Electrical and Power Engineer

Thales unveils new uncrewed vehicle. By Max Blenkin | Perth | 6 October 2026 2 / 3 free articles left. Defence company Thales has unveiled a new large uncrewed vehicle able to transport 10 tonnes of cargo and deliver power to operate remote installations such as a hospital or a radar system. This draws on the company's long experience with the Bushmaster protected mobility vehicle and on the mining experience of Newcastle company 3ME Technology. Called BladeHAUL, this will undergo trials at the Talisman Sabre exercise next year. Thales Vice President for Land and Guided Weapons and explosive Ordnance Andrew Downes said the experience in Ukraine showed a large number of uncrewed ground vehicles on the frontlines. "What a platform like this does is ensure that you can support those vehicles to and back from the frontlines. It can carry 10 tonnes. So you can think of resupply and casualty evacuation," he told reporters the 2026 Land Forces defence expo in Perth. "It is also a mobile power source. "What's great about it is that it has all the cross country mobility of the Bushmaster with all the power from 3ME and a flatbed that you can mount anything you need on. You can literally put a 20 foot shipping container on it with up to 10 tonnes." BladeHAUL is made at the Thales plant in Bendigo, Victoria and at 3ME in Newcastle. Power comes from a hybrid diesel and electric system. It operates autonomously, either navigating independently to a particular location or in follow the leader mode. That will be further developed though a Memorandum of Understanding with Deakin University. Thales Chief Executive Officer Jeff Connolly said more important that the piece of kit was the collaboration between Thales and 3ME. "It is about industry collaboration to deliver something that is needed to secure the nation," he said. "What you have in front of you is the most energy dense powerplant to take sensors and effectors around the country. It is of course exportable to the world." "What it also represents is the result of the confidence the Commonwealth has had in the actual manufacturing capability in Bendigo." 3ME Technology Chief Executive Officer Justin Bain said this had all come together in the last six months but represented over eight years of hard tech development by 3ME. "It has its BladeVOLT Gen 2 battery system proven in the underground mining industry, its BladeDRIVE control system, software and hybrid technology through to BladeNET its secure telemetry and EdgetVOLT, the mobile power solution. "We are looking forward to trial in the new year with Army."

Critical CVE-2026-18397: remote code execution vulnerability in Thales SConnect threatens SWIFT banking and government authentication systems. Executive summary. A critical remote code execution (RCE) vulnerability, CVE-2026-18397, has been identified in the Thales SConnect browser extension, a hardware authentication middleware extensively deployed in SWIFT banking networks and government authentication portals. This vulnerability enables attackers to achieve drive-by RCE within seconds via malicious websites or iframes, bypassing cryptographic security checks due to improper RSA signature validation and buffer handling. Successful exploitation allows adversaries to load malicious DLLs, resulting in full system compromise on endpoints used for global financial transfers and government operations. While multiple security research groups have demonstrated proof-of-concept exploitation and reported in-the-wild attacks, this CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and thus CISA has not confirmed active exploitation. Technical information. CVE-2026-18397 is a critical vulnerability (CVSS 9.4) affecting the Thales SConnect browser extension, which serves as a middleware for hardware-based authentication in high-assurance environments such as SWIFT banking, government identity providers, and insurance portals. The vulnerability arises from a buffer overflow condition triggered by improper RSA signature validation and heap spraying techniques. Attackers can craft oversized RSA signatures that bypass SConnect's cryptographic checks, leading to heap corruption and arbitrary code execution. The attack chain begins when a victim visits a malicious website or is served a crafted iframe. The exploit leverages the browser extension's native messaging interface to deliver a payload that results in the loading of a malicious DLL. This grants the attacker code execution privileges on the endpoint, enabling session hijacking of SWIFT banking systems, compromise of government authentication flows, and potential lateral movement within the victim's network. The vulnerability is mapped to several MITRE ATT&CK techniques, including T1189 (Drive-by Compromise), T1203 (Exploitation for Client Execution), T1055 (Process Injection), T1190 (Exploit Public-Facing Application), T1574.001 (Hijack Execution Flow: DLL Search Order Hijacking), T1211 (Exploitation for Defense Evasion), T1056 (Input Capture), and T1539 (Steal Web Session Cookie). Proof-of-concept code was demonstrated by a Bay Area Labs researcher, and exploit development has been accelerated by the use of AI agents, lowering the technical barrier for non-nation-state actors. The vulnerability affects all SConnect browser extension versions released prior to August 2026, including those for Chrome, Edge, and Apple platforms. Exploitation in the wild. Multiple security research sources, including the Aviatrix Threat Research Center and Bay Area Labs, have reported drive-by attacks targeting banking and government users leveraging this vulnerability. The exploit can be delivered via malicious websites or embedded iframes, requiring minimal user interaction. While there have been no confirmed unauthorized SWIFT transfers or identity-card signing events, session hijacking and endpoint compromise have been observed in the wild. Chrome and Apple versions of SConnect were patched in August 2026, and the Edge version was removed from distribution in September 2026. Despite these mitigations, organizations using unpatched or legacy versions remain at significant risk. APT Groups using this vulnerability. No specific advanced persistent threat (APT) group attribution has been made in public reporting or MITRE mapping for CVE-2026-18397. However, the rapid development and deployment of exploit code, including the use of AI-driven tooling, suggest that both sophisticated and opportunistic threat actors are capable of leveraging this vulnerability. The primary tactics, techniques, and procedures (TTPs) observed include drive-by compromise, heap spraying, DLL injection, and session hijacking. Affected product versions. The affected product is the Thales SConnect Browser Extension. All versions released prior to the August 2026 update are vulnerable, including those for Chrome, Edge, and Apple platforms. This encompasses all SConnect deployments used for SWIFT banking, government identity providers such as Qatar's Tawtheeq and the Swedish Tax Agency, and insurance portals requiring hardware-based authentication. Patched versions were released in August 2026 for Chrome and Apple, while the Edge version was removed from distribution in September 2026. Workaround and mitigation. Organizations must immediately update the SConnect browser extension to the latest patched version (August 2026 or later). For environments where SConnect is now end-of-life, migration to supported alternatives such as SWIFT Web Connect is strongly recommended. Network controls should be enhanced by implementing inline intrusion prevention systems (IPS) with Suricata signatures tailored for this exploit, and by deploying egress filtering to block unauthorized outbound connections from compromised endpoints. Zero trust segmentation should be enforced to limit lateral movement from compromised endpoints, and continuous monitoring for anomalous authentication patterns and session hijacking attempts is essential. Additionally, organizations should review their supply chain and vulnerability management processes to ensure compliance with regulatory frameworks such as PCI DSS 4.0, NYDFS 23 NYCRR 500, DORA, NIS2, and ISO 27001. Indicators of compromise. The following indicators are derived from public threat intelligence sources. Please note that indicators are point-in-time and should be validated in your environment before enforcement. | Type | Indicator | Reported (date) | Source | | Domain | bayarealabs[.]com | 2026-10-02 | https://aviatrix.ai/threat-research-center/swift-banking-government-middleware-rce-cve-2026-18397/ | | Domain | thalesgroup[.]com | 2026-10-02 | https://aviatrix.ai/threat-research-center/swift-banking-government-middleware-rce-cve-2026-18397/ | | URL | hxxps://bayarealabs[.]com/sconnect-vulnerability-report | 2026-10-02 | https://aviatrix.ai/threat-research-center/swift-banking-government-middleware-rce-cve-2026-18397/ | | URL | hxxps://thalesgroup[.]com/security/advisories/CVE-2026-18397 | 2026-10-02 | https://aviatrix.ai/threat-research-center/swift-banking-government-middleware-rce-cve-2026-18397/ | No public DLL hashes or specific process names have been disclosed; organizations should monitor for unauthorized DLLs loaded by browser extension processes and unexpected child processes spawned by browser or SConnect native host. References. Rescana is here for you. Rescana provides a comprehensive third-party risk management (TPRM) platform that empowers organizations to continuously monitor, assess, and mitigate cyber risks across their supply chain. Its platform delivers actionable intelligence, automated risk scoring, and real-time alerts to help you stay ahead of emerging threats. Rescana is happy to answer any questions at [email protected]. Contact Rescana / book a demo. Talk to Rescana about this advisory, or book a demo of the platform.

Argentina issues two-week ultimatum to UK over Sea Lion oil project, threatens international arbitration. Argentina formally notified the United Kingdom on September 28, 2026, to halt all hydrocarbon activities linked to the Sea Lion project in the North Malvinas Basin within 14 days or face international arbitration under the UN Convention on the Law of the Sea. The escalation represents the fourth legal and diplomatic action in 25 days targeting offshore oil development in disputed South Atlantic waters, with parallel sanctions announced against British firm Thales UK Limited for unauthorized flights between the Falklands and Punta Arenas, Chile. President Javier Milei instructed the Foreign Ministry and legal teams to initiate arbitration proceedings under Annex VII of the UN Convention on the Law of the Sea (UNCLOS), specifically targeting the Sea Lion project operated by Rockhopper Exploration and Navitas Petroleum approximately 220 kilometers north of the islands. The Argentine government argues that unilateral hydrocarbon exploitation violates UN General Assembly resolutions 2065 and 31/49, which recognize the sovereignty dispute and prohibit modifications to the status quo during negotiations. Argentina contends the project falls within its sovereign continental shelf jurisdiction extending to 350 nautical miles under UNCLOS provisions. The ultimatum warns that absent UK compliance, Argentina will petition the International Tribunal for the Law of the Sea for provisional measures to preserve its continental shelf rights. Chancellor Pablo Quirno characterized the move as unprecedented, stating the government would seek interim tribunal orders while the arbitration panel assembles. The legal strategy follows a September 16 injunctive order by federal judge Mariel Borruto directing the oil companies to cease construction activities pending environmental review, though Rockhopper and Navitas jointly stated they expect no material project impact. London rejected the arbitration claim through Foreign Office Minister Uma Kumaran, who defended the islanders' right to develop natural resources and questioned Argentina's reliability as a UK partner. The UK government maintains that Sea Lion operations comply with local Falklands legislation and international law, invoking the 2013 referendum in which 99.8 percent of islanders voted to remain a British Overseas Territory. British Defense Secretary Wes Streeting reinforced that position with statements affirming military readiness to defend the islands, noting scheduled Typhoon fighter upgrades by November 2027. The diplomatic clash intensified after Milei's September UN General Assembly speech renewed sovereignty claims. Argentina simultaneously announced sanctions against Thales UK Limited for allegedly operating flights between the islands and Chile without Argentine authorization, tied to a business delegation meeting Chilean suppliers. The Foreign Ministry is separately exploring US-mediated negotiations, contingent on British acceptance. The Sea Lion project carries significant economic stakes, with UK authorities estimating potential royalties of $2 billion over three decades of production. Argentina's September 3 decree 868/2026 empowered the Foreign Ministry to sanction unauthorized hydrocarbon operators and imposed disclosure requirements on companies seeking benefits under the RIGI large-investment incentive regime. A subsequent September 8 criminal complaint invoked Law 26.659 against Navitas, building on 2022 sanctions that yielded no operational interruption. The two-week deadline expires mid-October, positioning the dispute for potential International Tribunal consideration before year-end if the UK maintains its current stance on resource development in the contested basin.