We’re Tracking the Future of Security

Category: Cyber-Physical Security

Coverage of the convergence between IT/cybersecurity and physical security systems, including networked device risk, secure system integration and unified threat response.

  • ATF Confirms Data Breach After Ransomware Group Claims Access to Investigation Data

    ATF Confirms Data Breach After Ransomware Group Claims Access to Investigation Data

    The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has confirmed a cyberattack affected a system containing information about the targets of its investigations, following claims by a ransomware group that it had gained access to the agency’s data, Reuters reported.

    What’s New

    According to court documents and public reporting, the ransomware group gained access to a computer system holding information related to ATF investigative targets. The agency confirmed the breach but has not disclosed the full scope of the data involved or attributed the intrusion to a specific threat actor.

    Why It Matters

    A breach touching active investigation data raises risks beyond typical data-exposure incidents, potentially compromising ongoing law enforcement operations and the safety of investigative targets and personnel if the information is misused or leaked. The incident adds to a string of confirmed breaches at U.S. federal agencies this year and comes weeks after the Justice Department and FBI moved to disrupt state-sponsored hacking infrastructure targeting other parts of the federal government.

  • Australian Police Charge Two Men Over TeamPCP Hacking Group Linked to Open-Source Supply Chain Breaches

    Australian Police Charge Two Men Over TeamPCP Hacking Group Linked to Open-Source Supply Chain Breaches

    The Australian Federal Police, working with the FBI and the Western Australia Police Force, arrested and charged two Perth-area men on August 26, 2026 over their alleged roles in TeamPCP, a cybercrime group blamed for a string of high-profile breaches this year. Louis Michael Gaebler, 23, of Mandurah, and Ruben Ian Thomson, 21, of Cottesloe, appeared in Perth Magistrates Court on August 27 facing a combined 14 charges, according to the AFP and reporting from TechCrunch, The Hacker News and Help Net Security.

    Investigators allege the pair were principal participants in a syndicate that planted malicious code in popular open-source software projects, which was then unwittingly incorporated by developers and organizations worldwide, according to the AFP statement cited by ABC News Australia. The Hacker News reported that TeamPCP has been tied to the March 2026 compromise of the open-source security scanners Trivy and Checkmarx KICS, as well as the AI gateway LiteLLM, while TechCrunch reported the group has also been blamed for hacks affecting Mercor and OpenAI.

    According to Help Net Security’s account of the charges, the Cottesloe man faces eight offenses including possessing and supplying data for use in computer offenses, unauthorized modification of data, failing to comply with a data-access order, and dealing with proceeds of crime worth more than AU$100,000; the maximum penalties involved range from three to twenty years’ imprisonment. Investigators searched properties in Cottesloe, Hamilton Hill and Mandurah, seizing electronic devices now undergoing forensic examination.

    The AFP said the investigation began in April 2026 after it and the FBI received tips about a syndicate inserting malicious code into open-source packages used by other developers, and that “further arrests and charges have not been ruled out” as the forensic review of seized data continues, per SecurityWeek’s reporting.

    The case highlights the continuing risk that open-source software supply chains pose as a vector for widescale compromise: a single tampered dependency or scanning tool can propagate into the environments of every organization that pulls it into a build pipeline, a dynamic security teams have increasingly had to account for in software composition analysis and dependency-vetting programs.

  • Johnson Controls Metasys Building Automation Platform Patches Persistent XSS Vulnerability

    Johnson Controls Metasys Building Automation Platform Patches Persistent XSS Vulnerability

    Crafted URL Can Hijack Administrator Sessions

    CISA published ICS advisory ICSA-26-225-14 on August 13, 2026, disclosing a cross-site scripting vulnerability in Johnson Controls Metasys, a building automation and management platform used across critical manufacturing, commercial facilities, government facilities, transportation systems and energy sites worldwide. Tracked as CVE-2026-34491 and rated CWE-79, the flaw carries a CVSS v3 base score of 8.0.

    According to CISA, a low-privilege user can inject a malicious payload into the Metasys web interface through a crafted URL. The payload persists across logins and executes in the browser context of other users who view the affected page, including administrators, which could lead to session hijacking and unauthorized access to building systems. The advisory lists Metasys 12 and 13 as affected in all versions, and Metasys 14 before v14.1.5 and Metasys 15 before v15.0.1.

    Mitigation

    Johnson Controls has released patched versions for the affected Metasys 14 and 15 branches and published mitigation guidance for the platform. CISA recommends operators apply the available updates, restrict Metasys web interface access to trusted networks, and follow standard input-validation and session-management hardening for building management system deployments.

    Sources

  • Siemens Patches Critical Remote Code Execution Flaw in Siveillance Video Management Servers

    Siemens Patches Critical Remote Code Execution Flaw in Siveillance Video Management Servers

    Command Injection Rated Critical

    CISA published ICS advisory ICSA-26-225-09 on August 13, 2026, describing a critical vulnerability in Siemens Siveillance Video, a video management platform deployed worldwide across the critical manufacturing, communications and commercial facilities sectors. Tracked as CVE-2026-3014 and rated CWE-78 (OS Command Injection), the flaw affects Siveillance Video V2023 R3 versions before 23.3.27, V2024 R1 versions before 24.1.16, and V2025 versions before 25.1.15, with a CVSS v3 base score of 9.1.

    According to the advisory, a user with edit permissions on the Management Server can exploit the flaw to execute arbitrary code in the context of the Management Server service, which could allow an attacker to take control of connected video management infrastructure.

    Updates Available for All Affected Branches

    Siemens has released fixed versions for each affected release branch: V23.3 HotfixRev27 or later, V24.1 HotfixRev16 or later, and the V25.1.15 update for the 2025 branch. CISA and Siemens recommend that operators update to the corrected versions as soon as practical and, in line with general ICS hardening guidance, restrict Management Server edit permissions to trusted administrators and segment video management infrastructure from untrusted networks.

    Sources

  • UK and Ukraine Sign AI Defense Partnership Granting Access to Ukraine’s Avengers AI Labs

    UK and Ukraine Sign AI Defense Partnership Granting Access to Ukraine’s Avengers AI Labs

    Britain and Ukraine signed a partnership in Kyiv on Monday, August 24, 2026, to jointly develop artificial intelligence tools for defense and security, with the UK becoming the first international partner granted access to Ukraine’s Avengers AI Labs battlefield-data platform, according to Reuters and a UK government statement.

    A Battlefield Dataset Built From Ukraine’s War

    UK Prime Minister Andy Burnham and Ukrainian President Volodymyr Zelenskyy signed the agreement, which the UK government describes as part of the two countries’ “100 Year Partnership.” Avengers AI Labs is built around an annotated dataset of roughly 5 million battlefield images, according to Ukraine’s Defence Ministry, drawn largely from the DELTA combat management and situational-awareness system. The platform aggregates data from cameras and sensors deployed across Ukraine’s front lines, capturing tanks, artillery, air-defense systems, infantry and aerial targets including Shahed drones and reconnaissance UAVs, which is used to train AI models that the UK government says currently identify a majority of targets in real time.

    Under the deal, Britain will in turn back Ukraine with access to its universities, researchers and technology companies, which the UK government describes as the world’s third-largest AI ecosystem. The agreement initially focuses on defense and national-security applications, bringing together engineers, academics, businesses and military operational experts from both countries.

    Fiber-Optic Sensing and Low-Power AI Chips Among First Pilot Projects

    Three British startups — Bristol-based Sintela, Oxford-based Mind Foundry, and London-based Skyral — are involved in the initial pilot projects announced alongside the partnership. The first project turns buried fiber-optic cables into a distributed AI-enabled sensor system, initially being trialed at a UK defense site to detect protesters and hostile actors attempting to gather intelligence; UK officials say the same approach could later extend to protecting airports, prisons, railways and energy plants. A second pilot project will explore low-power AI chips designed for future drones, robotics and autonomous systems.

    The AI agreement was announced alongside a separate decision by the UK to let defense contractor MBDA release classified information on UK-made components for the SCALP long-range missile, enabling local assembly lines in Ukraine. UK Defence Secretary Wes Streeting and AI Minister Kanishka Narayan both framed the AI partnership as part of a broader push to convert Ukraine’s wartime operational data into long-term technology and national-security capability for both countries.

    Sources

  • DOJ and FBI Seize Domains Behind Chinese State-Sponsored QScan and QTRouter Hacking Platforms

    DOJ and FBI Seize Domains Behind Chinese State-Sponsored QScan and QTRouter Hacking Platforms

    The U.S. Department of Justice and FBI announced August 26, 2026 that they had executed court-authorized domain seizures to disable two linked hacking platforms, known as QScan and QTRouter, used by a China-based, state-sponsored group the department identified as QTFY. According to the DOJ’s press release, court documents unsealed in the Southern District of California name Nanjing Xinjiuwei Network Technology Company as the operator of QTFY, which the department said sells hacking services to clients including the Chinese Ministry of State Security and the People’s Liberation Army.

    Court filings describe QScan and QTRouter as complementary tools: QScan searches the internet and automatically infects vulnerable internet-of-things devices, such as home routers and security cameras, while QTRouter forms an obfuscation network from those compromised devices that lets operators route attack traffic through infected machines in more than 130 countries, concealing the true origin of intrusions, FBI Cyber Assistant Director Brett Leatherman said in a video statement released by the bureau.

    The DOJ said the disruption made both platforms inoperable because the seized domains were hard-coded into their communication and authentication functions, a technique reported by The Record based on court documents. According to the department, victims of QTFY’s activity since at least 2018 include NASA, the Federal Reserve, the Department of Energy, the Department of Justice itself, the Department of Health and Human Services, the National Institutes of Health, and the U.S. Senate, as well as power companies, telecommunications providers, hospitals, financial institutions and defense contractors.

    Leatherman described the action as the disruption of “a global botnet used by a Chinese state-sponsored group … to target U.S. critical infrastructure,” adding that QTFY had “exploited software vulnerabilities to launch cyberattacks against U.S. government agencies, power companies, telcos, and major hospital systems” for nearly a decade. The FBI said QTFY’s services were also sold to customers beyond the Chinese government, though it did not name additional clients.

    The takedown is the latest in a series of U.S. actions targeting Chinese state-linked infrastructure-scanning and botnet operations, and underscores continuing concern among federal agencies about the use of compromised consumer and small-business IoT devices, including routers and security cameras, as staging infrastructure for espionage-linked intrusions into critical infrastructure networks.

  • Pro-Russian Hacker Group Claims Multi-Day DDoS Attack on Norway’s Digital Government Services

    Pro-Russian Hacker Group Claims Multi-Day DDoS Attack on Norway’s Digital Government Services

    A pro-Russian hacking group calling itself Server Killers claimed responsibility on Wednesday, August 26, 2026 for a distributed denial-of-service attack that disrupted Norwegian government digital services for several days, according to the Associated Press and multiple cybersecurity outlets including BleepingComputer and The Record. The group said in a Telegram post, widely reported by Norwegian media, that it had “declared cyber war” on Norway after the country renewed its security cooperation with Ukraine on August 23.

    Are Kvistad, a spokesperson for the Norwegian Digitalization Agency (Digdir), told the AP that the attack began Monday, August 24, and had affected multiple government digital services over three days. BleepingComputer reported that the attack started at 03:38 CEST that morning and targeted infrastructure supporting services operated by Digdir and its operations provider, Vivicta.

    The Record reported that the incident disrupted roughly ten digital services used for identity verification, logging into public services, exchanging data and documents between government agencies and businesses, accessing public records, and managing employee access. Among the affected systems was ID-porten, Norway’s digital identification gateway, which the outlet said has more than 4.5 million users and provides access to services including BankID and MinID.

    Security Affairs, which first reported the incident on August 25, characterized it as a DDoS attack rather than an intrusion resulting in data theft. The Server Killers group’s Telegram claim, cited by ABC News, tied the timing directly to Norwegian Prime Minister Jonas Gahr Støre’s meeting with Ukrainian President Volodymyr Zelenskyy around Ukraine’s National Flag Day on August 23.

    Norwegian officials had not, as of the claim’s publication, independently confirmed Server Killers as the responsible party, and cybersecurity researchers caution that DDoS attribution based solely on a threat actor’s own claims should be treated carefully. The incident nonetheless illustrates how European governments’ digital-identity infrastructure has become a recurring target for politically motivated disruption tied to support for Ukraine.

  • Cyberattack Disrupts Boston Scientific’s Global Order Processing and Shipping

    Cyberattack Disrupts Boston Scientific’s Global Order Processing and Shipping

    Boston Scientific, the Massachusetts-based medical device manufacturer, disclosed on August 26, 2026 that a cyberattack identified the previous day had disrupted its global operations, including its ability to process and ship customer orders. According to a filing with the U.S. Securities and Exchange Commission reported by Cybersecurity Dive, the company said the incident affected its IT network and “certain operating systems and business applications” beginning August 25.

    In a statement posted to its newsroom, Boston Scientific said it activated its incident response plan upon detection and is working with third-party cybersecurity experts to investigate, contain and remediate the threat. The company said it could not immediately estimate how long full restoration of affected systems would take, according to reporting from SecurityWeek and pharmaphorum.

    The disruption has drawn attention because of Boston Scientific’s role as a major supplier of cardiovascular, endoscopy and neuromodulation devices to hospitals and clinics worldwide. Dray Agha, senior manager of security operations at the security platform Huntress, told pharmaphorum that “the attack on Boston Scientific demonstrates that cyber incidents in the MedTech sector extend far beyond IT and actively threaten the global healthcare supply chain,” warning that an inability to process or ship medical orders “creates immediate ripple effects that can ultimately delay critical treatments and impact patient care down the line.”

    Boston Scientific has not publicly attributed the attack to a specific threat actor or confirmed whether patient or customer data was exposed. Medical Device Network, citing the company’s own account, reported that the incident has continued to affect access to operating systems and business applications supporting order processing days after it was first detected.

    The incident adds to what industry outlets describe as a continuing pattern of cybersecurity incidents affecting medical technology manufacturers in 2026, underscoring the exposure that device makers face when enterprise IT outages ripple into physical supply chains for hospitals and clinicians who depend on timely equipment and consumable shipments.

  • CISA Red-Team Assessments Show Why One SOC Detected an Intrusion and Another Did Not

    CISA Red-Team Assessments Show Why One SOC Detected an Intrusion and Another Did Not

    The US Cybersecurity and Infrastructure Security Agency published A Tale of Two SOCs: Insights From Two Red Team Assessments on August 25, 2026. The advisory compares assessments conducted at two critical-infrastructure organizations and shows how similar adversary techniques produced very different defensive outcomes.

    Two assessments, two outcomes

    At the first organization, CISA’s red team gained access to multiple workstations, elevated privileges across the domain and moved laterally without being detected by the security operations center. The assessment identified gaps in monitoring, cloud visibility, identity protection and communication between separate security teams.

    At the second organization, the SOC detected and quarantined the red team’s initial access. That response forced the assessors to move to an assumed-breach scenario. Defenders also detected and contained portions of the follow-on activity, limiting the red team’s freedom of movement.

    What made the difference

    CISA’s comparison emphasizes operational fundamentals rather than a single security product. Tuned alerts, established network and identity baselines, documented escalation procedures, communication between SOC teams and system owners, and visibility across IT, cloud and operational-technology environments all affected the result.

    The advisory also highlights the risk created by fragmented tooling. Multiple SOCs or endpoint-detection platforms do not automatically improve security when teams cannot see one another’s alerts or coordinate investigations. Cloud identity and application controls require the same operational ownership as traditional endpoint and network monitoring.

    Why it matters for critical infrastructure

    Critical-infrastructure operators increasingly manage connected IT, cloud and OT environments. An attacker who begins on a workstation may use identity systems, remote administration paths or cloud services to move toward operationally important resources. Detection quality therefore depends on whether defenders can correlate events across those boundaries before activity becomes a domain-wide compromise.

    Red-team assessments do not predict every real intrusion, but they provide controlled evidence of how existing people, procedures and technology perform against realistic adversary behavior. CISA’s findings support a practical priority: organizations should test whether their SOC can detect and coordinate a response across the complete environment, rather than assuming that deployed tools are functioning as an integrated defense.

    Sources

    Follow additional developments on Technology News.

  • CISA Deadline Passes for Federal Agencies to Patch Actively Exploited Zimbra Flaw

    CISA Deadline Passes for Federal Agencies to Patch Actively Exploited Zimbra Flaw

    August 24, 2026, was the deadline for US federal civilian executive branch agencies to mitigate or discontinue use of Zimbra Collaboration Suite (ZCS) systems affected by CVE-2026-73570, a critical, actively exploited remote-code-execution flaw, after the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog on August 21, according to reporting from Dark Reading and The Hacker News.

    Background on the flaw

    Zimbra disclosed CVE-2026-73570, a command-injection vulnerability in the optional zimbra-snmp component that can allow unauthenticated remote code execution when SNMP notifications are enabled, and released a patched version, ZCS 10.1.20, on July 20, 2026. Poland’s CERT Polska warned on August 16–17 that the flaw was being actively exploited in the wild, and BleepingComputer reported on the active exploitation campaign on August 20. CISA added the vulnerability to its KEV catalog on August 21 and required federal civilian agencies to remediate by August 24.

    Why it matters

    Zimbra Collaboration Suite is widely used email and collaboration software across businesses and government agencies. An unauthenticated remote-code-execution flaw in internet-facing collaboration infrastructure, already confirmed as being actively exploited before a patch was applied everywhere, is exactly the scenario CISA’s KEV deadlines are designed to force organizations to act on quickly. Security teams running Zimbra Collaboration Suite that have not yet applied version 10.1.20 or later, or disabled the affected SNMP component, should treat this as an active, ongoing exploitation risk rather than a theoretical one.

    Sources

    More coverage like this is available on Technology News.