Thursday, October 15, 2026
Published 7:01 AM · 120 articles from 16 sources · about 5 min to read in full
Cyber security
Perimeter and self-hosted software dominated the day, with exploited flaws in Langflow, Nextcloud and AhsayCBS alongside the edge-device zero-days. Supply-chain compromise showed up in GitHub CI secrets and hardware wallets. Law enforcement actions targeted phishing infrastructure and North Korean IT worker fraud.
What happened
Langflow: attackers are exploiting CVE-2026-105740, a CVSS 9.9 authenticated RCE. Honeypots logged 1,423 exploit attempts. The Hacker News ↗
Nextcloud servers: attackers have exploited a critical flaw in Collabora Online's built-in CODE app to plant web shells since September 10. The Hacker News ↗
AhsayCBS: Ahsay fixed CVE-2026-105133 and CVE-2026-105134 after earlier patches proved incomplete. Exploitation dropped web shells and miners. The Hacker News ↗
GitLab has warned of a maximum-severity code execution vulnerability that needs urgent patching. The linked BleepingComputer headline places it in the regex compiler engine. The summary gives no version details. Lobsters ↗
GhostAction compromised about 1,900 GitHub accounts and targeted over 30,000 repositories. GitGuardian counted 3,174 secrets extracted from CI. The Hacker News ↗
curl 8.23.0 fixes an HTTP/2 upload flaw. A researcher turned it into client-side code execution through a malicious server. The Hacker News ↗
Microsoft and Japan's National Police Agency dismantled YAM Store, a marketplace behind the CoGUI and Iron Man phishing kits. The kits sent over a billion scam messages. The Verge ↗
Ledger asked resellers in seven Asian countries to halt wallet sales while it investigates device tampering from a supply-chain attack. BleepingComputer ↗
Articles the model saw · 44
Palo Alto Networks patched CVE-2026-0322, a CVSS 8.6 RCE in PAN-OS management interface, which is under active exploitation.
The Hacker Newscvepalo-altorceactively-exploitedFeed excerpt
Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface. "A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables an
Palo Alto Networks patched a high-severity PAN-OS remote code execution zero-day, CVE-2026-0322, already exploited against firewalls.
BleepingComputercvepalo-altozero-dayfirewallexploitedFeed excerpt
Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. [...]
Cisco warns of active exploitation of a critical Secure Email Gateway flaw allowing unauthenticated file writes and potential root command execution.
The Hacker Newscveciscoactively-exploitedemail-securityFeed excerpt
Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware,
Ivanti patched a Connect Secure zero-day after researchers confirmed in-the-wild exploitation, with a separate privilege-escalation fix promised later.
The Registercvezero-dayivantivpnFeed excerpt
Vendor promises fix for separate privilege-escalation flaw in the coming weeks
CISA urges immediate patching of an Ivanti Connect Secure flaw exploited as a zero-day since October 1st.
BleepingComputercveivantizero-dayactively-exploitedFeed excerpt
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st. [...]
CISA urged immediate updates to Ivanti Connect Secure after actively exploited authentication bypass CVE-2026-104935 (CVSS 8.6), with honeypots logging 105 exploit attempts.
The Hacker Newscveivantivpnactively-exploitedFeed excerpt
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following the disclosure of an actively exploited vulnerability. The security flaw, tracked as CVE-2026-104935 (CVSS score: 8.6), is a case of authentication bypass impacting ICS
The GhostAction credential-theft campaign compromised about 1,900 GitHub accounts and targeted over 30,000 repositories, extracting 3,174 secrets from CI, per GitGuardian.
The Hacker Newsgithubcredential-theftsupply-chainFeed excerpt
The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations. The spike, according to GitGuardian, was observed on October 8 and 9, 2026. "This resulted from compromising the GitHub accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories' CI," security researchers Gaetan
The UK Legal Aid Agency says attackers who breached its systems in April 2025 stole records dating back to 1978.
BleepingComputerbreachuk-governmentdata-theftFeed excerpt
The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice that manages the country's Public Defender Service, says attackers who breached its IT systems in April 2025 stole records dating back to 1978. [...]
Attackers are exploiting CVE-2026-105740, a CVSS 9.9 authenticated RCE in Langflow, with 1,423 honeypot exploit attempts logged.
The Hacker Newscvelangflowrceactively-exploitedFeed excerpt
Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian. Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows. In February 2025, DataStax, the parent company of Langflow, was acquired by IBM. The vulnerability in question is CVE-2026-105740 (CVSS score: 9.9), a case of
Ahsay fixed CVE-2026-105133 and CVE-2026-105134 in AhsayCBS after earlier patches were incomplete, with exploitation dropping web shells and miners.
The Hacker Newscveweb-shellexploitedpatchFeed excerpt
Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners. The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be chained to sidestep authentication and execute arbitrary commands on affected systems. In a report published earlier
Cisco's make-me-root email bug is being exploited as a zero-day by unknown attackers, with CISA issuing a warning.
The Registerciscozero-daycisaexploitedFeed excerpt
Both Switchzilla and CISA sound the alarm
A fridge-related attack hit about 700 supermarkets, causing millions in losses and fires by exploiting outdated internet-exposed devices.
Ars Technicaiotincidentot-securityFeed excerpt
Incident hitting 700 supermarkets exploited outdated devices exposed to the Internet.
Microsoft and Japan's National Police Agency dismantled YAM Store, a marketplace enabling phishing kits CoGUI and Iron Man that sent over a billion scam messages.
The VergephishingtakedownmicrosoftFeed excerpt
We've all gotten a scam text about a nonexistent parking ticket or a fake package delivery, but hopefully you'll start seeing fewer of them. Microsoft says it helped dismantle a marketplace for scammers sending phishing messages like those around the world. Through an investigation with Japan's National Police Agency, it tracked scam activity back to a marketplace called YAM Store and a pair of phishing kits, CoGUI and Iron Man: Since January 2026, YAM Store, CoGUI and Iron Man have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, including more than 750 million messages geared to … Read the full story at The Verge.
DOJ arrested two suspects, charged 14 individuals, and seized about 187 laptops in disrupting North Korean Famous Chollima remote IT worker laptop farms.
BleepingComputernorth-koreathreat-actorfraudFeed excerpt
The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes. [...]
Ledger asked resellers across seven Asian countries to halt wallet sales while it investigates device tampering from a supply-chain attack.
BleepingComputersupply-chaincrypto-wallethardwareFeed excerpt
Ledger has asked resellers and distributors of its wallets in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales and remove products from shelves while it investigates device tampering. [...]
Attackers exploited a critical flaw in Collabora Online's built-in CODE app to plant web shells on Nextcloud servers since September 10.
The Hacker Newsnextcloudweb-shellexploitationFeed excerpt
Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw
Cisco patched an actively exploited Secure Email Gateway zero-day allowing unauthenticated remote root command execution.
BleepingComputerciscozero-daycveemail-securityFeed excerpt
Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges. [...]
Microsoft, Health-ISAC, and partners disrupted three phishing kits CoGUI, Haozi, and Iron Man System tied to over 1 billion scam messages.
The Hacker NewsphishingmicrosofttakedownFeed excerpt
Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. "Since January 2026, the threat actors behind these kits have been responsible for
The DOJ charged 14 people and seized about 187 computers in a crackdown on North Korean remote IT worker fraud across 40+ laptop farms.
The Hacker Newsnorth-koreafrauddojFeed excerpt
The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The indictment charges a mix of U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70 U.S. companies, charging them with wire fraud conspiracy, money
GitLab has warned of a maximum-severity code execution vulnerability requiring urgent patching.
LobstersvulnerabilitygitlabrceFeed excerpt
Comments
Scott Helme argues passkeys are a sound authentication improvement rather than a trap, drawing heavy discussion on Hacker News.
Hacker News (front page)passkeysauthenticationopinionFeed excerpt
Article URL: https://scotthelme.co.uk/passkeys-are-not-a-trap/ Comments URL: https://news.ycombinator.com/item?id=50088935 Points: 554 # Comments: 721
UK sanctions Cryptomus, a crypto platform described as a major conduit for ransomware and cybercrime payments tied to Russia.
Krebs on SecuritysanctionscryptoransomwareFeed excerpt
The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial restrictions.
Hackers took control of Danfoss refrigeration controllers in France, heating supermarket cold units to around 50C overnight.
Schneier on SecurityicsiotattackFeed excerpt
Another IoT cyberattack, this one in France: Hackers gained control of the software that regulates the temperatures of the refrigeration units, forcing some to warm to 50C (120F) overnight, according to one supermarket chain affected. […] Normally, supermarket freezers go through a short period of defrosting overnight, in which temperatures rise slightly. But the hackers ordered the units to heat up and stay hot, although Danfoss did not confirm any reports about just how warm the fridges and freezers could become in that process. Danfoss said the affected cold units were older models whose security software could not be updated to ward off a risk they had identified. Any IoT device that can’t be updated is vulnerable. And, probably, any IoT device that can be updated is also vulnerable.
Law enforcement worldwide disrupted a cybercrime network responsible for over a billion phishing messages across 150 countries.
BleepingComputerphishingtakedownlaw-enforcementFeed excerpt
A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide. [...]
curl 8.23.0 fixes an HTTP/2 upload flaw that a researcher turned into client-side code execution via a malicious server.
The Hacker Newscurlhttp2code-executioncveFeed excerpt
A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client's memory, and the researcher who reported it turned that into code execution on the uploading machine. The curl project fixed it on October 14 in curl 8.23.0. Taking over a client needs exact knowledge of its build and memory layout, and curl expects a real attack to end in a crash
CISA added four actively exploited flaws to its KEV catalog, including CVE-2026-0322 in Palo Alto PAN-OS and CVE-2026-76519 in Cisco Secure Email Gateway.
CISA Advisoriescvekevcisapalo-altociscoFeed excerpt
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when …
New Android malware Hirudo replaces legitimate banking apps with modified versions that disable security checks to steal credentials.
BleepingComputerandroidmalwarebankingFeed excerpt
A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks. [...]
XBOW chained three Chrome zero-days into a drive-by exploit built in six days with OpenAI's GPT-5.6 Sol; Google patched them.
The Hacker Newschromeexploitaizero-dayFeed excerpt
A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said. Its researchers built the attack in six days by directing AI agents running OpenAI's publicly available GPT-5.6 Sol model. Google has since confirmed all three bugs, fixed them, and paid XBOW its top $
ThreatFabric disclosed Hirudo, an Android banking trojan that swaps in patched versions of Indonesian banking apps to evade their checks.
The Hacker NewsandroidmalwarebankingFeed excerpt
Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud. Dutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking
US Air Force pilots reportedly used malware-infected USB drives while planning Afghanistan missions.
The RegistermalwareusbmilitaryFeed excerpt
The term military intelligence seems like an oxymoron in this case
A Lobsters thread discusses Microsoft Defender being released for Linux desktops.
LobstersmicrosoftlinuxendpointFeed excerpt
Comments
UK officials say proposed AI safeguard amendments to the Cyber Security Bill remain under consideration despite a ministerial pledge to act.
The RegisterpolicyaiukFeed excerpt
Officials say amendments remain under consideration despite minister's pledge to act
Researchers show latent backdoors can be implanted in flow-based intrusion detection models by poisoning just 0.001% of training data, and propose a mitigation.
arXiv cs.CR (Cryptography & Security)ml-securitypoisoningidsbackdoorFeed excerpt
arXiv:2610.19766v1 Announce Type: new Abstract: Although Artificial Intelligence (AI)-based Intrusion Detection Systems (IDSs) are increasingly deployed in operational networks, their dependence on large-scale training data introduces a critical vulnerability to stealthy poisoning attacks. We demonstrate that latent backdoors can be successfully implanted in flow-based IDS models by poisoning as little as 0.001% of the training data, maintaining near-nominal performance on clean inputs while ensuring high attack success rates. To address this threat, we propose a diagnostic-first methodology that localizes trigger-relevant features through constrained perturbation analysis and detects poisoning-induced behavioral drift by comparison with a distilled baseline model. The proposed methodology further enables targeted mitigation via automated data sanitization or neuron pruning. Our findings expose the operational risks of near-undetectable backdoors and provide a scalable approach to analyzing, quantifying, and mitigating backdoor exposure in AI-based IDS.
Paper systematizes security of the emerging Agent Skills open standard for LLM agents, defining a threat model and taxonomy.
arXiv cs.CR (Cryptography & Security)ai-agentsthreat-modelresearchFeed excerpt
arXiv:2604.02837v2 Announce Type: replace Abstract: Agent Skills is an emerging open standard that defines a modular, filesystem-based packaging format enabling LLM-based agents to acquire domain-specific expertise on demand. Despite rapid adoption across multiple agentic platforms and the emergence of large community marketplaces, the security properties of Agent Skills have not been systematically studied. This paper presents a systematization of the security of the Agent Skills framework. We define a threat model for the framework and decompose the full lifecycle of an Agent Skill across four phases---Creation, Distribution, Deployment, and Execution---identifying the structural attack surface each phase introduces. Building on this lifecycle analysis, we construct a threat taxonomy comprising seven categories and nineteen scenarios organized across three attack layers, grounded in both architectural analysis and real-world evidence. Each scenario is annotated with whether the exposure follows from the specification or from the latitude the specification leaves to individual runtimes, with the strength of the public evidence supporting it, and with the feasibility of its mitigat…
A2ABreak presents the first systematic security analysis of the Linux Foundation-governed Agent2Agent (A2A) protocol for multi-agent systems.
arXiv cs.CR (Cryptography & Security)a2aai-agentsprotocol-securityFeed excerpt
arXiv:2609.10871v2 Announce Type: replace Abstract: The Agent2Agent (A2A) protocol, now governed by the Linux Foundation, is an open standard that enables autonomous AI agents to discover, authenticate with, and delegate tasks to one another across organizational boundaries. Designed to complement the Model Context Protocol (MCP) for tool integration, A2A is rapidly emerging as the horizontal communication layer of the multi-agent ecosystem. Yet the protocol's security has received no systematic analysis. This paper presents A2ABreak, the first rigorous systematic security analysis of the A2A protocol. We introduce a novel framework that utilizes an LLM-assisted extraction of a verified finite-state machine directly from the natural-language specification, producing a unified model of 37 states and 76 transitions from 929 formalized statements, and then systematically reasons over this model to discover protocol-level vulnerabilities through adversarial verification, under a full-compliance assumption. Our analysis uncovers 11 new vulnerabilities, each exploitable by a specification-compliant adversary without requiring any implementation flaw. Among the findings are cross-client c…
Cloudflare's blog post reports that malicious bots shifted to other networks after strikes disrupted Yandex data centers.
Hacker News (front page)botscloudflareyandexFeed excerpt
Article URL: https://blog.cloudflare.com/yandex-outage/ Comments URL: https://news.ycombinator.com/item?id=50094673 Points: 57 # Comments: 13
Xbow's AI system earned a $250K bug bounty after researchers found a 1-billion-user exploit in six days of work.
The Registerbug-bountyaiexploitFeed excerpt
Xbow earned a $250K bug bounty and all the AI model got was a lousy t-shirt
An OpenAI engineer faces FBI foreign spy charges after a recording device hidden in toilet paper was found in a secure meeting room.
Ars TechnicaopenaiespionagefbiFeed excerpt
OpenAI engineer faces 5 years and $250K fine as FBI lobs foreign spy charges.
Android Authority reports Google automatically links users' phone numbers to all signed-in accounts without clear notice.
Hacker News (front page)googleprivacyandroidFeed excerpt
Article URL: https://www.androidauthority.com/google-auto-phone-number-verification-android-3723117/ Comments URL: https://news.ycombinator.com/item?id=50090349 Points: 64 # Comments: 13
Prospect reports ICE is planning a $100M domestic surveillance program called ERO One.
Hacker News (front page)surveillanceprivacygovernmentFeed excerpt
Article URL: https://prospect.org/2026/10/14/ice-planning-nightmare-domestic-spy-program-ero-one/ Comments URL: https://news.ycombinator.com/item?id=50090246 Points: 167 # Comments: 60
LWN roundup of security updates across AlmaLinux, Debian, Fedora, Mageia, Red Hat, and Slackware distributions.
LWN.netpatcheslinuxadvisoriesFeed excerpt
Security updates have been issued by AlmaLinux (bind9.18, dovecot, flatpak, gd, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base, kernel, opentelemetry-collector, pcre2, and tftp), Debian (curl and keystone), Fedora (aegisub, arm-none-eabi-binutils-cs, avr-binutils, chromium, curl, firefox, kernel, python-jupytext, and xdg-dbus-proxy), Mageia (apache, freeciv, gnumeric, mingw-gdk-pixbuf, and patool), Red Hat (cockpit-image-builder, fence-agents, firefox, ipa, kernel, kernel-rt, pcre2, python-tornado, qt6-qtdeclarative, thunderbird, and webkit2gtk3), Slackware (expat), SUSE (bind, busybox, containerd, cups-filters, fixme, gimp, glibc, google-osconfig-agent, kernel, libtcnative-2-0, openssh, openssl-3, php8, podman, python-oauthlib, python-PyJWT, python-urllib3, python-virtualenv, python311, python313-jupyter-server, python313-kubernetes, python313-logilab-common, python313-markdown-it-py, python313-markdown2, python313-marshmallow, python313-mpmath, python313-mysql-connector-python, python313-oci-sdk, python313-oic, unbound, wpa_supplicant, xen, and xorg-x11-server), and Ubuntu (kernel, libyaml-perl, linux, linux-aws, linux-aws-fips, linux-aws-hwe, l…
Proposes an adaptive Gaussian mixture model to detect physical-layer CSI spoofing attacks against indoor wireless localization when attacker and node are close.
arXiv cs.CR (Cryptography & Security)wirelessanomaly-detectionresearchFeed excerpt
arXiv:2610.18946v1 Announce Type: new Abstract: Physical-layer spoofing attacks pose a critical threat to wireless localization systems by manipulating channel state information (CSI). Detecting such attacks becomes particularly challenging when the attacker and the legitimate node are spatially proximate, as their CSI characteristics become increasingly similar. To address this challenge in indoor scenarios, we propose an adaptive Gaussian mixture model (GMM)-based detection framework that learns legitimate CSI patterns and detects spatial inconsistency through statistical anomaly detection. Using a massive multiple-input multiple-output (MIMO) experimental dataset with 64 uniform linear array (ULA) antenna and 5 mm spatial resolution, we evaluated our detector against CSI spoofing attacks with spatial displacements ranging from 50 mm to 450 mm. The adaptive GMM achieves 95-98% detection rate for displacements above 150 mm while maintaining 1% false alarm rate. We benchmark our approach against conventional GMM, local outlier factor (LOF), one-class support vector machine (SVM) and k-nearest neighbors (k-NN) classifiers, demonstrating overall superior detection performance of our …
TrackShield proposes a runtime resource-management layer defending multi-object trackers against SlowTrack-style availability attacks on embedded GPUs.
arXiv cs.CR (Cryptography & Security)availability-attackcomputer-visionresearchFeed excerpt
arXiv:2610.19278v1 Announce Type: new Abstract: High-performance camera-based perception pipelines must sustain per-frame real-time budgets on resource-constrained embedded GPU platforms. Availability attacks such as SlowTrack inflate the persistent state of multi-object trackers: data-association workload accumulates across frames, so per-frame latency increases and drives the pipeline past its deadline. Detector- and NMS-layer defenses do not directly control this persistent tracker-side resource. We present TrackShield, a lightweight runtime resource-management layer that protects the tracker at the point where attack-induced workload accumulates. TrackShield combines low-overhead anomaly monitoring with staged birth capping, pruning of young or weakly matched tracks, and per-stage association-input admission control. Its hard admission guard provides a deterministic bound on admitted association workload, independently of the heuristic monitor. On a Jetson AGX Orin, TrackShield reduces attacked tracking-stage latency from $139.90$ to $6.27$\,ms and whole-pipeline P99 latency from $190.9$ to $48.8$\,ms, at a benign MOTA cost of $1.06$ points. As an availability defense, TrackShi…
Proposes a mutually authenticated session key protocol using CRYSTALS-Kyber for edge-IoT peer-to-peer energy trading systems.
arXiv cs.CR (Cryptography & Security)post-quantumiotresearchFeed excerpt
arXiv:2610.19491v1 Announce Type: new Abstract: The rise of quantum computing presents substantial challenges to the security of Peer-to-Peer (P2P) energy trading systems. This paper introduces an innovative mutual authenticated session key agreement protocol aimed at protecting edge-IoT P2P energy trading communications in the quantum era. Each peer is an IoT-enabled smart metering device that is registered by an edge registration authority and acts as both producer and consumer. The proposed protocol incorporates CRYSTALS-Kyber's quantum-resistant cryptographic suite to guarantee the authenticity and confidentiality of negotiated session keys in the presence of quantum threats. Furthermore, it leverages the Hedera Hashgraph public blockchain, which is recognized for its quantum-resilient design, to ensure transparency and support efficient revocation mechanisms. Extensive comparative analyses have been conducted to demonstrate the protocol's superiority over existing alternatives, including both traditional schemes based on classical cryptography and emerging early-stage post-quantum approaches, in terms of performance and security features. By combining robust security and high …