It’s been a dense week in security news, spanning deep-sea biology, international law enforcement takedowns, brain-computer interface vulnerabilities, and a truly staggering pile of industrial control system advisories. Below is our attempt to make sense of it all, from the geopolitical to the merely absurd.
We’ll start, as tradition demands, with cephalopods. Bruce Schneier’s long-running Friday Squid Blogging feature points to a video on deep-sea exploration techniques — specifically the finding that red light, rather than the blinding white searchlights typically used on submersibles, lets researchers observe undersea creatures without scaring them off first. It’s a small but delightful reminder that even in surveillance and observation, the tools you use shape what you’re able to see — a metaphor that, intentionally or not, threads through much of the rest of this roundup.
On the enforcement side, a joint investigation between German and Brazilian police has produced seven arrests connected to a banking hack, with suspects charged with fraud in both countries. These cross-border operations are becoming more common and more necessary, since financial cybercrime rarely respects jurisdiction. The real story here is the coordination itself: getting BKA and Brazilian federal police to move in sync against the same criminal network is the kind of unglamorous institutional work that actually disrupts these operations, more so than any single arrest.
Schneier also shared his upcoming speaking schedule, with stops ranging from LAcon V to the League of Women Voters to CanSecWest. It’s a useful reminder of how wide his audience spans — from science fiction conventions to voter advocacy groups to hardcore security conferences — which says something about how central cybersecurity and technology policy have become to civic life generally, not just to specialists.
Meanwhile, France is dealing with a serious breach: the Directorate General of Public Finances confirmed unauthorized access to its systems after a hacker claimed to have compromised data on 600,000 people, apparently via stolen or misused identity credentials. Tax authorities sit on some of the most sensitive personal and financial data a government holds, and breaches like this — reportedly enabled through identity misuse rather than some exotic zero-day — underscore how identity verification remains one of the weakest links in government cybersecurity, no matter how sophisticated the surrounding infrastructure is.
On a more consumer-facing note, Brian Krebs highlights DecryptAds, a new free tool that scrapes and correlates adtech data to reveal which companies are tracking you across websites and apps. This kind of transparency tooling matters because the ad-tech ecosystem has long relied on obscurity — most users have no realistic way to know who’s harvesting their data or how it’s being resold. Making that information legible, even partially, is a meaningful step toward accountability in an industry that has actively resisted it.
Schneier’s essay co-written with Nathan E. Sanders, “If the Markets Reject OpenAI and Anthropic, the US Should Nationalize Them,” is the most provocative item in this batch. The core argument: both companies were founded on promises of uniquely responsible AI stewardship, and both have drifted from that mission under commercial pressure. The nationalization proposal is deliberately blunt, but it forces a real question worth sitting with — if the premise of “safety-focused” AI labs was always that they’d resist ordinary corporate incentives, what happens now that they haven’t? It’s an argument likely to generate plenty of disagreement, which is probably the point.
Surveillance technology company Flock Safety is also making news, with new privacy controls being rolled out to all customers after scandals involving officers misusing license-plate tracking data. The company will now require “Audit Assistance” features to flag abnormal searches and will cut data retention to seven days in most cases. This is a case study in how surveillance infrastructure, once deployed at scale, tends to generate its own oversight problems — and how companies often respond to abuse scandals with technical patches rather than fundamental rethinking of whether the capability should exist in the first place.
On the malware front, researchers have identified a new Mirai variant with encrypted C2 communications and a credential-sniffing feature that hunts for default logins. Mirai’s basic architecture has proven remarkably durable since its 2016 debut, and each new variant is a reminder that the IoT security problem it exploited — devices shipped with default or hardcoded credentials — remains largely unsolved a decade later. Stealth upgrades like encrypted C2 traffic just make these botnets harder to detect and take down, prolonging their useful life for attackers.
In a genuinely tragic case, Brazilian regulators have ordered Discord to suspend its Go Live streaming feature after finding it contributed to a 13-year-old’s suicide. This story sits at the uncomfortable intersection of child safety, platform design, and regulatory reach — and it’s likely to intensify pressure on platforms globally to build stronger age-verification and content-moderation safeguards into livestreaming features, which have historically received less scrutiny than static content or messaging.
In a striking policy shift, the Trump administration announced it will allow private cybersecurity firms to launch offensive operations against criminal organizations. “Hack-back” authorization has been debated for years in U.S. policy circles, largely because of the serious risks involved — misattribution, escalation, and collateral damage to innocent third parties whose infrastructure criminals may be using. Formalizing private-sector offensive operations is a significant departure from the traditionally government-only stance on offensive cyber action, and it’s worth watching closely how oversight and accountability get built into whatever framework emerges.
Germany, meanwhile, is moving in a related but distinct direction: its cabinet approved legislation granting intelligence agencies new powers to hack foreign systems, sabotage supply chains, and spread disinformation targeting extremists domestically. Described as the biggest overhaul of German spy law since World War II, this is a notable move for a country whose intelligence apparatus has operated under unusually tight restrictions given its history. The inclusion of “feeding false information to extremists” as a sanctioned tactic is especially worth watching, since it blurs lines between counter-extremism and state-run disinformation in ways that could prove controversial.
Finally, we come to the always-substantial stack of CISA industrial control system advisories, and this week’s batch is a good reminder of how varied — and how serious — ICS vulnerabilities can be. Hitachi Energy’s APM Edge product is affected by so-called “Dirty Frag” vulnerabilities threatening confidentiality, integrity, and availability. AVEVA Enterprise SCADA has a deserialization flaw that could allow code execution — a vulnerability class that remains a perennial favorite among attackers targeting industrial software. Perhaps most alarming is the Haiwell IoT Cloud HMI Gateway issue, a maximum-severity (CVSS 10) OS command injection bug that could let an attacker execute arbitrary commands with root privileges — about as bad as ICS vulnerabilities get.
Rounding out the industrial advisories, Siemens had a particularly busy week: Simcenter Femap and Solid Edge both suffer from file-parsing vulnerabilities in BMP and PAR/PSM/DFT formats respectively, either of which could crash the application or enable code execution if a user opens a malicious file — a reminder that engineering and design software, often overlooked in security conversations, is just as exposed to file-based attacks as any office document format. Siemens’s LOGO! Soft Comfort tool has weaknesses in its project-file encryption, including a lack of password salting that leaves it open to offline brute-force attacks, while Siveillance Video, Siemens’s video management platform, carries a remote code execution vulnerability that’s especially concerning given its use in physical security and surveillance deployments.
Two more advisories deserve attention for different reasons. ANDRITZ’s HIPASE-250 and 250 SCALA systems store passwords insecurely, potentially allowing attackers to read device data or gain workstation access — a basic security hygiene failure that continues to show up across industrial equipment despite decades of warnings. And on the medical device side, the Flow Neuroscience FL-100, a brain-stimulation device, was found to rely on hard-coded credentials, potentially letting a nearby attacker manipulate stimulation parameters and override built-in safety limits. Of everything in this week’s advisory pile, that last one is the most viscerally unsettling: a hard-coded credential vulnerability isn’t just a data problem here, it’s a direct pathway to physical harm through a device attached to someone’s head. As brain-stimulation and neurotech devices move from research settings into consumer markets, this kind of finding should serve as an early warning that security review for neurotechnology needs to be treated with the same rigor as, say, pacemakers — not as an afterthought bolted onto a wellness gadget.
Taken together, this week’s stories trace a familiar but still uncomfortable pattern: attackers and defenders alike are becoming more sophisticated, legal frameworks for both offense and privacy are shifting rapidly, and the sheer surface area of vulnerable systems — from tax databases to brain stimulators — keeps expanding faster than our ability to secure it. If there’s a single throughline, it might be that red-light lesson from the squid researchers: sometimes the right tool for observation isn’t the most powerful one, but the one calibrated not to disturb what you’re trying to understand. Security policy, surveillance oversight, and AI governance could all stand to learn something from that.
Leave a Reply