6 min read · 10 sources

Enterprise software is finally breaking past the screen and hitting physical factory floors. At SAP TechEd, SAP launched a major physical AI initiative aimed at driving shop-floor hardware - including industrial arms, autonomous mobile robots, and quadrupeds - directly from enterprise resource planning workflows.

At the same time, traditional perimeter security continues its steady collapse. Between critical authentication broker flaws in Microsoft Authenticator, widespread lateral movement through legacy VPN appliances, and an uncoordinated zero-day drop hitting Tailscale SSH, the push toward zero-trust machine identity has shifted from architectural preference to immediate operational triage.

Here is what is breaking, what is deploying, and what engineers need to patch today.

SAP’s new platform turns every robot motion into a line‑item in the ERP ledger, giving factories the same audit trail as financial transactions.

SAP ties industrial robotics directly to the ERP ledger

Source: news.sap.com ↗

SAP wants to turn real-world automation into direct database transactions. The enterprise software giant introduced its physical AI platform, designed to sit between ERP state machines and industrial hardware like quadrupeds, sensors, and warehouse robotics. Built in collaboration with partners including Foxconn, Intel, Holcim, and Arçelik-LG, the system provides bidirectional communication: business logic dictates hardware tasks, while operational telemetry loops back as structured, auditable ERP data.

For operations and software engineers in manufacturing environments, this bridges the historical gap between operational technology (OT) protocols and business applications. Instead of maintaining fragile middleware or bespoke pipelines to sync programmable logic controllers (PLCs) with inventory databases, the physical AI architecture governs, logs, and triggers mechanical tasks through standard enterprise processes.

Android Authenticator flaw leaks work tokens to unprivileged apps

Source: thehackernews.com ↗

Microsoft issued an update for a severe vulnerability, tracked as CVE-2026-80097 with a CVSS score of 8.6, in its Android Authenticator application. The flaw existed inside the app’s AccountChooserActivity broker component. When handling authentication intents, the broker verified the cryptographic signature of the app it was attempting to impersonate (such as Microsoft Teams) instead of validating the caller identity of the application initiating the request.

This oversight allowed malicious apps installed on the device - operating with baseline permissions - to initiate an authentication flow, trick the broker, and extract enterprise OAuth refresh and access tokens. Those tokens grant access to user emails, internal calendars, and cloud files. Exploitation requires the victim to interact with a legitimate sign-in prompt, but no specialized Android permissions are needed. Systems and endpoint administrators should enforce updates to Microsoft Authenticator version 6.2606.4246 or later immediately.

Active VPN gateway exploits force the migration to Zero Trust

Source: networkworld.com ↗

The steady stream of edge-device compromises has reached a breaking point, prompting renewed calls to completely retire legacy perimeter VPN architectures. Ransomware groups continue to capitalize on remote code execution and session-hijacking flaws across public-facing enterprise gateways. Recent attacks exploit PAN-OS (CVE-2026-0257), Ivanti (CVE-2026-104935), WatchGuard Firebox (CVE-2025-9242 and CVE-2025-14733), Citrix NetScaler (CVE-2025-5777), and SonicWall appliances (CVE-2024-40766).

Traditional VPN concentrators place authenticated clients directly inside flat Layer 3 subnets, giving attackers an immediate launchpad for lateral discovery, credential harvesting, and domain takeover. Security teams are migrating to identity-aware access proxies and zero-trust network access (ZTNA) models. By pulling edge management consoles off the public internet entirely and binding access strictly to identity and micro-segmented applications, operations teams can stop automated scanners from turning a single device flaw into an entire network breach.

Unmonitored Linux EDR fallback states create invisible blind spots

Source: technologymatch.com ↗

Security engineers managing Linux fleets often trust their endpoint dashboards too much. A comprehensive analysis highlights that Linux EDR agents frequently report healthy heartbeats while failing to capture system calls, file integrity events, or network sockets. Kernel version mismatches, missing eBPF features, or tracing subsystem crashes silently push agents into degraded operational modes.

Both CrowdStrike’s Reduced Functionality Mode (RFM) and Microsoft Defender’s Netlink fallback keep the sensor daemon alive and communicating with cloud consoles, but completely disable deep process tracing and containerized workload isolation. Systems teams should not rely on SaaS console status alone. Verify telemetry locally across endpoints using vendor diagnostic utilities, test eBPF and kernel compatibility explicitly before upgrading distributions, and validate that runtime event monitors capture behavior within transient containers.

IBM and Cisco launch identity frameworks for agents and switches

Source: newsroom.ibm.com ↗

Non-human identities and dynamic machine credentials are expanding faster than existing IAM setups can manage. At TechXchange 2026, IBM unveiled an agent governance framework designed to contain autonomous workflows. Integrating HashiCorp Vault alongside watsonx Orchestrate and NVIDIA OpenShell, the platform replaces hardcoded secrets with dynamic, short-lived credentials, establishes cryptographic identities for autonomous agents, and monitors runtime interactions to halt rogue lateral agent-to-agent access.

At the network layer, Cisco took a parallel approach by partnering with Teleport to launch Privileged Infrastructure Access. This framework eliminates long-lived passwords and static credentials on core switches and routers. Access to control planes is instead governed by ephemeral certificates mapped directly to human operators or automation runbooks, cutting off attack vectors where adversaries hijack persistent credentials to pivot through network switching fabric.

Oracle adds Apache Iceberg support and enterprise semantics to its Lakehouse

Source: oracle.com ↗

Oracle updated its Autonomous AI Lakehouse with a business semantic layer and direct table access for Apache Iceberg. Operating across OCI, AWS, Azure, Google Cloud, and on-premises storage, the engine allows analytics workloads and agentic systems to run native SQL queries against object storage without extract, transform, load (ETL) runs or custom data duplication pipelines.

The built-in semantic layer maps business definitions and compliance policies directly over external datasets, including PostgreSQL, MongoDB, SQL Server, and Amazon S3. For data engineers, this standardizes access controls and context modeling across fragmented lakes, ensuring that automated systems query real-time analytics without bypassing row-level security or enterprise business rules.

Tailworm vulnerabilities expose Tailscale SSH to rapid root compromise

Source: securityweek.com ↗

A zero-day disclosure from Cyberdione Labs revealed Tailworm, a chain of 11 vulnerabilities impacting Tailscale client 1.104.2 and headscale 0.29.5. The primary vulnerabilities target Tailscale SSH, where improper handling of root forwarding controls allows an adversary with authorization on a single mesh node to elevate privileges and gain root access on remote nodes in under a second per hop.

The exploit operates without requiring target credentials or user interaction on the victim host. Tailscale is preparing hotfixes, but network administrators should immediately inspect tailnet ACLs, enforce explicit device authorization tags, and disable unnecessary SSH agent or port forwarding until client patches are fully distributed across nodes.

Edge deployments: Tabular AI aboard the ISS and PHP2Shell fallout

Source: news.sap.com ↗

SAP and Hewlett Packard Enterprise have extended data modeling into orbit, announcing plans to test the SAP-RPT tabular foundation model on the HPE Spaceborne Computer-2 aboard the International Space Station. The model consumes structured telemetry natively without requiring task-specific fine-tuning, aiming to predict edge hardware failures, reconcile corrupt sensor tables, and handle real-time maintenance triage within power- and compute-constrained environments.

Back on the ground, critical vulnerabilities dubbed PHP2Shell forced emergency patch cycles across major telecommunications and infrastructure providers. Flaws in underlying PHP parsers exposed management panels and public endpoints. Palo Alto Networks released out-of-band hotfixes for PAN-OS management interfaces, Cisco patched Duo Access Gateway installations, and NTT temporarily shut down cloud administrative portals and national alerting infrastructure to isolate vulnerable services. Infrastructure engineers should prioritize scanning external-facing appliances for embedded PHP components and isolate exposed administrative ports from public transit paths.