We’re Tracking the Future of Security

Category: Cyber-Physical Security

Coverage of the convergence between IT/cybersecurity and physical security systems, including networked device risk, secure system integration and unified threat response.

  • NIST Awards $1.7 Million for Regional Cybersecurity Workforce Programs

    NIST Awards $1.7 Million for Regional Cybersecurity Workforce Programs

    NIST has awarded more than $1.7 million in cooperative agreements to nine education and community organizations developing regional cybersecurity workforce programs. The awards cover projects in eight states and are intended to connect training with the needs of local employers and nonprofit organizations.

    Projects combine education with practical pathways

    The agreements are administered through NIST’s National Initiative for Cybersecurity Education. Individual awards are worth up to $200,000 and support Regional Alliances and Multistakeholder Partnerships to Stimulate Cybersecurity Education and Workforce Development, known as RAMPS.

    Planned activities include curriculum development, high-school and college programs, internships, apprenticeships, workshops, boot camps, competitions and hands-on projects. NIST says the new awards expand the RAMPS network to 55 communities in 26 states.

    Workforce planning should map skills to real systems

    Training volume alone does not resolve operational shortages. Employers and educators need role definitions, supervised practice and evidence that participants can work safely with identity, network, cloud and incident-response systems. The NICE Workforce Framework offers a common language for that mapping, while regional partnerships can adapt delivery to local infrastructure and industry. SectechMedia follows workforce and operational resilience issues in its cybersecurity coverage.

    Sources

  • NIST Finalizes Guidance for Protecting Online Identity and Access Tokens

    NIST Finalizes Guidance for Protecting Online Identity and Access Tokens

    NIST has finalized implementation guidance for protecting online identity and access tokens from theft, forgery and misuse. Tokens allow applications and services to recognize authenticated users without repeatedly asking for credentials, but stolen or forged tokens can let an attacker impersonate a legitimate account while bypassing normal sign-in checks.

    The guidance uses a reference cloud implementation

    The publication describes a zero-trust architecture built around commercial and open-source technologies. It covers token discovery, visibility, validation and enforcement across identity providers, applications and cloud services. NIST developed the practice guide with CISA and industry collaborators through the National Cybersecurity Center of Excellence.

    The final material emphasizes that token protection is not limited to one product. Organizations need coordinated telemetry and policy enforcement across the systems that issue, receive and validate tokens.

    Operations should test revocation and misuse detection

    Identity teams should inventory token types, document trust relationships, reduce unnecessary token lifetime and confirm that revocation works during an incident. Monitoring should identify unusual issuance, replay and use from unexpected devices or locations. Those controls complement phishing-resistant authentication rather than replacing it. SectechMedia follows related developments in its identity and access-control coverage.

    Sources

  • CISA Adds Actively Exploited WordPress Core File-Inclusion Flaw to KEV

    CISA Adds Actively Exploited WordPress Core File-Inclusion Flaw to KEV

    CISA has added CVE-2026-87902, a WordPress core file-inclusion vulnerability, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The issue affects WordPress versions before 7.1.2, with fixes also backported to maintained older branches.

    Specific conditions can turn local inclusion into code execution

    The flaw involves page-template resolution in get_page_template(). An unauthenticated attacker can cause WordPress to include a chosen readable local PHP file outside the active theme directories. Exploitation requires additional server and theme preconditions, but a successful chain can lead to remote code execution. The CVE record assigns a high-severity score and notes that no user interaction or prior privileges are required.

    WordPress released version 7.1.2 on September 22 and recommended immediate updates. CISA added the vulnerability to KEV on September 25, while public reporting documented probing shortly after the patch became available.

    Inventory and verification matter after patching

    Operators should confirm the actual WordPress core version on every site, apply the relevant security release, review web and file-change telemetry, and verify that unsupported instances are not exposed. Patching does not by itself prove that an already-exposed site was not accessed. SectechMedia follows related operational risks in its cybersecurity coverage.

    Sources

  • F-Droid 2.0 Redesigns Open-Source Android App Discovery and Updates

    F-Droid 2.0 Redesigns Open-Source Android App Discovery and Updates

    F-Droid has released version 2.0 of its official Android client, describing it as the project’s largest application update in ten years. The redesign modernizes how users discover, search for and maintain free and open-source Android applications while retaining F-Droid’s repository model.

    The client has been rebuilt around current Android patterns

    The interface now centers on Discover, Search and My Apps. Categories are integrated into discovery, while installed applications and updates are consolidated under My Apps. The project says major components were rewritten with Kotlin Compose after 14 test releases, providing a new base for future development.

    Discovery includes newly added, recently updated and widely downloaded applications. The category system has also been expanded to make specialist tools such as VPNs, firewalls and password managers easier to find. F-Droid says the experience remains free of behavioral tracking.

    Repository trust still requires informed review

    A redesigned client can improve update visibility and software discovery, but users and organizations should still assess repository policy, signing, update cadence and application permissions. Mobile fleets also need a clear rule for software installed outside a managed commercial store. SectechMedia follows related controls in its cybersecurity coverage.

    Sources

  • Local AI Model Reworks Credential Dumper to Evade Two EDR Products in Lab Test

    Local AI Model Reworks Credential Dumper to Evade Two EDR Products in Lab Test

    A security researcher reports that an uncensored local AI model modified a Windows credential-dumping program until it ran without alerts from two endpoint detection and response products available in the test lab. The experiment does not demonstrate a universal EDR bypass, but it illustrates how local models without service-side safeguards can accelerate iterative offensive development.

    The model changed several observable behaviors

    The test began with a tool designed to clone the LSASS process and create an encrypted memory dump. Initial versions were detected. After prompts requesting stealth, the local model changed process-spawning behavior, reduced access rights, inserted timing variation, changed output paths and removed embedded strings. The researcher reports that the revised build then completed without detections in the two tested products.

    The result is limited to one laboratory setup, one task and two unnamed EDR platforms. It should not be generalized into a claim that AI can bypass every endpoint product.

    Defenders need behavior-level validation

    Security teams should test controls against credential-access behaviors rather than rely only on static signatures. Useful layers include LSASS protection, credential isolation, privilege reduction, process-access telemetry and correlation across endpoint and identity systems. Model governance also matters where organizations permit local AI tools. SectechMedia tracks these risks in its cybersecurity coverage.

    Sources

  • Lunex Stealer Uses Vulnerable AMD Driver to Blind Security Tools

    Lunex Stealer Uses Vulnerable AMD Driver to Blind Security Tools

    Researchers have documented a multistage Windows malware chain in which Lunex Stealer abuses a legitimately signed but vulnerable AMD kernel driver before collecting browser and cryptocurrency data. The technique is an example of bring your own vulnerable driver, or BYOVD, in which attackers load a trusted driver whose known flaw provides kernel-level capabilities.

    The driver is used to weaken monitoring

    The chain begins with a fake verification page and a malicious installer. Its loader uses the vulnerable PDFWKRNL.sys driver associated with CVE-2023-20598 to interfere with callbacks used by security products. The products can remain running while losing visibility into activity that follows. The final stealer targets credentials, session cookies and wallet information from several Chromium-based browsers and can add a native-messaging component for persistence and remote file operations.

    AMD published its original bulletin for the driver vulnerability in 2023. The current campaign matters because it shows how older signed-driver flaws can be combined with newer malware delivery and persistence techniques.

    Driver controls need operational testing

    Defenders should inventory vulnerable drivers, apply vendor updates, review driver-loading telemetry and test whether Microsoft’s vulnerable-driver blocklist is active in their actual Windows configuration. Browser credential theft also increases the value of phishing-resistant authentication and rapid session revocation. SectechMedia tracks related developments in its cybersecurity coverage.

    Sources

  • Security System MTTR Metrics and Critical Spare Parts Planning

    Security System MTTR Metrics and Critical Spare Parts Planning

    Security availability depends on more than failure rate. A device that fails rarely can still create unacceptable exposure if repair takes weeks because the part, configuration or specialist is unavailable. Mean time to repair and critical-spares planning connect maintenance records with operational risk.

    Define repair time consistently

    Choose when the MTTR clock starts and stops. Useful stages include detection, ticket creation, diagnosis, parts arrival, physical repair, configuration and verified return to service. One overall average can hide delays caused by logistics or approval.

    Separate active repair time from waiting time while retaining both. A technician may replace a camera in an hour after the correct model arrives, but a ten-day procurement delay still affects service availability.

    Rank assets by operational consequence

    Classify devices and components according to the function they support. A recorder power supply, access controller, fire-network card or perimeter processor may affect many downstream points. Spares should follow consequence and lead time, not simply the number of devices installed.

    Include software licenses, certificates, configuration backups, mounting hardware and compatible power supplies. A shelf containing the main device is not a complete recovery capability if activation keys or approved firmware are unavailable.

    Use failure history without overfitting

    Review faults by model, age, environment and cause. Repeated failures may justify additional stock, but they may also indicate heat, power quality, water ingress or poor installation. Buying more of the same component does not correct a systemic cause.

    Track parts consumed, returned and found defective. Rotate stock where batteries, seals or other components age in storage. Verify that replacement models remain interoperable with the deployed platform before older parts become unavailable.

    Test the recovery process

    Run controlled replacement exercises for selected critical assets. Confirm access to backups, credentials, firmware, tools and test equipment. Measure restoration through functional read-back rather than ending the clock when hardware powers on.

    Review MTTR trends with service-level targets and temporary mitigations. A bypassed zone or borrowed camera may reduce immediate risk but should not close the permanent repair ticket. Maintenance metrics support broader Industrial Safety & Monitoring resilience when they expose where staffing, logistics or configuration control delays recovery.

    Govern inventory and obsolescence

    Assign ownership for minimum stock, storage conditions, firmware compatibility and replenishment. Review manufacturer end-of-sale and end-of-support notices so a critical spare does not depend on an unavailable model or unsupported software branch.

    Quarterly inventory checks should compare physical stock with maintenance records and planned projects. Reserve critical parts for restoration rather than allowing project work to consume them without replacement. The resulting evidence connects spare holdings to actual risk, repair history and tested recovery capability.

    Record substitutions and compatibility decisions. An emergency replacement should not become an undocumented permanent configuration that future maintenance teams cannot reproduce.

    Reference sources

  • Aviation Cybersecurity Survey Reports Average Annual Losses of $1.4 Million

    Aviation Cybersecurity Survey Reports Average Annual Losses of $1.4 Million

    A survey commissioned by cybersecurity company Bridewell reports average breach losses of $1.4 million among U.S. aviation organizations during the previous 12 months. Censuswide surveyed 250 cybersecurity professionals working across the sector.

    Common attacks reached operationally sensitive organizations

    Phishing was the most frequently reported attack in the study. Respondents also described malware, credential theft and distributed denial-of-service incidents. The findings show that aviation cyber risk extends across business systems, airport operations, service providers and supply-chain connections.

    Financial impact varied, but a large share of respondents placed losses between hundreds of thousands and several million dollars. Concern was particularly high around operational infrastructure and third parties, where one compromised connection can affect several organizations.

    Spending must translate into tested resilience

    More respondents reported increasing cybersecurity budgets, while specialist recruitment remained difficult. Aviation operators should therefore measure whether investment improves asset visibility, identity controls, segmentation, recovery time and supplier assurance rather than treating spending alone as a maturity indicator.

    The results are relevant to SectechMedia’s Industrial Safety & Monitoring coverage. Airports and aviation service providers should exercise degraded operations, verify backup communications and require suppliers to report incidents promptly. A defensible program links cyber monitoring with physical operations so that a digital outage does not create an unmanaged safety or access-control condition.

    Sources

  • Attackers Bypass WAF Rules to Exploit Oracle PeopleSoft Systems

    Attackers Bypass WAF Rules to Exploit Oracle PeopleSoft Systems

    Google threat researchers have reported renewed mass exploitation of CVE-2026-35273 in Oracle PeopleSoft. The campaign modifies earlier exploit traffic so that requests can bypass web application firewall rules that match the vulnerable path as a literal string.

    Encoded paths can defeat narrow filtering rules

    The reported requests substitute an encoded character in the PeopleSoft Environment Management Hub path. A proxy or WAF may inspect the request before decoding it, while the application server later normalizes the path and routes it to the vulnerable servlet. The mismatch shows why an edge rule is not a substitute for applying Oracle’s security update.

    Google linked the renewed activity to UNC6240 and observed web-shell deployment on affected systems. Reported targets span education, technology, healthcare, transportation and government. Post-exploitation activity can include command execution, credential theft, tunneling and data staging.

    Defenders need patching and host-level review

    Organizations should apply the vendor fix, review whether the Environment Management Hub service is required and search access logs for encoded variants of the vulnerable path. PeopleSoft and WebLogic hosts should be inspected for unexpected JSP files, remote-management tools, archives and unusual outbound connections.

    The campaign reinforces the need for layered controls in Cyber-Physical Security. Teams should rotate credentials accessible to the application account and preserve logs before cleanup. A WAF can reduce exposure, but application patching, host monitoring and identity recovery remain necessary when attackers change request encoding.

    Sources

  • Kiteworks Issues Precautionary Shutdown Advisory After Threat Intelligence Warning

    Kiteworks Issues Precautionary Shutdown Advisory After Threat Intelligence Warning

    Kiteworks has issued a precautionary shutdown advisory after receiving what it described as credible threat intelligence from federal authorities. The company recommended a nine-hour shutdown window for customer-managed systems during the weekend while it worked with authorities on the potential threat.

    The advisory was preventive, not a breach notice

    Kiteworks said it had no indication that its systems or customer environments had been compromised when the advisory was published. Self-managed deployments, including on-premises and customer-controlled cloud systems, were asked to follow instructions sent directly to customers. The company said it would handle the same measure for systems that it hosts.

    Independent reporting said the warning concerned the possibility of a zero-day attack and applied across time zones. The unusual step reflects the sensitivity of managed file-transfer and secure-communications platforms, which often handle confidential information for government, financial, legal and industrial organizations.

    Recovery should include verification

    A shutdown window is only one part of incident preparation. Operators should preserve logs, document system state, validate updates or mitigations, and confirm integrity before restoring external access. They should also monitor vendor communications because threat information and required actions can change as an investigation develops. SectechMedia follows secure infrastructure operations in its cyber-physical security coverage.

    Sources