crafted request: an attacker can reference one page that gets rendered in the response while a different page actually owns the component or action being executed, allowing the authorization check to trust the rendered page and miss the permission requirements tied to the executed action.

    PaperCut print management software is widely deployed across schools, government agencies, healthcare systems and corporate print environments, making unauthenticated remote code execution a significant exposure wherever an instance is reachable from an untrusted network. Organizations running PaperCut NG or MF are advised to apply the emergency patch immediately and review Huntress’s indicators for signs of prior exploitation.

  • Google Rolls Out Encrypted Client Hello on Android 17 to Hide Browsing Destinations From Networks

    Google Rolls Out Encrypted Client Hello on Android 17 to Hide Browsing Destinations From Networks

    Google said this week that Android 17 now supports Encrypted Client Hello (ECH), a privacy standard that prevents internet service providers and other network operators from seeing which websites and apps a device is connecting to, according to a security post published by Google and its Jigsaw team. Google described the rollout as the first broad deployment of ECH on a major mobile operating system.

    ECH works alongside private DNS to encrypt the hostname sent during the initial stage of a TLS connection, a field historically visible in plaintext even over otherwise-encrypted HTTPS connections and commonly used by networks to profile which sites and services a user visits. With ECH enabled, network providers can see only which content delivery network is handling a connection and how much data is moving, not the specific destination site, for websites and apps that support the standard. Google said Android 17 also adds Local Network Protection, requiring apps to obtain permission before scanning for or connecting to devices on a user’s local network, along with mandatory Certificate Transparency logging for website certificates.

    For organizations managing mobile device fleets, wider ECH adoption reduces the effectiveness of network-level traffic analysis as a security and monitoring technique, since enterprise security tools that rely on inspecting destination hostnames at the network layer will see less metadata for ECH-enabled connections. Google said Android app developers should upgrade to OkHttp 5.5.0 and enable ECH support to take advantage of the new protection.

  • Berlin State Government Refuses to Pay Extortionists After State Network Breach

    Berlin State Government Refuses to Pay Extortionists After State Network Breach

    Berlin’s state government confirmed on August 28, 2026 that it is the target of an extortion attempt following the compromise of the city-state’s administrative network earlier in August, and said it will not meet the attackers’ demands, according to a Senate Chancellery statement and reporting by The Hacker News. The same statement disclosed that forensic investigators had found further data outflows tied to the Senate Department for Mobility, Transport, Climate Protection and Environment, with exfiltration dated between August 7 and August 12, 2026.

    The Senate Chancellery said the affected department first reported an outflow on August 7 and was cut off from the network on August 14, seven days later. Berlin has not published a figure for how much data left the network; the only itemized account in circulation is from the attackers’ own leak-site post, indexed on August 28. The Chancellery said personal or other non-public data cannot be excluded from what was taken, and that the scope and content of the breach are still being examined.

    Refusing extortion demands after a confirmed government network breach carries operational risk if attackers publish or sell stolen data, but security officials increasingly favor the approach to avoid funding further attacks and to preserve credibility with other public bodies watching how governments respond. The case adds Berlin to a growing list of European state and municipal governments that have had to publicly navigate ransomware extortion decisions on live, unresolved incidents this year.