ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “beacon”

40 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 402Ransomware 194Vulnerability 133Threat actor 132Exploit / PoC 63Data breach 54Policy & legal 27Industry 25Phishing & fraud 18Research 13AI safety & security 10Advisory 5AI tools & infra 3Tools 3
SeverityAllcritical 294high 513medium 210low 57info 11

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Cyclops Blink Evolves Into x86-64 Linux Implant With Packet Sniffing and Internal Network Scanning

Sophos uncovers a new x86-64 Cyclops Blink Linux implant with packet sniffing and internal network scanning on compromised Cisco FMC appliances.

Sophos identified a 64-bit Linux Cyclops Blink implant in August on compromised Cisco Firewall Management Center devices, persisting via SysV init scripts and masquerading as the process 'kworker01'. The modular malware runs five child processes for reconnaissance, file transfer, scanning, packet capture, and persistence, and beacons hourly over outbound TLS to hardcoded C2 89.34.96.56 on ports 43856 and 49172. The family was previously tied to Russian-linked Sandworm activity on WatchGuard appliances, though Sophos treats 2026 attribution cautiously. The packet-capture module applies configurable filters to retain credentials, cookies, and authentication tokens from raw Ethernet traffic.

Cyber Security News · 2d agoMalware in the wild

Sandworm-Linked Cyclops Blink Returns With Network Scanning and Packet-Sniffing Capabilities

Sophos uncovers a 64-bit Cyclops Blink variant on hacked Cisco FMC appliances, adding internal network scanning and selective packet capture; linked to Sandworm.

Sophos CTU analyzed a new 64-bit x86-64 Cyclops Blink implant (timezone_check) deployed on Cisco Secure Firewall Management Center appliances compromised via CVE-2026-20079 authentication bypass and CVE-2026-20316 low-privileged login. The activity is assessed with high confidence as Russian-nexus, with a moderate-confidence link to Sandworm (IRON VIKING, also tracked as Seashell Blizzard). The implant runs a parent controller plus five worker modules, masquerades as [kworker/0:1], persists via SysV init scripts at /lib/tz/timezone_check, and beacons to hard-coded C2 89.34.96.56 over a custom TLS protocol on ports 43856 and 49172. New module 0x11 scans internal IPv4 networks for SSH, SMB, LDAP, VMware, HTTP/HTTPS and VPN services, while module 0x12 performs filtered packet capture that can expose cleartext credentials, cookies and tokens.

GBHackers · 2d agoMalware in the wild 10 sourcesCVE-2026-20079CVE-2026-20316

Meta debuts its Muse AI agent. Will consumers trust it?

Meta launched Muse, a consumer AI agent powered by Muse Spark that connects to users' apps to execute tasks like emailing, booking travel, and payments.

Meta introduced Muse, a personal AI agent for US users that connects to email, calendars, payments, shopping, and other services to execute tasks such as booking travel, lowering bills, and completing purchases via Link by Stripe. The agent runs in a dedicated Muse Secure VM with a separate Sentinel agent kept apart at the system level, and Meta claims it cannot see passwords or payment data and does not share conversations with ad systems. Muse is free to start, with Power ($20/month) and Maximum ($100/month) subscription tiers, and is available on the web, iOS, Android, and WhatsApp, with Meta AI glasses support planned. The launch follows Meta's $18 billion multistate consumer-harms settlement and comes as rivals like Gemini Spark and Claude Cowork push agentic AI.

TechCrunch · AI · 8d agoAI industry 3 sources1

14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI

Trend Micro found 14 trojanized npm calendar utilities delivering RedC2 4.0, an AI-powered cross-platform backdoor sold for $99.99.

Trend Micro's TrendAI identified 14 functional but trojanized npm packages (streak-*, kit-map-vim, map-streak-kit) that load a bundled Linux implant, the RedShell beacon of RedC2 4.0, without requiring install hooks. RedC2 4.0, sold by Red Offsec for $99.99 and advertised on Hack Forums by actor MarlboroMan in June 2026, offers shell access, credential theft, SOCKS5 proxying, in-memory execution, and an LLM-driven component called Red Agent for natural-language post-exploitation. The framework has evolved from version 2.0 in August 2025 through 4.0, with the Linux beacon introduced in the latest release.

The Hacker News · 23d agoMalware in the wild

BeaconKV: Key-Value Cache Compression Guided by Beacon Queries for Efficient Large Reasoning Model Inference

BeaconKV introduces training-free KV cache compression using beacon queries, cutting long-reasoning inference memory up to 5.8x while preserving accuracy.

The paper shows recency-based KV cache compression assumptions fail in long-horizon reasoning because Thought Revisiting Tokens (TRT) re-attend to distant context such as early task-solving plans. TRT queries cluster into a small number of similarity groups, which BeaconKV exploits by maintaining compact beacon query representatives to anticipate revisited KV pairs without storing full query history. The training-free method achieves up to 5.8x memory reduction and over 4.3x throughput improvement across four open-source large reasoning models while nearly preserving full cache accuracy.

Hugging Face daily papers · 13d agoAI research1

Exposed AWS Access Key Linked to Data Breach Affecting 1500+ UK Charities

CRM provider Beacon says a compromised AWS access key likely caused a data breach affecting more than 1,500 UK charities.

Beacon, a UK CRM provider serving the charity sector, disclosed that an exposed AWS access key was the likely root cause of a data breach. The incident affected data belonging to more than 1,500 UK charities. The company said the compromised cloud credential enabled the unauthorized access; specific record volumes and data types are not detailed in the report.

Infosecurity Magazine · Aug 13, 2026Data breach in the wild

Tracking OceanLotus’ new Downloader, KerrDown

Unit 42 identifies KerrDown, a new OceanLotus (APT32) downloader active since 2018 targeting Vietnamese speakers via malicious macros and DLL side-loading.

Unit 42 tracks KerrDown, a previously undocumented downloader family used by OceanLotus (APT32) since at least early 2018, primarily targeting Vietnam or Vietnamese-speaking individuals. Delivery uses macro-laced Microsoft Office documents embedding base64-encoded 32-bit and 64-bit DLLs, and RAR archives containing a legitimate program abused for DLL side-loading. KerrDown is dropped as main_background.png, downloads a DES-encrypted payload from a URL, and executes it directly in memory. Researchers used Jaccard-index similarity analysis to identify the new family, connect campaign samples, and infer patterns in the group's working hours and days.

Palo Alto Unit 42 · Aug 17, 2026Malware in the wild1

After accusations of selling ‘perv glasses,’ Meta prepares to sell a pair without a cameranew

Meta is preparing camera-less Luna smart glasses with microphones and an AI button to access its chatbot and Muse agent, per reports.

The Information reports Meta is developing Luna, a camera-free smart glasses model with six built-in microphones and a side button that activates Meta's AI chatbot and its Muse consumer agent, possibly unveiled at next week's Meta Connect event. The move follows consumer backlash over camera-equipped glasses that critics called 'perv glasses.' Meta's Reality Labs continues to post large losses despite the smart glasses line's relative market success.

TechCrunch · AI · 48m agoAI industry

xHunt Campaign: Attacks on Kuwait Shipping and Transportation Organizations

xHunt deployed custom backdoors Hisoka, Killua, Gon, and EYE against Kuwait shipping and transportation organizations, using DNS tunneling and email-draft C2 channels.

Unit 42 observed the xHunt campaign targeting Kuwait transportation and shipping organizations between May and June 2019, installing backdoors named after characters from the anime Hunter x Hunter, including Hisoka, Killua, Sakabota, and Netero. The tools use HTTP and DNS tunneling for C2, and Hisoka v0.9 added an unusual email-based C2 channel that abuses Exchange Web Services with stolen credentials to exchange email drafts. The Gon tool provides port scanning, file transfer, screenshots, remote command execution, and RDP session creation, while EYE acts as a cleanup failsafe if a legitimate user logs in. Related activity targeting Kuwait between July and December 2018 was reported by IBM X-Force IRIS, suggesting the campaigns are likely related.

Palo Alto Unit 42 · Aug 17, 2026Threat actor1

'HTTP Terminator' Hunts for Novel Desync Attacks

PortSwigger's James Kettle discusses HTTP Terminator, an AI-powered open source tool that uncovered new HTTP request-smuggling (desync) techniques.

PortSwigger researcher James Kettle spoke with Dark Reading about HTTP Terminator, an AI-powered open source tool built to hunt for novel HTTP desync vulnerabilities. The tool has already discovered new HTTP request-smuggling techniques, extending Kettle's prior desync research.

Dark Reading · 21d agoTools

Bitsight connects threat intelligence and exposure monitoring across the supply chain

Bitsight made Beacon generally available, combining supply-chain exposure monitoring with MCP support to feed threat intelligence into AI workflows.

Bitsight announced general availability of Beacon, which continuously monitors critical vendors for exposure, vulnerabilities, malicious activity, intrusion, stolen credentials and compromise. New Model Context Protocol (MCP) and agentic capabilities push Bitsight intelligence into AI-enabled workflows, with over 400 customers signing up for early access in one month. The company cites data that third parties now account for almost half of enterprise breaches, up over 60% year over year.

Help Net Security · 2d agoTools

Meta is back with Muse Glimmer: local, agentic, multimodal, and open source

Meta releases Muse Glimmer, an open-source model built for local, agentic, multimodal use.

Meta has released Muse Glimmer, a new open-source model highlighted on the Hugging Face blog. The model is designed to run locally and supports agentic and multimodal workflows. Details on parameter count and benchmarks were not provided in the title; the release marks Meta's return to open model releases.

Hugging Face Blog · Aug 10, 2026Model release

Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain

The Hunter's Ledger tracked campaign UTA-2026-024 using Sliver C2, Domain Admin account creation, and Ethereum-based C2 rotation to compromise a US organization's Windows domain.

The Hunter's Ledger tracked an intrusion at one unnamed US organization as UTA-2026-024, staged from exposed server 193.233.202.17 with a Sliver beacon. Operators created a non-expiring Domain Admin account, enabled RDP with NLA disabled, dumped SAM, SYSTEM and SECURITY hives plus LSASS memory, and disabled eight endpoint protection services. A Node.js implant resolved its C2 server from an Ethereum smart contract that rotated domains five times in five months, while SYSTEM scheduled tasks with backdated dates and DNS allowlist manipulation provided persistence. The infrastructure ties to a confirmed ransomware incident, but no encryptor deployment was proven in this intrusion.

Cyber Security News · 8d agoThreat actor in the wild

Meta Introduces Muse, a Personal AI Agent That Runs on Its Own Dedicated Secure Cloud Computer

Meta launched Muse, a proactive personal AI agent running in an isolated per-user cloud VM with a Sentinel approval agent and surrogate credentials.

Meta introduced Muse, a consumer agent that performs long-horizon tasks like email, travel booking, and bill negotiation, rolling out in the US on iOS, Android, muse.ai, and WhatsApp with free and paid tiers. Each user gets a dedicated Muse Secure VM where the agent runs in a systemd-nspawn cell, while a separate Sentinel agent approves every network request at layer 4/7 and injects real credentials only at the network boundary. The underlying Muse Spark 1.3 model, which Meta says cuts tool calls by ~20% and tokens by ~25% versus 1.2 and is near state-of-the-art on prompt-injection resistance, is available via Meta Model API, with open weights on the roadmap.

MarkTechPost · 7d agoAI industry

16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets

Typosquatted RubyGems packages deliver the StubMaker infostealer, stealing browser credentials, crypto wallets, and Telegram data from Windows developers.

OpenSourceMalware discovered a typosquatting campaign on August 15, 2026, tracked as StubMaker, publishing 16 malicious RubyGems packages (e.g., ubnuler, brumdler, brundlef) that imitate popular Ruby dependencies. The gems use the extconf.rb install hook to fetch a 22 MB Rust-based loader from GitHub, which launches a Go-based stealer ("wincfg") containing a DLL that bypasses Chromium's app-bound encryption to extract browser credentials, payment cards, crypto wallets and seed phrases, and Telegram Desktop data. Stolen data is uploaded as a password-protected ZIP to Gofile, with the download link sent over plain HTTP. The same actor also deployed 37 typosquatted npm packages delivering the identical loader and infostealer, and abused RubyGems' namespace reuse to republish malicious versions of yanked gems.

The Hacker News · 26d agoMalware in the wild

Bisonal Malware Used in Attacks Against Russia and South Korea

Unit 42 details a Bisonal malware variant, active since 2014, targeting Russian and South Korean defense organizations via PDF-disguised spearphishing emails.

In early May, Unit 42 discovered a campaign delivering a Bisonal malware variant against at least one Russian communications security and cryptography company and one unidentified organization in South Korea. The variant, in the wild since at least 2014, introduces a new C2 cipher and rewritten networking and persistence code, with only 14 samples collected to date. Attackers spoofed Russian state corporation Rostec in spearphishing emails carrying an executable disguised with a PDF icon; the dropper decrypts an RC4-encrypted DLL and establishes persistence via a registry Run key. Bisonal has been used since 2013 against government, military, and defense targets in South Korea, Russia, Japan, and India, alongside successors Bioazih and Dexbia.

Palo Alto Unit 42 · Aug 17, 2026Malware in the wild

Inside Meta’s push to put robots to work in data centers

Meta is testing robots to perform technician tasks in its data centers, advancing automation of AI infrastructure operations.

Meta is testing robots to perform tasks currently done by human technicians in its data centers. The push signals ambitions to automate AI infrastructure operations at scale. The excerpt provides no details on robot suppliers, deployment scale, or timelines.

Ars Technica · AI · 17d agoAI industry

StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack

Sansec details actively exploited StyleSmuggler 0-day (CVE-2026-75650, CVSS 10.0) unauthenticated RCE in Magento and Adobe Commerce, patched by Adobe hotfix APSB26-146.

Sansec is investigating StyleSmuggler, an actively exploited unauthenticated remote code execution chain in Magento Open Source and Adobe Commerce, now tracked as CVE-2026-75650 with CVSS 10.0. Adobe released hotfix VULN-39341 via APSB26-146 (priority 1) on September 7 for versions 2.4.4 through 2.4.9, but stores were being exploited for roughly three days before the fix existed. The implant is a Rust backdoor that disguises itself as kworker, fc-cache, or chronyd processes and exfiltrates host data in MessagePack records sent as fake NTP replies over UDP port 123. Adobe advises rotating the encryption key and every credential it protected, and Sansec stresses patching does not clean already-compromised stores.

Sansec (Magento / e-commerce security) · 11d agoExploit / PoC in the wildCVE-2026-756501

Metasploit Wrap Up: Payloads and Exploits, and Scanners, Oh my!

Rapid7's weekly Metasploit roundup highlights newly added exploit modules, payloads, and scanners in the Metasploit Framework.

Rapid7 published its weekly Metasploit Wrap Up summarizing community contributions to the Metasploit Framework, including new exploit modules, payloads, and scanners. No article text was available; the post serves as a routine digest for practitioners tracking newly packaged modules.

Rapid7 Blog · 19d agoTools

Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers

SpecterOps released CDP-Enable-BOF, a Beacon Object File that enables Chrome DevTools Protocol in live Chrome or Edge processes on Windows for session hijacking.

SpecterOps released CDP-Enable-BOF, an x64 Beacon Object File that activates Chrome DevTools Protocol inside running chrome.exe or msedge.exe processes on Windows, exposing cookies, history, saved passwords, and authenticated sessions without administrator rights. It calls Chromium's StartRemoteDebuggingServer on the browser UI thread to stay reliable under CFG, TLS, and CET, and was tested on Chrome 147 and Edge 147. The technique builds on work by DeathFlamingo and Cedric Van Bockhaven; Google had hardened remote debugging in Chrome 136 after attackers used it to steal cookies post-App-Bound Encryption. Defenders can watch Sysmon Event IDs 8 and 10 for injection into browser processes.

The Hacker News · 22d agoResearch2

Open-source secrets scanning tool Sift hunts credentials in Microsoft 365, Slack, and Jira

Stratus Security open-sourced Sift, a CLI secrets scanner covering Active Directory, SharePoint, Teams, Slack, Jira, and Confluence, outperforming Snaffler in benchmarks.

Stratus Security released Sift, a free open-source command line tool that hunts passwords, API keys, and sensitive data across local disks, Windows shares, Active Directory, SharePoint, OneDrive, Teams, Slack, Jira, and Confluence. In the firm's benchmarks, Sift scanned 250,000 files in 10.61 seconds versus Snaffler's 25.48 and averaged 92 MiB memory versus Snaffler's 337 MiB. Optional false-positive filtering runs through a local language model via Ollama, and scans write checkpoints so interrupted runs resume. The tool found thousands of credentials in Jira ticket comments that prior pentesting had missed.

Help Net Security · 14d agoTools

The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions

Elastic details KREMLIN, a Brazilian banking malware whose malicious Chrome/Edge extension forges Chromium integrity checks to steal sessions.

Elastic Security Labs tracked operation REF9334 and its KREMLIN toolkit, a Brazilian banking malware campaign impersonating twelve banks across seven campaigns since May 2025. The infection chain uses multi-stage obfuscated JavaScript loaders with sandbox checks (file and process counting), scheduled-task persistence, and an Ethereum smart contract acting as a dead-drop resolver for C2 and payload URLs, abusing Archive.org for hosting. The malicious browser extension bypasses Chromium integrity mechanisms by manipulating Secure Preferences and regenerating required HMACs and App-Bound encrypted hashes. Threat Command disrupted over 1,500 infections by registering the kill-switch canary domain.

Elastic Security Labs · 2d agoMalware in the wild

Researchers open-source a Wi-Fi cyber range for security training

NTNU and Aegean researchers open-source a software-emulated Wi-Fi cyber range using mac80211_hwsim with LLM-assisted scenario building.

Researchers from the Norwegian University of Science and Technology and the University of the Aegean published a design and prototype for a cyber range dedicated to IEEE 802.11 security training, emulating access points and clients with mac80211_hwsim, Linux namespaces, hostapd, wpa_supplicant, dnsmasq, and FreeRADIUS. The platform bundles Aircrack-ng, Wireshark, and custom tools WPAxFuzz and Bl0ck, and can convert plain-language scenario descriptions into deployable definitions via a locally hosted Llama model. A working prototype covering scenario creation and deployment is on GitHub; monitoring, access control, and orchestration zones remain future work.

Help Net Security · 23d agoTools1

HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures

A custom HVNC backdoor is targeting Latin American financial organizations via fake DocuSign and NFe tax-document lures, giving attackers hidden persistent remote access.

ANY.RUN researchers analyzed a multi-stage phishing campaign delivering a custom HVNC backdoor to banking and financial organizations in Latin America. The chain starts with fake DocuSign and NFe tax-document pages that serve per-visitor ZIP archives, followed by an LNK dropper, an NSIS loader, and a 64-bit backdoor masquerading as Windows Update Assistant. The implant provides hidden remote desktop control, keystroke monitoring, Firefox data theft, Startup-folder persistence, and EDR-aware behavior, communicating over TCP/27015.

ANY.RUN · 8d agoMalware in the wild

New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks

Nozomi details KATARU, an IoT botnet that brute-forces Telnet, exploits public Linux kernel flaws for root access, and launches multi-protocol DDoS attacks.

KATARU, discovered after honeypot Telnet brute-force activity from a Vietnamese IP, downloads an ARM payload (vlxx.arm) and attempts privilege escalation by editing /etc/passwd or exploiting CVE-2026-46300 (Fragnesia), CVE-2026-43284 (Dirty Frag), and CVE-2026-31431 (Copy Fail). It combines Mirai-style TCP, UDP, ICMP, HTTP, QUIC and DNS floods with application attacks against Minecraft, FiveM, OpenVPN and WireGuard. The malware uses X25519 and ChaCha20-Poly1305 encrypted C2, unusually broad persistence across systemd, cron, init frameworks, and Android hooks, plus anti-debugging and decoy traffic to hinder analysis. Implementers copied x86 shellcode into the ARM binary and reused an RFC 7748 test-vector key, indicating low-quality but rapidly evolving commodity development.

GBHackersupdated · 5d agofirst · 5d agoMalware in the wild 2 sourcesCVE-2026-46300CVE-2026-43284CVE-2026-31431

'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink

Russia-linked Sandworm chains Cisco vulnerabilities to deploy an upgraded Cyclops Blink botnet variant the FBI disrupted in 2022.

Dark Reading reports that Sandworm, the notorious Russia-linked threat group, is chaining Cisco vulnerabilities to deploy an upgraded version of the Cyclops Blink botnet malware. The FBI previously disrupted the Cyclops Blink botnet in 2022. The activity signals renewed botnet infrastructure building by the group despite prior law-enforcement action.

Dark Reading · 1d agoThreat actor in the wild

Researchers Show How Meta's 'Pervert Glasses' Are Used to Harass Women

University of Sydney researchers detail how pickup artists use Meta Ray-Ban smart glasses to covertly film and harass women, then post the videos on Instagram.

Researchers Joanne Gray, Milica Stilinovic, Marcus Carter, and Ben Egliston analyzed 350 Instagram videos posted between September 2023 and March 2026 showing unsolicited approaches to women filmed with smart glasses. They found a clear correlation between covert filming and harassment severity, arguing ambient capture creates 'borderline' harassment that evades platform moderation mechanisms. Instagram head Adam Mosseri said the platform would remove harassing pickup-line content, though similar videos remain widespread a month later. Meta's safeguards, such as the recording light, were previously criticized as insufficient, and users have modded glasses to disable the light.

404 Media · Aug 12, 2026AI safety & security

Honeypot-Omaha and batch.py [Guest Diary], (Wed, Sep 2nd)

A SANS ISC guest diary describes batch.py, a Python tool that consolidates honeypot logs and enriches IOCs with threat intelligence data.

Written by a SANS.edu BACS intern, the diary explains analysis of the DShield Honeypot-Omaha sensor, which uses Cowrie to emulate SSH and Telnet and log attacker activity. The author's batch.py script implements a four-phase pipeline with SHA-256-generated master and guest authentication to consolidate JSON and log files, correlate data via external APIs, and produce MITRE, CVE, geolocation, threat-score and fingerprint enrichment for investigated indicators.

SANS Internet Storm Center · 13d agoTools1

Meta Launches Personal AI Agent, Muse, Emphasizes Safety and Privacy

Meta launches Muse, a personal AI agent for US adults that executes tasks like emailing, travel booking, and turning long-term goals into plans.

Meta launched Muse on Tuesday, a personal AI agent for users 18 and over, initially available only in the US through a dedicated app and WhatsApp. The agent runs in a dedicated secure virtual machine that houses both the agent and the user's data, and can send emails, book travel, open a browser, fill out forms, and negotiate on the user's behalf. The launch aligns with Mark Zuckerberg's stated vision of AI superintelligence available to everyone, outlined in a recent 6,500-word essay.

SecurityWeek · 7d agoAI industry1

Mozilla's new Smart Window assistant runs on Mistral's models

Mozilla's Firefox Smart Window beta AI browsing assistant, powered by Mistral's models, launches in France and North America with no conversation storage.

Mozilla and Mistral partnered to power the Firefox Smart Window beta, an AI browsing assistant for complex searches, content recall, and tab summarization. The feature is available first in France and North America, with the UK and Germany to follow later this year. Mistral commits to storing no conversation data, and chats are not kept on Mozilla's servers by default.

The Decoder · 5h agoAI industry 2 sources1

Keep Your Tech FLAME Alive: Trailblazer Suzanne Wheeler

Akamai's FLAME Trailblazer series profiles Suzanne Wheeler's path into cybersecurity and offers advice for women building security careers.

This Akamai FLAME Trailblazer post features Suzanne Wheeler describing her personal journey into the cybersecurity field. She shares advice aimed at women who are charting their own career paths in technology and security. The piece is part of Akamai's ongoing diversity and culture series.

Akamai Blog · Aug 13, 2026Industry