Search This Blog

Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Latest News

SonicWall Patches Exploited VPN Authentication Flaw

  SonicWall has released security updates addressing a high severity vulnerability in SonicOS that could allow attackers to bypass SAML auth...

All the recent news you need to know

AI in Policing Risks Amplifying Racial Bias, Researchers Warn

 




When the Los Angeles Police Department started feeding decades of arrest records into predictive algorithms, it believed it was upgrading how it approached crime. What it actually did, researchers now argue, was automate its existing prejudices.

The growing use of artificial intelligence in law enforcement is raising alarms among criminologists and legal scholars who say these systems absorb the biases already embedded in historical police data and repeat them at scale. Far from offering a neutral, data-driven view of crime, the tools risk entrenching the same inequalities they claim to transcend.

At the core of the problem is how these systems learn. AI tools for predictive policing are trained on past arrest and crime records, which means they begin with a picture of crime shaped by previous policing decisions rather than by crime itself. Areas that received heavier patrol in earlier decades show more recorded incidents. The algorithm reads that density as a future risk signal and directs officers back to those same neighborhoods. More arrests follow. The data is updated. The cycle repeats.

Sarah Brayne, a sociologist at the University of Texas at Austin, spent time inside the LAPD studying how the department used big data systems. In research published in the *American Sociological Review*, she found the department was increasingly using data to predict crime rather than respond to it. The data flowing into those systems was skewed from the start: crimes in public places were more likely to be recorded, and patrol resources were disproportionately concentrated in Black neighborhoods. Once that history was absorbed by the algorithm, Brayne wrote, "the predictions appear impartial." They were not. The models, she concluded, create "a feedback loop in which they not only predict events such as crime or police contact, but also contribute to their future occurrence."

The problem sharpens when that underlying data was produced under conditions of institutional misconduct. Researchers at New York University's AI Now Institute studied 13 jurisdictions across the US and found that in nine of them, police departments had trained predictive systems on records gathered during documented periods of unlawful or biased policing. Chicago is the starkest case. The city's police department was under federal investigation for discriminatory practices at the same moment it adopted a risk-flagging algorithm to identify people likely to be involved in shootings. The residents federal investigators had identified as targets of biased policing overlapped substantially with those the algorithm flagged. The list eventually grew to more than 400,000 names, 56 percent of them Black men.

Chicago shut down the program in 2019 after its own inspector general raised concerns about its effectiveness. Los Angeles scrapped a similar initiative, Operation LASER, the same year. A 2023 analysis of Geolitica, formerly known as PredPol, one of the most widely deployed predictive policing tools in the country, found a success rate below half a percent across more than 23,000 predictions made in Plainfield, New Jersey.

Not everyone in the field believes the technology is fundamentally broken. Dr. Dimitrios Kollias, an associate professor in multimodal artificial intelligence at Queen Mary University of London, argues that modern AI systems do not simply replay their training data. "They can combine learned information in new ways and generate outputs that were not explicitly present in those examples," he told the BBC. He acknowledges dirty data is a genuine concern but argues systems can be tested for unfair outcomes and redesigned when they fail. As those systems grow more autonomous, he adds, ensuring they remain under meaningful human control becomes a priority in its own right.

The consequences of algorithmic bias run well beyond law enforcement. A 2019 study published in the journal Science examined a healthcare AI tool used to allocate additional patient support across US hospitals. The system measured patient need by predicting the cost of their care. Because less was already being spent on Black patients than on equally sick white patients, often due to poorer access to care, the algorithm systematically directed resources toward white patients. When researchers recalibrated it to predict illness directly rather than cost, the share of Black patients selected for extra support would have risen from roughly 18 percent to 47 percent. The fix was straightforward once someone looked for the problem. That is precisely the case researchers make for independent oversight.

Legislators are beginning to respond. In January 2024, seven US Congress members asked the Justice Department to pause grant funding for predictive policing programs until their discriminatory impact could be assessed. A White House policy from March 2024 requires federal agencies to independently test rights-impacting AI tools, though the mandate does not extend to state and local police departments. In Britain, 17 civil society organizations called the same year for a full ban on predictive policing.

Dr. Carolyn McKay, an associate professor in digital justice at the University of Sydney Law School, says cleaning up biased data is not a matter of removing a few stray errors. The corrupted records are not sitting at the edges of an otherwise sound dataset. They run through the foundation the algorithm was built on. Even systems redesigned to flag locations rather than individual people can produce the same outcomes, she warns, because the neighborhoods they target were shaped by years of concentrated policing long before any algorithm got involved.

The root of the problem, most researchers agree, is not the machine. It is the human judgment baked into the data the machine inherited. The algorithm did not decide what suspicious behavior looked like, or which crimes were worth recording. People did. Until those decisions are independently examined, AI will keep reflecting them back.



Barracuda Patches Two Security Flaws That Could Let Attackers Take Over Email Security Gateways


Experts have shown how two vulnerabilities in Barracuda's Email Security Gateway can be chained to execute arbitrary commands with root privileges without requiring an attacker to log in.

The vulnerabilities, tracked as CVE-2026-116606 and CVE-2026-111560, affect Barracuda's email-filtering appliance and could allow remote attackers to bypass security restrictions and gain complete control of vulnerable systems.

According to cybersecurity firm watchTowr, which published its technical analysis, the attack chain combines an authorization bypass flaw with a command injection vulnerability. Barracuda released security patches for the issues earlier this week.

The first vulnerability, CVE-2026-116606, is an authorization bypass flaw that allows unauthenticated attackers to access a configuration restoration function and modify the appliance's global settings. The second, CVE-2026-111560, is a command injection vulnerability that enables commands to execute with root privileges.

Mandiant assigned CVSS severity scores of 9.3 and 8.6 to the two vulnerabilities, respectively.

How the attack chain works

In its technical investigation, watchTowr discovered that the authorization bypass stems from the appliance's password-change process. When a password change request fails, the system incorrectly returns a low-privilege user role instead of terminating the request completely.

The researchers also found that Barracuda's backup verification mechanism relies on a secret embedded within the appliance's code. Since this secret is not securely protected, attackers can generate a valid checksum for a specially crafted configuration backup and restore it on the targeted device.

The uploaded configuration can contain a manipulated timezone value. When the appliance processes this setting, it passes the value to a shell command that executes with root privileges.

watchTowr demonstrated the attack by successfully writing a file to the appliance with root-level permissions.

Affected products

CVE-2026-116606 affects Barracuda Email Security Gateway, while CVE-2026-111560 impacts five additional products, including Load Balancer Application Delivery Controller (ADC), Message Archiver, WAF Control Center, Web Application Firewall (WAF), and Web Security Gateway (WSG).

However, the complete unauthenticated attack chain applies specifically to Email Security Gateway. Exploitation of the command injection vulnerability on the other affected products requires administrator access.

What next?

Barracuda has released security updates addressing both vulnerabilities and recommends that customers install the appropriate patches or upgrade to the latest fixed firmware versions.

As of the disclosure, neither vulnerability had been listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no publicly reported incidents linked the flaws to active exploitation.

Data Sovereignty Is Essential for India's Digital Infrastructure, Says RBI Governor


Sanjay Malhotra, Governor of the Reserve Bank of India (RBI), emphasized the significance of maintaining sovereign data centers in order to safeguard critical financial information and strengthen the country's digital infrastructure. As information technology has become an integral part of the banking industry, security infrastructure, operational resilience, and cybersecurity have become increasingly important in maintaining financial stability, especially in light of the growing threat landscape being shaped by artificial intelligence (AI). 


Prime Minister Narendra Modi inaugurated the RBI's new data center complex and Cybersecurity Training Institute in Bhubaneswar on October 25, and made these remarks following the inauguration. With a capital investment of Rs 169 crore, the facility is expected to enhance the reliability of critical financial services and to reduce the likelihood that essential banking operations will be disrupted.

A spokesperson for Doordarshan reported that Malhotra explained that the central bank's technology infrastructure facilitates the use of applications by the general public, financial institutions, and government departments. He pointed out that information technology cannot be considered merely a supporting function, as several essential financial operations are directly dependent upon the availability and security of these technologies. 

NEFT and RTGS are major payment infrastructures that will be supported by the new data center. Furthermore, the RBI's integrated ombudsman system and applications used by financial institutions regulated by the central bank will be supported by the new data center. In addition to government banking operations, it will also accommodate financial institutions regulated by the RBI. 

A key component of Malhotra's statement was the RBI's role in the Unified Payments Interface (UPI) ecosystem in India. Although UPI is operated by the National Payments Corporation of India (NPCI), final settlement of transactions takes place through the RBI's data centres and applications. To ensure the availability of the central bank's infrastructure within the wider digital payments ecosystem, it is important. 

Four independent data centres are located within the Bhubaneswar complex, which has been accredited as Tier IV by the Uptime Institute, the highest level of its data centre classification. This facility will be operated independently of third party cloud service providers, allowing RBI to maintain greater control over its critical infrastructure and sensitive financial information. Additionally, the project's geographical location will contribute to its resilience. 

A geographically separated and seismically isolated location in Bhubaneswar reduces the possibility that a localised disruption will affect all facilities simultaneously. The RBI previously operated three data centers in Maharashtra. Additionally, this development reflects the increasing importance of data sovereignty in the Indian financial infrastructure, where uninterrupted access to critical systems and the control of sensitive information remain essential security priorities. 

As part of the RBI's infrastructure security efforts, cybersecurity expertise is also being developed throughout the financial sector. In the Bhubaneswar project, there will be a Cybersecurity Training Institute, which will occupie approximately two-thirds of the campus, and the remaining portion will accommodate the data centre. It is intended that the institute will provide training to personnel of the RBI, bank employees, and professionals from other financial institutions. 

A number of emerging technologies, such as artificial intelligence (AI), big data analytics, quantum technology, and blockchain, will be studied as part of its programming. There will also be research activities conducted in order to investigate ways to improve the security and efficiency of financial systems. With AI posing new challenges to financial institutions, specialized training is becoming increasingly important.

The technology can provide opportunities for improving banking operations and security monitoring; however, if it is misused, it can result in cyberattacks, automated fraud, and attempts to exploit weaknesses in digital systems, increasing in sophistication. Financial sector readiness therefore relies heavily on cybersecurity professionals staying up to date on these developments. 

Governor of the Reserve Bank, Sanjay Malhotra, stressed the need to maintain personnel informed of technological developments and the growing importance of cybersecurity in the context of artificial intelligence. By attending the institute, financial sector professionals will be better equipped to comprehend emerging risks and respond to changes in cybersecurity. In addition to investing in digital infrastructure, the initiative emphasizes the importance of building human expertise. 

For data centers and advanced technology systems to be secure, trained professionals must manage operations, identify security weaknesses, and ensure service reliability are required. It was pointed out during the inauguration that cybersecurity was directly related to India's economic security by Prime Minister Narendra Modi. As financial services become increasingly dependent on digital technologies and digital banking, it becomes increasingly important to protect the financial infrastructure.

As well as highlighting the institute's role in developing cybersecurity and emerging technologies, Finance Minister Nirmala Sitharaman also highlighted the institute's efforts. Due to its emphasis on energy efficiency and water conservation, the RBI has also applied for a Platinum rating with the Indian Green Building Council. 

Bhubaneswar represents a larger effort to strengthen India's control over critical financial technology infrastructure by incorporating locally sourced materials in its construction approach. To protect the country's financial ecosystem, sovereign data management, geographically distributed infrastructure, and specialized cybersecurity training will remain important. As digital payments and artificial intelligence-driven services continue to increase, a comprehensive data management system, geographically distributed infrastructure, and cybersecurity training will be essential. 

An important strategic investment is being made in Indian financial infrastructure with the establishment of the sovereign data centre and cybersecurity training institute. In order to enhance the long-term reliability and resilience of the country's digital financial systems, the RBI intends to strengthen control over critical financial data and develop specialised cybersecurity expertise.

Bogotá Investigates Possible Health Agency Email Compromise Linked to European Airport Bomb Hoax

 

Authorities in Bogota, Colombia, have opened an investigation into whether an email account used by a public health agency was accessed without authorisation or if it was spoofed in a bomb threat email sent to an airport in Europe. The threat comes after a wave of bomb threats via email has caused chaos at airports throughout Europe since Monday. Flights have been diverted, and security checks and searches have been conducted but so far no devices have been found. 

In the Bogota related email seen by Recorded Future News, the message was sent to contacts in Rome’s Fiumicino Airport and appeared to be sent using the Subred Sur Occidente domain. This is a public hospital network covering the southern west of Bogota. The email said there were explosives on board two flights heading to Rome. One was a Finnair flight from Helsinki which was escorted into Rome by Italian Air Force fighter jets. The other was an Aer Lingus flight which was diverted to a French military base. 

Bogota’s mayor’s office has confirmed it received an international alert regarding a possible use of an email address used by a health agency in the city. An investigation has been ordered to find out what happened, according to a statement on the Subred Sur Occidente website. The administration also highlighted that there have been suspected cyber-attacks on public institutions recently. It cannot be ruled out that international hackers have been involved or that government email addresses have been compromised. 

It is still being investigated whether the email account used by the hospital network was used to send the threat, or if it was just spoofed. There is also no evidence to currently link staff from the health agency to the threat or why the domain was chosen. Several of the threats to European airports have been signed off with names linked to a Russian misogynistic group which is banned in Russia. 

However experts have warned that this does not mean they can be blamed. The threats have also been sent to several Irish media outlets on Friday. The messages claimed to be linked to the same group. The Irish government have said the threats to media outlets are serious and it is not clear if they have come from individuals or an organised effort. 

However the timing and similarities to the airport disruptions mean it is likely to be an organised campaign. A spokesperson for the Taoiseach of Ireland could not be immediately reached to ask if the government’s statement was based on any specific intelligence. It is not known who has sent the series of threats.

FCC Starts Blocking Devices for What's Inside Them, Then Gives Intel a Pass

 



The Federal Communications Commission moved this month to block two consumer gadgets from the American market, not because of who made them, but because of a chip buried inside. A dashcam and a wireless video transmitter both contained components manufactured by HiSilicon, a Huawei subsidiary, putting them on the wrong side of a rule that took effect October 13 and extends Washington's existing tech blacklist deep into the supply chain.

The same day those products were pulled, October 22, the FCC handed Intel a one-year reprieve for the foreign-built robots running in its semiconductor factories. The two decisions landed together, and together they sketch the shape of a problem that will follow this policy for years.


What Changed and Why It Matters

The FCC has maintained what it calls the Covered List since 2021, a register of foreign technology companies whose products are deemed national security risks. Placement on the list means a company's equipment cannot receive radiofrequency authorization in the United States, which amounts to a ban on importing and selling it here. For years, the restriction was straightforward: it applied to products built by listed companies. Huawei was on the list; Huawei routers were blocked.

The new Third Report and Order changed the terms. It bars RF authorization for any device that incorporates logic-bearing components from a Covered List entity, so long as the end product itself would have been blocked. The two gadgets flagged on October 22 were the first to be caught under this framework, but they will not be the last.

The FCC's characterization of the HiSilicon chips is worth noting. The agency called them "foreign surveillance chips" and cited their "built-in detection algorithms for human faces," a feature sold to consumers as a way to identify strangers near a home. HiSilicon is a Huawei subsidiary, and Huawei is already on the Covered List, which is what triggered the rule. FCC Chairman Brendan Carr praised the enforcement action and said more would follow.

"Manufacturers must now conduct their own supply chain audits to determine whether any of their parts trigger the rule, with limited guidance on where to look."


A Rule With Gaps

The logic is clean on paper. If a company is considered a threat, its chips should not enter American products regardless of who assembles them. But applying that logic requires knowing what is inside a device, and that is harder than it sounds.

No authoritative list currently exists identifying which companies manufacture covered components. Huawei itself did not name HiSilicon in a 2023 subsidiary disclosure filing to the FCC. That gap means the burden of compliance falls on manufacturers who must audit their own supply chains, often without clear guidance on which subsidiaries or affiliates to look for. A separate FCC proceeding that would require Covered List entities to submit complete subsidiary and affiliate disclosures is still pending and not yet in effect.

The rule's reach also has limits. It applies only to components made by entities actually named on the Covered List. Unnamed manufacturers of foreign industrial robots or consumer routers, for instance, do not fall under it, even if those products are covered under the separate "sector-based" rules the FCC introduced for certain product categories starting in December 2025.


Intel's Narrow Escape, and Its Clock Problem

When the FCC added humanoid robots, quadrupeds, and other industrial robotic devices to the Covered List in July 2026, it created an immediate operational problem for Intel. The company's semiconductor fabrication plants run on automated guided vehicles, or AGVs, purpose-built machines that shuttle materials across factory floors. Intel says these machines have been in continuous operation for roughly two decades and that no American-made alternatives meet its technical requirements.

Intel applied for relief before it was clear the rule even applied to its machines, flagging the uncertainty in its filing. The FCC granted a one-year hardware waiver on October 22, the first of its kind in the robotics category. Intel committed to keeping the vehicles on-site under its control, making no changes that would improve their RF characteristics, and not introducing new capabilities.

The problem is the timeline. The hardware waiver expires in October 2027. A separate waiver covering software and firmware updates on the same machines runs through January 2029, leaving a 15-month gap between the two deadlines. Replacing industrial robots typically requires years of commissioning, procurement evaluation, and integration work, a timeline that does not fit inside 12 months. At least one industry analyst has described the arrangement as "a temporary fix for a long-term problem." Intel will need to identify domestic alternatives, pursue an extension, or seek a longer-term exemption well before next fall's deadline.


What Comes Next

The FCC's Covered List has been moving in one direction: more products, more companies, more components. Drones, consumer-grade routers, power inverters, and now industrial robots have all been added to sector-based restrictions that cover foreign-produced products across entire categories, regardless of which specific company made them. Companies operating in those sectors can apply to the Department of Homeland Security or the Department of War for conditional approval, which requires committing to a domestic manufacturing onshoring plan.

The two decisions on October 22 sit on opposite ends of that spectrum. The HiSilicon enforcement shows the new component rule starting to bite, pulling products off the market that passed previous scrutiny because the finished gadget was not made by a listed company. The Intel waiver shows how far the domestic alternative market still has to go before the restrictions can hold without exceptions. The list is getting sharper. The supply chain it assumes into existence is still being assembled.



Hackers Exploit OpenSSH SSHole Flaw Within Hours

 

A newly disclosed OpenSSH vulnerability, nicknamed SSHole, is already being exploited in the wild. The flaw, tracked as CVE-2026-123158 and carrying a CVSS score of 8.1, lets unauthenticated attackers log in to certain Linux accounts that have no usable password set. Security firm Previdian observed the first exploitation attempt less than nine hours after the vulnerability was published, and confirmed successful root access on an Alpine Linux honeypot. 

The issue affects Linux systems running OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled. Alpine Linux’s default OpenSSH server configuration is among the affected setups. An attacker can send an oversized password—between 257 and 1,024 bytes—to trigger the bug and gain access to accounts configured with an asterisk (*) as their password hash. This means attackers do not need to steal SSH keys or valid credentials to obtain access. 

SSHole stems from password-handling behavior linked to a 2016 patch for CVE-2016-6210, a username-enumeration flaw. Under the specific conditions, OpenSSH mistakenly treats a failed password-hashing operation as successful authentication because it produces the same asterisk value used to mark password-disabled accounts. The SSH daemon then compares that value with the account’s stored password field and allows the login. Importantly, the flaw does not bypass passwords on accounts that have valid password hashes. 

The consequences depend heavily on the privileges of the compromised account. A successful attack grants the attacker the permissions already held by that account, which could include access to deployment credentials, application secrets, and connected infrastructure. From there, intruders may move laterally across systems or disrupt services. The vulnerability does not affect Dropbear, glibc-based Linux distributions, non-Linux systems, or systems that authenticate passwords through PAM.

Administrators should act quickly by installing OpenSSH 10.6p2 or their distribution’s patched package and restarting the sshd service. Alpine also advises reviewing /var/log/messages for “Accepted password for” entries involving accounts that should not accept password logins, including root, Alpine, or key-only users. Administrators should inspect recent users, files, authorized keys, and doas usage; if a suspicious login cannot be ruled out, the system should be treated as compromised.

Featured