We’re Tracking the Future of Security

Tag: Cyber-Physical Security

  • TSA Audit Finds Access-Control Gaps Across Sensitive IT Systems

    TSA Audit Finds Access-Control Gaps Across Sensitive IT Systems

    The Transportation Security Administration needs stronger controls over who can access sensitive information technology systems, according to a Department of Homeland Security Office of Inspector General report dated September 29. The audit examined account governance, privileged access and the removal of access when personnel leave the agency.

    The inspector general reported weaknesses in approval documentation for privileged accounts, annual access reviews and timely deprovisioning for separated personnel. These are administrative controls, but they directly affect whether technical safeguards can reliably enforce the agency’s intended access policy.

    Five Recommendations Issued

    The report made five recommendations intended to strengthen account authorization, recurring reviews, evidence retention and offboarding. TSA concurred with all five, according to the audit. The agency also described corrective work, including a ServiceNow-based process introduced in July 2026 to improve account management and review workflows.

    Because parts of the report are redacted, the public document does not expose detailed system configurations. It nevertheless provides a clear governance lesson: access-control effectiveness depends on current identity records, documented approvals and prompt revocation, not only on authentication technology.

    Why the Findings Matter Beyond TSA

    Transportation organizations increasingly connect operational, administrative and physical-security systems. A stale or over-privileged account can therefore become a pathway to sensitive data or systems that support real-world operations. Mature programs link human-resources events, identity governance and technical enforcement so that role changes and departures trigger predictable access updates.

    Security teams can apply the same principles by inventorying privileged accounts, assigning accountable owners, retaining approval evidence and testing offboarding with measurable service targets. Independent review should verify that the documented procedure produces the expected result in live systems. Exceptions should have named owners, expiry dates and documented compensating controls.

    The findings also reinforce the connection between cyber and physical risk discussed in SectechMedia’s cyber-physical security convergence guide.

    Sources

  • ENISA Says Three in Four EU Employees Encountered Cyber Threats at Work

    ENISA Says Three in Four EU Employees Encountered Cyber Threats at Work

    Cyber threats are a routine workplace experience for many European employees, according to survey findings highlighted by the European Union Agency for Cybersecurity (ENISA). The results point to a gap between broad awareness of cyber risk and the training, reporting habits and practical confidence needed to respond consistently.

    Survey finds broad exposure but uneven preparedness

    The European Commission’s Eurobarometer survey found that 74% of employees had encountered suspicious emails, messages, voice calls or links during the previous six months. Phishing or fraudulent email was the most frequently reported threat at 39%, while 18% encountered attempts to obtain personal data or passwords.

    Awareness is comparatively high: 83% said a cyberattack could have serious consequences for their organization. Preparedness is less uniform. The survey says 60% received cybersecurity training in the previous year, participation was lower in smaller organizations, and only 48% felt able to recognize AI-generated fake videos. At the same time, 85% expressed interest in improving their cybersecurity skills.

    Operational lessons for security teams

    The findings reinforce the need to treat workforce readiness as part of operational security rather than a once-a-year compliance exercise. Short, role-specific training can be paired with clear reporting channels, realistic phishing simulations and rapid feedback after suspicious activity. Organizations responsible for essential services should also connect employee reporting to incident-response procedures so that a suspicious message can be assessed before it becomes a wider compromise.

    For teams managing connected facilities and operational environments, the human layer should complement technical controls such as access management, network segmentation and monitored response workflows. SectechMedia’s cyber-physical security coverage follows how these controls intersect with physical operations.

    Sources

  • Osavul Raises $10 Million to Detect Hostile Intent Across Cyber and Physical Domains

    Osavul Raises $10 Million to Detect Hostile Intent Across Cyber and Physical Domains

    Hybrid risk intelligence company Osavul has raised $10 million (€8.5 million) in a Series A round led by 33N Ventures, with participation from Balnord, G+D Ventures and existing investor 42CAP. The round, announced October 1, brings the Luxembourg-based company’s total funding to roughly €12 million.

    Reading hostile intent across three domains

    Osavul’s AI platform analyzes open and privileged data sources to identify hostile intent spanning the information, cyber and physical domains, rather than treating them as separate disciplines handled by separate teams. The company, which counts NATO and other defense and government institutions among its customers, says it maps identified intent against a customer’s own people, facilities and supply chains to show where a strike could land.

    Part of a wider funding trend

    Osavul says it has tracked more than 150 state-linked hybrid incidents across Europe since 2022, combining cyberattacks, sabotage, espionage and information manipulation, and plans to use the new funding to expand from government and defense work into enterprise and critical-infrastructure customers. The raise adds to a run of early-stage funding for platforms that promise a single risk picture spanning categories security teams have traditionally monitored with separate tools.

    Sources and further reading

  • CISA Launches 2026 Cybersecurity Campaign Focused on Critical Infrastructure

    CISA Launches 2026 Cybersecurity Campaign Focused on Critical Infrastructure

    The US Cybersecurity and Infrastructure Security Agency has opened Cybersecurity Awareness Month 2026 with a campaign aimed at turning security awareness into operational resilience. Released on October 1 under the theme Securing the Next 250, the initiative places particular emphasis on organizations that own, operate or support critical infrastructure.

    Guidance moves from basic hygiene to continuity

    CISA’s starting points remain familiar: train employees to recognize phishing, require strong and unique passwords, use multifactor authentication and keep software updated. The agency then extends the checklist to logging, tested backups, encryption, incident reporting and rehearsed response plans.

    The 2026 material adds explicit attention to disruption planning. Organizations are encouraged to identify how mission-essential functions could continue when critical systems or even internet access are unavailable. That turns an awareness campaign into a practical continuity exercise rather than a collection of security slogans.

    Critical-infrastructure teams can use the month as a control review

    CISA frames its infrastructure guidance around three actions: reduce attack surfaces, replace end-of-support devices and recover quickly enough to sustain operations. These are recommendations rather than evidence that any individual organization has met a security standard, so owners should translate them into measurable local work: asset inventories, accountable remediation dates, recovery objectives and exercises involving technical, legal and operational leaders.

    The National Cybersecurity Alliance, which co-leads the wider annual campaign, likewise emphasizes strong authentication, software updates and recognizing suspicious activity. For operators, the useful test is whether those behaviors are embedded in routine maintenance and incident procedures after October ends. Related operational-security coverage is available in SectechMedia’s cyber-physical security channel.

    Sources

  • CISA Details High-Risk Flaws in Malcolm Network Analysis Platform

    CISA Details High-Risk Flaws in Malcolm Network Analysis Platform

    CISA has published advisory ICSA-26-254-01 covering multiple vulnerabilities in Malcolm network analysis platform releases earlier than v26.06.0. The advisory, dated October 1, assigns a maximum CVSS v3 base score of 8.8 and recommends moving to an appropriate September 2026 or later release.

    Broad weakness classes increase review scope

    The reported issues span cross-site scripting and open redirect, command injection, path traversal, server-side request forgery, authentication and authorization flaws, default credentials, improper certificate validation, a vulnerable dependency, and weak password hashing. This breadth means remediation planning should account for more than a single defect or attack path.

    CISA identifies Energy, Information Technology, and Water and Wastewater Systems as affected sectors and describes deployment as worldwide. Because Malcolm supports network analysis, weaknesses in the platform can be relevant to teams overseeing monitoring infrastructure and the larger cyber-physical security domain. The advisory facts do not establish exploitation, and organizations should avoid treating severity alone as evidence of compromise.

    Upgrade and exposure-reduction priorities

    CISA recommends updating to the latest September 2026 or later release. It also advises normal safeguards around network exposure, segmentation, access control, and monitoring. Operators should first identify deployed Malcolm versions and confirm the correct upgrade path for their environment, then review exposure and privileged access while the update is planned. Monitoring before and after remediation can help teams detect anomalous activity and verify that defensive controls continue to operate as intended.

    Sources and further reading

  • DIVD Says Zammad Zero-Days Enabled an AI-Driven Network Breach

    DIVD Says Zammad Zero-Days Enabled an AI-Driven Network Breach

    DIVD disclosed on September 30 that two Zammad zero-days were used in a September 21 breach. Its investigation remains ongoing, so the account should be treated as preliminary. DIVD said an AI agent chained the flaws within seconds, while network segmentation limited further movement inside the affected environment.

    Two vulnerabilities with different roles

    CVE-2026-102489 can allow session hijacking followed by remote code execution as the zammad service user. It affects versions 6.3.0 through 6.5.4. The issue is also present in 7.0.0 through 7.1.3, but the supplied record says it is not exploitable there under the stated environmental conditions. Its reported CVSS score is 9.4.

    CVE-2026-102490 can allow a local zammad user to escalate privileges to root. It affects releases from 1.5.0 to before 7.1.0-alpha, and reporting described all released versions at disclosure as affected. Its reported CVSS score is also 9.4. Together, the issues illustrate why application-layer weaknesses can matter to the wider cyber-physical security landscape.

    Response while guidance develops

    Operators should follow current Zammad and DIVD guidance and apply a fixed release when one becomes available. While the investigation and remediation advice continue to evolve, isolating vulnerable systems can reduce exposure. The reported use of an AI agent is based on DIVD’s preliminary incident account; it should not be generalized into a broader claim about attacker capability or automation. Defenders should focus on the verified vulnerability boundaries, access paths, segmentation, and observable evidence in their own environments.

    Sources and further reading

  • Researchers Find 543,699 Live Credentials in Public GitHub Data

    Researchers Find 543,699 Live Credentials in Public GitHub Data

    Truffle Security reports that 543,699 credentials discovered in public GitHub data still authenticated when tested. The finding comes from the company’s analysis of The Stack v3, a dataset containing 224.6 million public repositories and 58.47 billion files, and points to a long-lived operational problem rather than only recent accidental disclosure.

    Scale and age of the exposure

    The researchers identified 1,103,438 exposed credential candidates and tested them on July 27 and 28, 2026. They said 543,699 remained live. The median exposure age was 784 days, while the oldest valid credential dated to 2009. These figures are research findings reported by Truffle Security and should be understood within the methodology described in its primary report.

    The study also found 199,843 live credentials exposed after GitHub enabled default push protection in February 2024. According to the report, 51.8 percent of live credentials used formats that default push protection did not block. For teams managing broader cyber-physical security risks, the result illustrates how software supply-chain weaknesses can create access paths into operational environments.

    Control implications for security teams

    The research indicates that preventive scanning alone does not close the exposure window. Organizations need detection across repositories and development workflows, but they also need a reliable process to revoke and replace discovered secrets. Historical repositories and older commits deserve attention because a credential’s age does not establish that it has expired. Asset owners should treat a confirmed live credential as an incident requiring containment, scope assessment, rotation, and a review of associated access rather than merely removing the visible string from a repository.

    Sources and further reading

  • CISA Flags Exploited FortiMail Zero-Day Requiring Urgent Mitigation

    CISA Flags Exploited FortiMail Zero-Day Requiring Urgent Mitigation

    CISA has added CVE-2026-104286, a critical FortiMail vulnerability, to its Known Exploited Vulnerabilities catalog. The October 1 action gives covered organizations an October 4 due date and calls for forensic triage alongside mitigation, reflecting confirmed exploitation rather than a theoretical risk.

    Affected FortiMail releases and exposure

    Fortinet assigns the flaw a CVSS score of 9.8 and describes it as an unauthenticated path-traversal and null-byte handling issue. According to its advisory, an attacker can use HTTP or HTTPS to write arbitrary files. The affected ranges are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9.

    Fixed builds were listed as upcoming when the advisory was issued. This creates an immediate operational decision for teams responsible for internet-facing mail infrastructure and the wider cyber-physical security environment: reduce reachable attack surface while also checking systems for evidence of compromise.

    Immediate defensive priorities

    Fortinet’s stated workaround is to disable IBE or restrict management access to a trusted private network. Administrators should follow the vendor’s current guidance, preserve relevant evidence from mail and management interfaces before making changes, and conduct the forensic triage requested by CISA. Because fixed builds had not yet been listed in the supplied advisory facts, teams should verify the latest vendor notice before making assumptions about patch availability. The watchTowr analysis offers additional technical context, but remediation decisions should remain anchored to current Fortinet and CISA instructions.

    Sources and further reading

  • Meari IoT Cloud Authorization Flaws Expose Device and Owner Data

    Meari IoT Cloud Authorization Flaws Expose Device and Owner Data

    CISA has warned about two missing-authorization vulnerabilities in the Meari IoT Cloud Platform OpenAPI. The flaws could let an authenticated user cross account boundaries, alter another owner’s device configuration or obtain sensitive device-shadow data.

    What an authenticated attacker could access

    CVE-2026-101104 concerns authorization checks around device configuration. CVE-2026-96613 affects access to the complete device shadow, which CISA says can include device credentials, owner information, network details and telemetry. The advisory lists a maximum CVSS v3 base score of 7.7 and marks all versions as affected.

    The issue is relevant to connected cameras and other cloud-managed devices because the cloud control plane often stores both operational state and credentials. CISA says it is not aware of public exploitation targeting these vulnerabilities.

    No vendor fix was available at publication

    CISA reports that Meari did not respond to coordination attempts and that no fix was planned when the advisory was released. Users are advised to contact the vendor for information. In the meantime, organizations should review whether affected devices are necessary, isolate them from sensitive networks and monitor cloud-account activity for unexpected configuration changes.

    Teams should also rotate exposed credentials where feasible, restrict who can access the management tenant and document an exit plan if risk cannot be reduced. SectechMedia’s video surveillance and imaging coverage explores security considerations for connected camera ecosystems.

    Sources

  • Johnson Controls Fixes Two EasyIO Neo Controller Security Flaws

    Johnson Controls Fixes Two EasyIO Neo Controller Security Flaws

    Johnson Controls has released updates for EasyIO Neo controllers after two security issues were documented in separate coordinated advisories. The vulnerabilities concern exposure of sensitive information and transmission of credentials or session information without adequate encryption.

    What the two advisories cover

    CVE-2026-64892 involves information that can be obtained through physical debugging interfaces. CISA gives it a maximum CVSS v3 base score of 3.5. CVE-2026-64893 addresses cleartext transmission of credentials and session data and carries a maximum CVSS v3 base score of 5.4.

    The affected devices are used in building-control environments, where controller credentials can provide a path into operational functions. CISA says it is not aware of public exploitation targeting either issue. Johnson Controls lists the related product advisories JCI-PSA-2026-20 and JCI-PSA-2026-30 on its security-advisory portal.

    Updates and compensating controls

    The vendor identifies EC version 3.3b64 and CW version 3.3b26 as fixed releases. For the network issue, operators should use HTTPS and disable HTTP where their deployment allows it. Physical access to debugging interfaces should also be restricted, with controller locations monitored as part of the site’s security plan.

    Before updating controllers, building operators should document current logic and configuration, confirm a rollback path and schedule functional testing. Network teams should check that management traffic stays on trusted segments. SectechMedia’s industrial safety and monitoring coverage includes further guidance for operational technology estates.

    Sources