We’re Tracking the Future of Security

Category: Cyber-Physical Security

Coverage of the convergence between IT/cybersecurity and physical security systems, including networked device risk, secure system integration and unified threat response.

  • Ransomware Attack on Dutch Health-IT Vendor ChipSoft Disrupts Hospitals

    Ransomware Attack on Dutch Health-IT Vendor ChipSoft Disrupts Hospitals

    April 7, 2026 — A ransomware attack on ChipSoft, a software vendor used by roughly 80 percent of hospitals in the Netherlands, forced parts of its digital infrastructure offline and disrupted hospital operations.

    What happened

    The Embargo ransomware group was linked to the attack, which took ChipSoft’s public website and several patient-facing platforms — including Zorgportaal and HiX Mobile — offline. Eleven hospitals took their ChipSoft-dependent systems offline as a precaution, and the company later confirmed that medical personal data had been stolen, though it said the stolen data was subsequently destroyed.

    Why it matters

    The incident illustrates concentration risk in healthcare IT: a single software vendor’s compromise can simultaneously disrupt patient care across a large share of a country’s hospital system, a pattern increasingly common as healthcare consolidates around a small number of electronic health-record platforms.

    Security and infrastructure impact

    Hospital IT and physical-security teams should treat vendor-concentration risk as a resilience planning priority, including tested downtime procedures for core clinical software, not only for ransomware directly targeting the hospital’s own network.

    Sources

    ← Back to Technology News

  • CISA Adds Six Actively Exploited Fortinet, Microsoft and Adobe Flaws to KEV

    CISA Adds Six Actively Exploited Fortinet, Microsoft and Adobe Flaws to KEV

    April 6, 2026 — CISA added six actively exploited vulnerabilities spanning Fortinet, Microsoft and Adobe products to its Known Exploited Vulnerabilities catalog in a single batch update.

    What happened

    The additions included Fortinet FortiClient EMS and FortiSandbox flaws that allow improper access control and unauthenticated OS command injection respectively, alongside vulnerabilities in Microsoft and Adobe software. CISA’s catalog entries require affected federal agencies to remediate on a defined schedule.

    Why it matters

    Batch KEV updates spanning multiple, unrelated vendors in the same week illustrate how broadly distributed exploitation activity has become across common enterprise software rather than concentrated in a single product line.

    Security and infrastructure impact

    Security teams should treat multi-vendor KEV batches as a prompt to review patch status across their full software inventory, not just the specific products named, since KEV additions often reflect exploitation trends that spread quickly to adjacent, similarly configured systems.

    Sources

    ← Back to Technology News

  • NVIDIA Expands AI-Powered Cybersecurity Partnerships for OT and ICS

    NVIDIA Expands AI-Powered Cybersecurity Partnerships for OT and ICS

    February 23, 2026 — NVIDIA detailed integrations with Akamai, Forescout, Palo Alto Networks, Siemens and Xage Security for operational technology and industrial control security.

    What happened

    NVIDIA announced that several security and industrial vendors were integrating its accelerated computing, AI and BlueField technology into OT and ICS security offerings. The company described architectures for visibility, policy enforcement and threat response at the infrastructure edge. Capabilities will vary by partner product and deployment, so the announcement should not be read as a single universally available solution.

    Why it matters

    OT environments often combine long-lived equipment, availability constraints and limited maintenance windows. Moving selected security functions closer to industrial workloads may improve visibility and response, but it also adds components that must be engineered and governed correctly.

    Security and infrastructure impact

    Operators should validate passive discovery, segmentation, fail-safe behavior, update procedures and the effect of automated containment on production. AI-generated detections must feed accountable incident workflows rather than making uncontrolled process decisions.

    Sources

    ← Back to Technology News

  • Ransomware Remains a Critical Infrastructure Risk in 2026

    Ransomware Remains a Critical Infrastructure Risk in 2026

    2026 — Government threat assessments continue to identify ransomware as a major threat to critical infrastructure and essential public services.

    What happened

    The Canadian Centre for Cyber Security’s 2025–2026 assessment calls ransomware the leading cybercrime threat to Canadian critical infrastructure. New Jersey’s 2026 assessment likewise expects ransomware groups to continue targeting critical infrastructure and widely deployed enterprise software. These are risk assessments, not a claim that every sector or country experiences the same incident rate.

    Why it matters

    Ransomware becomes a safety and continuity problem when it disrupts hospitals, utilities, municipalities or emergency communications. Restoration priorities, manual workarounds and dependencies on vendors matter as much as endpoint detection.

    Security and infrastructure impact

    Infrastructure operators need tested offline recovery, segmented IT and OT environments, protected identity systems and decision-ready incident playbooks. Exercises should include loss of a shared service and determine which physical operations can continue safely.

    Sources

    ← Back to Technology News

  • Third-Party Involvement in Data Breaches Doubles in Verizon’s 2025 DBIR

    Third-Party Involvement in Data Breaches Doubles in Verizon’s 2025 DBIR

    April 23, 2025 — Verizon’s 2025 Data Breach Investigations Report found that third-party involvement in breaches doubled to 30 percent.

    What happened

    Verizon reported that third-party involvement appeared in 30 percent of breaches analyzed for its 2025 DBIR, double the prior report’s share. The finding covers partners and supply-chain relationships across a large incident dataset; it does not mean every vendor has the same probability of compromise.

    Why it matters

    Organizations increasingly depend on SaaS platforms, managed services, software components and connected contractors. A compromise outside the direct network can still inherit trusted access, shared data or administrative integration and produce a wide blast radius.

    Security and infrastructure impact

    Vendor assessment should extend beyond an annual questionnaire. Security teams need inventories of integrations and service accounts, least-privilege access, contract notification requirements, token revocation procedures and recovery plans for the loss of a critical supplier.

    Sources

    ← Back to Technology News

  • FCC Escalates Enforcement Against Hikvision and Dahua Equipment

    FCC Escalates Enforcement Against Hikvision and Dahua Equipment

    October 2025 — The FCC moved to close loopholes in its Covered List rules and launched “Operation Clean Carts” against the illegal online sale of banned Hikvision and Dahua equipment.

    What happened

    On October 7, 2025, FCC Chairman Brendan Carr announced the agency would vote to extend Covered List restrictions to previously authorized equipment models and covered component parts, closing a gap that had applied only to new Huawei, Hikvision and similar gear. Days later, the FCC reported that its Operation Clean Carts effort had prompted major online retailers to remove several million listings for prohibited equipment, including Hikvision and Dahua security cameras.

    Why it matters

    Extending restrictions to previously authorized equipment and component-level parts closes a significant compliance gap that had allowed legacy-authorized Hikvision and Dahua products to remain in the US market despite the broader ban.

    Security and infrastructure impact

    Integrators and end users still operating legacy Hikvision or Dahua video systems in the US — including in schools and commercial facilities with federal funding ties — should reassess compliance exposure, since enforcement has moved from new-model bans toward broader supply-chain and resale restrictions.

    Sources

    ← Back to Technology News

  • CISA Confirms Active Exploitation of SharePoint ToolShell Vulnerability

    CISA Confirms Active Exploitation of SharePoint ToolShell Vulnerability

    July 20, 2025 — CISA added SharePoint Server CVE-2025-53770 to its Known Exploited Vulnerabilities catalog after confirming active exploitation.

    What happened

    CISA added CVE-2025-53770, known as ToolShell, to the Known Exploited Vulnerabilities catalog and published guidance for affected on-premises Microsoft SharePoint environments. Later analysis described malicious files, web shells and attempts to extract cryptographic material. The issue concerned on-premises SharePoint Server, not Microsoft 365 SharePoint Online.

    Why it matters

    The incident demonstrates why collaboration platforms are high-value targets: they combine trusted identities, sensitive documents and connectivity to internal systems. A successful compromise may survive a simple software update if attackers have already installed persistence or stolen keys.

    Security and infrastructure impact

    Organizations should apply Microsoft and CISA guidance, hunt for published indicators, rotate exposed secrets where required and isolate affected systems during investigation. Recovery should include evidence review, not only patch installation.

    Sources

    ← Back to Technology News

  • CitrixBleed 2 Puts NetScaler Session Security Back Under Pressure

    CitrixBleed 2 Puts NetScaler Session Security Back Under Pressure

    June–July 2025 — The NetScaler vulnerability known as CitrixBleed 2 renewed attention on exposed edge appliances, session-token theft and post-patch incident response.

    What happened

    Security researchers used the name CitrixBleed 2 for a NetScaler ADC and Gateway vulnerability capable of exposing sensitive memory and session material under affected conditions. Citrix issued security updates and operational guidance. Because victim counts changed across investigations, this article does not repeat the hub’s earlier unverified “more than 100 organizations” figure.

    Why it matters

    Session-token exposure can let an attacker bypass the protection users expect from passwords and multifactor authentication. Patching closes the known flaw, but it may not invalidate tokens or remove persistence created before remediation.

    Security and infrastructure impact

    Defenders should follow vendor guidance, restrict management exposure, terminate relevant sessions, rotate credentials where indicated and review logs for abnormal access. Internet-facing security appliances should be included in rapid asset inventory and emergency patch processes.

    Sources

    ← Back to Technology News