Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

39 Child Tracking Brands Linked to One Chinese Server, Exposing 45 Security Vulnerabilities

  GPS trackers for children may put the tracked individuals and the people tracking them in danger, according to an investigation presented ...

All the recent news you need to know
surveillance software
Chinese spyware Commercial global cyber attacks LightSpy spyware malware surveillance software

LightSpy Spyware Expands Global Reach, Targeting Devices Across More Than a Dozen Countries

 

Cybersecurity researchers have uncovered new evidence suggesting that the Chinese-linked LightSpy spyware operation has expanded significantly, with infections and infrastructure now spanning more than a dozen countries, including the United States and several European nations.

A report from cybersecurity firm Arctic Wolf describes LightSpy as an increasingly sophisticated commercial surveillance platform whose capabilities appear to be offered to governments, military organisations and private companies. First identified in 2018 and previously linked to Chinese state-backed hacking activity, the spyware is now believed to be controlled by a single threat actor that provides the platform to multiple customers.

The researchers identified at least 117 servers associated with LightSpy across multiple countries. The infrastructure indicates that the operation has developed a much wider global footprint than earlier investigations had revealed.

LightSpy has also evolved beyond targeting individual operating systems. Its modular architecture reportedly allows it to compromise smartphones, Apple devices, Windows computers and Linux servers, while newer versions have introduced the ability to target internet routers.

The router capability represents a particularly concerning development because compromising network equipment could allow attackers to observe or potentially access several devices connected to the same network. Arctic Wolf said some of the compromised routers are associated with NATO member countries, although it did not disclose the specific organisations involved.

The latest versions of LightSpy reportedly offer extensive surveillance capabilities. Once installed, the spyware can collect sensitive information such as precise location data, chat conversations, stored passwords and screen recordings. It can also remotely delete files and potentially make compromised devices unusable, giving operators capabilities that extend beyond surveillance to data destruction.

According to Arctic Wolf, LightSpy's development reflects a wider commercialisation of advanced spyware. Capabilities once primarily associated with intelligence agencies and state-sponsored cyber operations are increasingly being packaged and sold to a broader customer base.

The researchers said LightSpy appears to be marketed as a commercial product, featuring customised branding, demonstrations and billing mechanisms designed for prospective customers. This suggests the operation may function as a structured surveillance business rather than being limited to a single espionage campaign.

Researchers also uncovered a potential link to a Chinese contractor through an operational mistake. According to Arctic Wolf, one of the spyware operators accessed the malware's administration panel and used their real name and office address while ordering Kentucky Fried Chicken. Investigators believe the incident provided an unusual clue that helped connect the infrastructure to its operators.

Despite the findings, several questions surrounding LightSpy remain unanswered. Arctic Wolf said the identities of the platform's customers, the total number of victims and the precise relationship between its operators and the Chinese government have not been publicly established.

The findings nevertheless underscore the growing sophistication and international reach of commercial spyware. As surveillance technologies become increasingly commercialised, advanced cyber capabilities are becoming accessible to a broader range of customers, extending the potential threat well beyond traditional state intelligence operations.

Read more »
Technology
Adversarial Clothing AI Surveillance Black hat Facial Recognition Technology

Black Hat 2026: How Special Clothing Could Trick AI Surveillance Cameras

 

AI surveillance is getting smarter, but a new Black Hat 2026 demonstration suggests clothing could also become a privacy tool. PCMag reported that hacker and SecKC founder Bill Swearingen showed how printed “adversarial patterns” may confuse facial-recognition systems and lower their confidence in detecting a person. 

The issue matters because modern surveillance does not just record video; it often analyzes it in real time. Facial-recognition and person-detection tools look for shapes, edges, and visual cues that help algorithms decide whether a face or body is present. Swearingen’s idea is to inject visual noise into that process so the system misreads what it sees, even though a human observer would just notice an ordinary scarf or shirt. 

At the center of the project is a simple but powerful problem: machine vision can be tricked. According to PCMag, Swearingen created an algorithm that generates patterns designed to disrupt detection models, and he suggested those patterns could eventually be printed on fabric for everyday wear. In related coverage, the project was described as working against multiple computer-vision systems, not by hiding someone from the camera, but by preventing the software from reliably flagging them as a target. 

Still, the technology is not ready to be treated as a guaranteed shield. PCMag noted that the concept has only been proven digitally so far, not in real-world physical fabrics under normal conditions. That means lighting, camera angle, movement, garment fit, and software updates could all change the result, so a pattern that works in a demo may fail in daily life. 

Even with those limits, the experiment highlights a bigger debate about privacy and surveillance. Supporters see anti-surveillance clothing as a low-tech, wearable form of resistance that does not require batteries or devices. Critics, however, argue it may become an arms race, where surveillance companies retrain their models to ignore the patterns and reduce their effectiveness over time. The broader issue is that public anonymity is becoming harder to preserve as AI systems spread, and people may increasingly look for creative ways to stay untracked.
Read more »
Vulnerability Management
AI Code Security AI Coding Risks Cyber Security Dependency Security Open Source Security Remediation Debt Secure Software Development Software Supply Chain Security Vulnerability Management

Enterprise AI Coding Adoption Fuels Open-Source Security Debt


As artificial intelligence coding tools are rapidly adopted, development teams are able to develop software more quickly, however, cybersecurity teams are also becoming increasingly under pressure due to the increasing volume of AI-generated code. Open-source dependencies have become increasingly common, and their rapid introduction can result in increased vulnerabilities for an organization and additional remediation workloads. This is a key concern. 

A study involving 300 security and engineering leaders in technology, financial services, healthcare, manufacturing, and government sectors revealed the growing challenges associated with managing this risk. Organizations may face remediation debt if dependencies accumulate faster than security teams can assess and resolve them, which could adversely affect security operations, compliance, productivity, and overall business resilience. 

AI coding systems are expected to become increasingly autonomous as time goes on, resulting in software and dependencies being introduced into enterprise environments at a pace that existing security processes may not be able to keep up with. Prioritization is also becoming increasingly important in light of the growing number of vulnerabilities. If every CVE is treated equally, security resources will be consumed rapidly without addressing the weaknesses that are most significant. 

There are several factors that can be considered in determining which issues require immediate action, including whether the vulnerability is reachable, whether the flaw can be exploited, and which systems or data will be impacted. Security controls are also becoming more involved in software development earlier. Testing static applications for security and analysis of software composition can be incorporated into development environments and continuous integration/continuous delivery pipelines to identify vulnerable dependencies and insecure code before the release process progresses further. 

By following this approach, security teams are less likely to discover large volumes of unresolved issues when development has been completed. AI-assisted development is becoming increasingly reliant upon dependency visibility. 

Software bills of materials can provide a comprehensive inventory of components used across applications, while controlled package sources and dependency policies can prevent libraries with known vulnerabilities from entering the development environment. It is also necessary to clearly define who will be responsible for clearing this backlog. 

Creating remediation deadlines based on risk level and assigning vulnerabilities to development teams responsible for the affected code can assist in making the process more measurable. Creating and verifying tickets as well as completing fixes automatically can also contribute to preventing vulnerabilities from remaining unresolved after they have been identified. The security backlog itself is not the only challenge that AI-assisted development can present when engineers approve code generated without understanding the design or underlying assumptions. 

In the event that the generated code becomes part of critical application logic, such gaps in understanding can make it more difficult to make later changes and troubleshoot. Increasing volumes of artificial intelligence-assisted development are putting additional pressure on existing vulnerability management methods. 

Generated code may bring in open-source libraries and transitive dependencies that may not be examined as thoroughly as manually selected components. These dependencies can result in a steady buildup of vulnerabilities that require assessment and remediation, which may cause security teams to face a steadily increasing backlog. 

Counting CVEs alone cannot provide a reliable indication of actual risk. There may be more urgent urgency for issues with limited exposure when they affect application components, are exposed to untrusted input, or are associated with active exploitation. The business impact of an issue also plays a role in determining which findings should be addressed first, as well as which findings should be addressed first. 

Security validation is therefore becoming increasingly integrated into the development process. Identifying insecure code and vulnerable dependencies before they reach production can be accomplished by integrating static application security testing and software composition analysis into development workflows and Continuous Integration/Continuous Delivery pipelines. The implementation of this approach can reduce the amount of remediation work that must be done by security teams following deployment. 

Greater visibility into software components is also of importance. A software bill of materials can provide information about the open-source packages that are used across various applications, while controls around approved package sources can help prevent known vulnerable or unsuitable dependencies from entering development environments. Additionally, it is necessary to clearly define ownership of the remediation process itself. 

By assigning vulnerabilities to teams responsible for the affected code and establishing a risk-based remediation timeline, and verifying the fixes, organizations can prevent unresolved findings from building up as AI-driven development continues.

In order to ensure successful software development, organizations will need stronger visibility, risk-based vulnerability prioritization, and security controls throughout the development process. A strong focus on dependency management and remediation work can assist in preventing the growth of security debt from becoming a larger risk for the software supply chain.
Read more »
OT Security
Black Hat 2026 Critical Infrastructure Cyber Attacks CISA OT Security

Hackers Shift From Disrupting to Destroying Critical Infrastructure

 

Cyberattacks on operational technology (OT) systems have shifted from data theft and ransom demands toward outright physical destruction, according to experts speaking at the Black Hat USA cybersecurity conference in Las Vegas. This trend poses a serious threat to critical infrastructure operators, many of whom are already underfunded and understaffed while managing aging industrial equipment amid heightened geopolitical tension. 

From espionage to physical sabotage 

Cheri Benedict, a cybersecurity and supply chain adviser at the White House's Office of the Federal Chief Information Officer, said OT attacks are increasingly targeting physical operations rather than just data. Matthew Rogers, the operational technology cybersecurity lead at CISA, echoed this concern, noting a "real desire and willingness to cause this impact at scale". Recent Iran-linked intrusions into U.S. water systems have failed to compromise drinking water safety, but Iran has also worked to disable safety monitoring systems across water and other sectors—an escalation Rogers called "what should actually scare you". 

A CISA advisory updated on July 22 revealed that Iran-linked actors planted malware on a programmable logic controller that overrode instruction sets responsible for maintaining safe operating parameters. This tactic traces back to 2017, when malware called Triton disabled safety equipment at a Saudi Arabian power plant, marking one of the earliest known examples of this attack style. Because operators rarely inspect PLCs unless they malfunction, such malware can remain undetected for years, making each compromised controller what Rogers described as "a ticking time bomb". 

Wipers replace ransomware 

Neal Pollard, a partner at consulting firm Control Risks, said wiper malware has become more prevalent than ransomware in some cases, reflecting "a change in intent and understanding" among threat actors even as overall attack volume stays consistent. Rogers added that hackers are increasingly deploying code designed to permanently cripple industrial control systems, warning that the U.S. lacks sufficient replacement equipment to recover at scale from such destruction. 

The panel emphasized that longstanding weaknesses—default passwords, unpatchable legacy devices, and unencrypted communications—remain the primary entry points for attackers. Vu Nguyen, CISO at the Department of Justice, noted that isolated OT environments with limited connectivity make log collection and incident response especially difficult. Notably, Rogers said none of the recent malicious activity relied on a single CVE or advanced AI tools, since OT systems remain so vulnerable that sophisticated exploits simply aren't necessary.
Read more »
technology
ai agents apis business data consulting MCP Salesforce software technology

Salesforce’s Headless 360 Pushes Enterprise Software Beyond the Browser

 




Salesforce is preparing for a future in which employees may no longer need to open Salesforce to use it.

At TDX 2026, CEO Marc Benioff described the shift with the line, “Our API is the UI,” as the company introduced Headless 360. The platform makes Salesforce capabilities, including Customer 360, Agentforce and Slack, accessible through APIs, Model Context Protocol (MCP) tools and command-line interfaces (CLI), allowing applications and AI agents to interact with Salesforce without relying on its traditional browser interface. Salesforce says its Headless 360 MCP server can support operations including querying and updating records, managing permissions, working with Apex and interacting with platform events.

The change challenges a model Salesforce spent decades building: software operated primarily by humans through screens and sold largely through user-based licensing.

If an AI agent performs the work, the traditional per-seat model becomes harder to justify. An agent does not need a dashboard or training programme in the same way an employee does. It needs authenticated access to data, tools and workflows.

Salesforce is already experimenting with consumption-based pricing. Its Agentforce model includes Flex Credits, which customers can use for agent actions, alongside conversation-based and user-based pricing. Salesforce lists 100,000 Flex Credits at $500, while certain Agentforce services can also be priced according to successful outcomes.

That transition could also affect the Salesforce consulting ecosystem. Implementation work historically centred on configuring screens, workflows and processes for employees. As agents take over more workflows, organizations may instead spend more on data quality, permissions, API architecture, agent governance and testing.

Salesforce has a reason to disrupt itself before competitors do.

AI-native platforms can be designed around APIs and autonomous agents without inheriting the assumptions of traditional enterprise software. By opening Salesforce to agents, the company is betting that its strongest asset is not the interface but the business data, permissions and workflows underneath it.

That makes governance a central part of the strategy.

Salesforce's Einstein Trust Layer is designed to keep Agentforce grounded in enterprise data while respecting existing access controls. Salesforce describes capabilities including dynamic grounding, secure data retrieval, auditability and zero-data-retention arrangements with external model providers.

But making Salesforce accessible through MCP and external AI systems creates another risk: the company no longer fully controls the interface through which users interact with its platform.

A sales manager could eventually ask an external AI agent to analyse pipeline data, update opportunities, trigger Salesforce workflows and coordinate information across Slack, Salesforce and other enterprise systems. The AI layer becomes the operating interface while Salesforce functions as the underlying system of record.

MCP also introduces new security considerations. Research has identified threats including tool poisoning and prompt injection, where malicious instructions embedded in tools or outputs can influence an agent's behaviour. The U.S. National Security Agency has similarly warned about cascading prompt-injection risks in MCP environments, where one agent's output can become another system's input.

The pricing problem remains unresolved as well. Agent actions vary enormously in complexity. Updating a contact record is not equivalent to autonomously completing a sales renewal, making a simple “pay per action” model difficult to align with business value.

Salesforce's Headless 360 strategy therefore represents more than a move away from browsers. It is a test of what enterprise software is worth when humans are no longer its primary operators.

Interfaces can be replaced. What is harder to replace is trusted business data, permission architecture, proprietary workflows and the infrastructure required to let autonomous systems act safely.

Salesforce is betting that those foundations will remain valuable.

The risk is that by making them accessible to external agents, it could also help those agents become the new interface between enterprises and Salesforce itself.

Read more »
Vehicle Tracking
ALPR Surveillance Flock Cameras Flock Safety License Plate Readers Mass Surveillance Privacy Vehicle Tracking

Flock Cameras Spark Debate Over Surveillance and Civil Liberties


With Flock Safety operating one of the largest networks of automatic license plate readers (ALPRs), automatic license plate readers (ALPRs) are becoming more common across the United States as part of surveillance infrastructure. As a result of their rapid expansion, privacy advocates have expressed concern that such systems may create detailed records of vehicle movements in communities across the nation. 

How Flock Cameras Work

While traffic enforcement cameras usually focus on specific violations, Flock cameras photograph passing vehicles and translate the images into searchable records. License plates, locations, times, make, model, color and body type can all be included in records, along with distinguishing features such as bumper stickers or visible damage that can assist investigators in finding a particular vehicle or based on broader descriptions.

Watchlists are also available for cars associated with stolen vehicles, missing people, or criminal investigations, triggering alerts in the event that a potential match is detected. It is possible for participating law enforcement agencies to search the data of other agencies, depending on how their networks are configured. 

Why Police Departments Use Flock Cameras

A flock camera is a compact device that captures passing vehicles and records information such as license plate numbers, vehicle make and model, color, and location. Throughout the course of the investigation, data will be stored in a searchable system that will allow participating law enforcement agencies and other authorized organizations to access the system, potentially enabling the tracking of individual vehicle movements. 

The company claims that its technology does not utilize facial recognition and that customers can manage access to collected data through controls. However, given the extent to which its network is deployed, concerns have been raised about the manner in which vehicle data is shared, retained, and utilized. Approximately 120,000 cameras are now deployed across 49 states in the company's system, which is deployed by police departments, businesses, schools and homeowner associations in more than 6,000 communities. 

With the capabilities of the technology, more than just a license plate can be captured, as the records may include distinctive vehicle characteristics such as bumper stickers, dents, and other visible features. With the proliferation of surveillance cameras along public roads as well as private properties, questions regarding data access, civil liberties, and data privacy are becoming increasingly difficult to separate from the broader discussion surrounding public safety technology. 

Why Flock Cameras Are Controversial

It is not just about a single camera recording the movement of a vehicle that is of concern, but the network surrounding it at large. By using a large number of cameras, investigators may be able to reconstruct patterns of movement involving individuals who are not suspected of committing crimes by repeating recordings of the same vehicle at various times and locations. 

The use of vehicle-location data has also been criticized by privacy advocates, who have noted that it may reveal visits to sensitive areas, such as health facilities, protest sites, and churches. Searches based on historic ALPR records are still subject to legal uncertainty, including when warrants are required. Flock rejects the characterization that its system constitutes mass surveillance, however. 

Data Sharing Raises Additional Concerns

In addition to bringing Flock into the debate about immigration enforcement, data sharing has brought Flock into the public eye. According to a 2025 review of search logs, there were more than 4,000 Flock searches conducted by local and state police at the request of federal authorities, including searches that may have been related to immigration enforcement. 

An investigation conducted in 2026 revealed that outside police departments searched school cameras. It has been contested that the federal government has direct access to Flock's cameras, claiming it does not have a contract with U.S. Immigration and Customs Enforcement and does not have the right to access its data or cameras directly. 

Unauthorized Access and Personal Misuse 

In addition to allegations of misuse, there have been 28 documented cases in which officers are alleged to have abused license plate reader systems to monitor spouses, former spouses, colleagues, or romantic interests. 

Another instance occurred in July 2026 when North Carolina authorities arrested a Charlotte-Mecklenburg police officer who was accused of conducting an unauthorized license plate search for a non-law enforcement purpose using Flock and the state criminal justice database. 

Flock Cameras Can Also Produce False Alerts

If surveillance data is inaccurate, it can also pose problems. During June 2026, a driver in Minnesota was stopped by Flock alerts triggered by license plates that were similar to license plates reported stolen in another state. According to Flock, license plate translations are sometimes incomplete or inaccurate, which can result in negative consequences when automated alerts are used to influence police conduct. 

Communities Push Back Against Flock Surveillance

Over 80 municipalities have reported terminating or refusing to renew their Flock agreements, while Washington has imposed restrictions on how license plate data can be collected, searched, and shared as a result of the debate. 

Opposition to the technology has gone beyond policy debates. There have been at least 33 incidents in which Flock cameras have been damaged or destroyed, including cases where cameras have been painted, blocked, cut down, or burned in 23 states.
Read more »
Subscribe to: Posts (Atom)

Featured