We’re Tracking the Future of Security

Category: Cyber-Physical Security

Coverage of the convergence between IT/cybersecurity and physical security systems, including networked device risk, secure system integration and unified threat response.

  • UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

    UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

    A cybercrime group tracked as UAT-10147 is using artificial intelligence tools to help scale attacks against internet-facing servers, and is deploying a malware toolset called SPECTRE that includes endpoint detection and response (EDR) evasion capabilities and a Linux rootkit component, according to a report published by The Hacker News on August 24, 2026.

    What the campaign involves

    Reporting describes UAT-10147 as using AI-assisted techniques to accelerate reconnaissance and exploitation against server infrastructure, rather than relying solely on manual attack chains. Once inside a target environment, the group is reported to deploy SPECTRE, which combines capabilities to bypass or blind EDR tooling with a Linux-focused rootkit intended to maintain stealthy, persistent access.

    Why it matters

    The use of AI-assisted tooling to scale attacks against server infrastructure reflects a trend that both offensive and defensive researchers have flagged repeatedly through 2026: attackers are using automation and AI assistance to compress the time between reconnaissance and exploitation, while defenders increasingly rely on AI-assisted detection to keep pace. A rootkit paired with EDR-bypass capability is also a reminder that Linux server estates — often assumed to be lower-risk than Windows endpoints — remain a high-value target, particularly where detection tooling coverage is weaker than on the desktop fleet.

    Sources

    More coverage like this is available on Technology News.

  • Operation QUICSILVER: New QUICAgent Backdoor Targets Myanmar Government and IT Networks

    Operation QUICSILVER: New QUICAgent Backdoor Targets Myanmar Government and IT Networks

    Security researchers have disclosed a cyber-espionage campaign, tracked as Operation QUICSILVER, that targets government agencies and IT organizations in Myanmar using a previously undocumented backdoor named QUICAgent, according to a report published by The Hacker News on August 24, 2026.

    What researchers found

    The campaign is described as an active cyber-espionage operation focused on Myanmar government and information-technology sector networks. Reporting characterizes it as consistent with state-linked cyber-espionage tradecraft, deploying the QUICAgent backdoor to establish persistent access inside targeted networks. As is typical for early-stage espionage-malware disclosures, full attribution and complete technical indicators were still being documented publicly at the time of the report.

    Why it matters

    Espionage-focused backdoors like QUICAgent are built to stay hidden inside government and infrastructure-adjacent networks for extended periods rather than cause immediate disruption, which makes early public disclosure by researchers an important part of defenders’ ability to detect them. Campaigns targeting Southeast Asian government and IT-sector networks are also a reminder that nation-state espionage activity extends well beyond the small number of countries that dominate headlines, and that regional government and critical-infrastructure-adjacent IT operators remain a persistent target set.

    Sources

    More coverage like this is available on Technology News.

  • GSX 2026 Preview: Security Leaders Head to Atlanta in September

    GSX 2026 Preview: Security Leaders Head to Atlanta in September

    Global Security Exchange returns to Atlanta in September with an agenda built around the operational and management challenges facing security leaders. The ASIS International event combines a technology exhibition with education on physical protection, information security and organizational resilience.

    Event details

    • Dates: 14–16 September 2026
    • Venue: Georgia World Congress Center
    • Location: Atlanta, Georgia, USA

    Published themes and technology areas

    • Intelligence and organizational resilience
    • Information security and site security
    • Supply-chain and personnel security
    • Investigations, executive protection and governance

    Who should follow the event

    Security directors, enterprise risk leaders, consultants, integrators and practitioners responsible for protecting people, facilities, information and supply chains.

    Why it matters

    GSX is useful for teams comparing technology with policy and operating practice. Its published education tracks span both physical and information-security responsibilities, making it relevant to organizations managing converged risk.

    Registration and visit planning

    Registration is open through the official GSX website. ASIS also lists pre-conference programs for 12–13 September; visitors should check the current registration and program pages before booking.

    Sources

    Security & Fire Exhibitions

  • International Security Expo 2026 Preview: Resilience and Counter-Threat Technology

    International Security Expo 2026 Preview: Resilience and Counter-Threat Technology

    International Security Expo returns to Olympia London with a focus on national and organizational resilience. The official program architecture brings together counter-terrorism, perimeter and border protection, counter-UAS, critical-infrastructure security and the co-located International Cyber Expo.

    Event details

    • Dates: 29–30 September 2026
    • Venue: The Grand Hall, Olympia London
    • Location: London, United Kingdom

    Published themes and technology areas

    • Counter-terrorism and resilience
    • Perimeter, border and counter-UAS security
    • Critical-infrastructure protection
    • Cybersecurity convergence and live demonstrations

    Who should follow the event

    Government and public-sector security teams, critical-infrastructure operators, corporate security leaders, consultants, integrators and technology buyers.

    Why it matters

    The event connects policy and operational security with product evaluation. Specialist zones and demonstrations can help buyers examine how systems perform within wider protective-security programs.

    Registration and visit planning

    The organizer offers registration through the official event site. Olympia publishes the same dates and Grand Hall location; visitors should check both sites for current access and travel guidance.

    Sources

    Security & Fire Exhibitions

  • Cyber-Physical Security Convergence: Why IT and Security Teams Are Merging

    Cyber-Physical Security Convergence: Why IT and Security Teams Are Merging

    Physical security systems increasingly run on IP networks, cloud services and software platforms, while cyber incidents can create physical consequences. This is pushing IT, cybersecurity and physical-security teams toward closer operational convergence.

    Physical devices are cyber assets

    Cameras, door controllers, intercoms, alarm panels and sensors contain processors, firmware and network interfaces. Weak credentials, vulnerable software or unnecessary services can turn protective equipment into a cyber entry point.

    Identity and incident convergence

    Joiner, mover and leaver processes should update both digital and physical permissions. Badge activity, login records, forced doors and camera status can also provide stronger incident context when correlated.

    Architecture and governance

    Security devices should not sit on unmanaged flat networks. Segmentation, secure remote access, logging and vulnerability management require shared ownership across IT, cyber and physical-security functions.

    Cloud and operational technology

    Vendor security posture becomes part of procurement as video and access platforms move to cloud services. Critical infrastructure must also consider OT systems that control physical processes.

    Benefits and limitations

    Convergence can improve asset visibility, investigation and policy consistency, but it does not require every department to merge. Clear responsibilities and escalation paths remain essential.

    Conclusion

    Unified identity, shared data and careful correlation will continue to drive cyber-physical convergence. Isolated facilities systems are increasingly difficult to govern securely.

  • Small UK Power Generator Taken Offline After Iran-Linked Cyberattack

    Small UK Power Generator Taken Offline After Iran-Linked Cyberattack

    A small power generation site in the United Kingdom was shut down for four days in July 2026 following a cyberattack that has been linked to hackers associated with Iran, The Telegraph reported on August 23, citing sources familiar with the incident. UK outlets including the Independent, Metro and The Register subsequently confirmed elements of the report with government sources.

    What happened

    The affected facility has not been publicly named. UK officials describe it only as a “small-scale energy generator” — the kind of site that, according to reporting, often runs intermittently to top up the grid rather than providing baseload power. A UK government spokesperson confirmed the incident to multiple outlets, including The Register and CNBC, stating that the attack did not create a risk to the wider energy system.

    Official response

    “This story refers to an incident impacting a small-scale energy generator, and at no point was there a risk to the wider energy system,” a UK government spokesperson said in a statement provided to several outlets. “The UK has a highly resilient energy system. We work closely with the energy sector to protect infrastructure and ensure the highest security standards.” The National Cyber Security Centre, part of GCHQ, said it does not routinely comment on individual incidents.

    Why it matters

    Reports describe this as the first time hackers linked to Iran have successfully disrupted a UK energy facility, and note that it occurred around the same time as a wave of cyberattacks attributed to Iran-linked actors against water utilities in the United States. Even when an individual facility is small relative to national grid capacity, incidents like this are a reminder that distributed and smaller energy assets — not just flagship power stations — are part of the critical infrastructure attack surface, and that operational technology segmentation and incident response planning need to extend across the full fleet of generation sites, not only the largest ones.

    Sources

    More coverage like this is available on Technology News.

  • DEF CON Franklin and National Rural Water Association Launch Water Watch Center for Small Utilities

    DEF CON Franklin and National Rural Water Association Launch Water Watch Center for Small Utilities

    DEF CON Franklin and the National Rural Water Association (NRWA) have launched the Water Watch Center, a program giving small water utilities direct access to cybersecurity support, the organizations announced at DEF CON 34 in Las Vegas.

    What’s New

    The Water Watch Center connects small water systems — those serving fewer than 10,000 people, which make up roughly 91% of the nation’s approximately 50,000 community water systems — with five managed detection and response providers: Defendify, Legato Security, L1 Secure, Rapid7 and Sentinel Technologies. The providers exchange threat information and patches through a shared collaboration mechanism and report findings to NRWA, which coordinates response for member utilities. DEF CON Franklin, a partnership between NRWA, the University of Chicago’s Cyber Policy Initiative and DEF CON, also offers a volunteer cyber task force that matches water systems with technologists who help harden OT and IT infrastructure.

    Why It Matters

    “NRWA is excited to establish the Water Watch Center to provide the tools our sector needs to assess, prepare for, and respond to cyberattacks,” said NRWA Chief Executive Officer Matthew Holmes. The launch follows what organizers described as one of the most widespread nation-state cyberattacks on U.S. water systems to date, and comes as small utilities with limited budgets and staff have struggled to access the kind of hands-on cybersecurity support larger utilities can afford.

  • White House Executive Order Sets Federal Post-Quantum Cryptography Deadlines

    White House Executive Order Sets Federal Post-Quantum Cryptography Deadlines

    June 22, 2026 — The White House issued Executive Order 14412, formally setting deadlines for federal agencies to migrate high-value systems to NIST-approved post-quantum cryptography.

    What happened

    The order requires federal civilian agencies to complete migration of key-establishment cryptography by December 31, 2030, and digital-signature cryptography by December 31, 2031, for high-value assets and high-impact systems. It also directs the FAR Council to propose a rule requiring covered federal contractors to meet the same NIST FIPS post-quantum standards, with agency migration leads due by late July 2026 and full migration plans due by late October 2026.

    Why it matters

    A binding federal deadline, rather than voluntary guidance, gives government contractors and critical-infrastructure operators a concrete planning horizon for a migration that touches nearly every system relying on current public-key cryptography.

    Security and infrastructure impact

    Organizations supplying software, hardware or managed services to federal agencies should begin cryptographic inventory and migration planning now, since the multi-year runway to 2030–2031 is short relative to the scope of systems that need updating across large, distributed infrastructure.

    Sources

    ← Back to Technology News

  • CISA Orders Emergency Patching After Ivanti Sentry Flaw Added to KEV

    CISA Orders Emergency Patching After Ivanti Sentry Flaw Added to KEV

    June 11, 2026 — CISA confirmed active exploitation of a maximum-severity vulnerability in Ivanti’s Sentry gateway appliance and added it to its Known Exploited Vulnerabilities catalog, triggering a new binding patch deadline for federal agencies.

    What happened

    The flaw, an OS command-injection weakness in Ivanti’s security gateway appliance formerly known as MobileIron Sentry, was confirmed as actively exploited and catalogued by CISA. Under newly issued Binding Operational Directive 26-04, CISA ordered federal civilian agencies to patch the flaw within three days.

    Why it matters

    A three-day emergency patch window for a maximum-severity, actively exploited edge-appliance vulnerability underscores how little time defenders now have between public disclosure and mandated remediation for internet-facing management infrastructure.

    Security and infrastructure impact

    Organizations running Ivanti gateway appliances outside the federal directive’s direct scope should still treat the finding as an urgent patch signal, given that KEV entries reliably indicate active, opportunistic exploitation rather than theoretical risk.

    Sources

    ← Back to Technology News

  • Anthropic Launches Project Glasswing to Share AI Vulnerability-Finding With Industry

    Anthropic Launches Project Glasswing to Share AI Vulnerability-Finding With Industry

    April 9, 2026 — Anthropic announced Project Glasswing, giving a group of major technology and finance companies early access to Claude Mythos Preview, a model it says can find and exploit software vulnerabilities at a level that rivals skilled human researchers.

    What happened

    Partners in the program included Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, Nvidia and Palo Alto Networks. Anthropic said Mythos Preview had already identified thousands of high-severity vulnerabilities across every major operating system and web browser, and it kept the model unreleased to the public, citing misuse concerns.

    Why it matters

    An AI model capable of automated, human-competitive vulnerability discovery is a double-edged development: it can dramatically accelerate defensive patching, but the same capability could eventually be misused for offensive exploit development if it reaches less careful actors.

    Security and infrastructure impact

    Critical-infrastructure operators and software vendors should watch how programs like Glasswing scale, since AI-assisted vulnerability research at this level will likely change both the speed of patch cycles and the sophistication expected of future exploit attempts.

    Sources

    ← Back to Technology News