Threat Brief — 2026-07-31 — Data Center OT Exposed, AI Threats Mature

Executive summary: A systemic weakness in data-center building-management protocols — ~90% running without encryption or authentication — gives attackers a shortcut to physical disruption without touching servers. ESET's latest threat report confirms malicious AI is moving from novelty to operational tooling, while Google's AI-assisted Chrome fuzzing programme patches a record 1,442 bugs across three releases. Law-enforcement infrastructure also advances: Interpol's global anti-fraud payment system and California's new DROP data-deletion platform both go live this month.

Top items

• Data-center cooling systems are an unguarded backdoor. Roughly 90% of building-management systems in data centres use protocols lacking both encryption and authentication, meaning an attacker who reaches the management network can manipulate cooling, power, and environmental controls without breaking into production servers. This is an OT/ICS exposure that demands the same segmentation and hardening attention as PLCs in water utilities. (src: SecurityLab)

• ESET threat report: malicious AI skills and adaptable malware on the rise. ESET's latest analysis tracks attackers adapting established techniques to AI platforms, including AI-assisted malware, ClickFix social-engineering attacks, and record volumes of QR-code phishing (quishing). The report underscores that AI is now embedded in offensive workflows — not just research concepts. (src: BleepingComputer)

• Chrome patch scope broader than first reported — three releases fix 1,442 flaws. New coverage reveals that Chrome versions 149 and 150 collectively addressed 1,442 security bugs across three releases, with 1,072 attributed to AI-assisted fuzzing. This surpasses the total fixed across the prior 23 milestones combined. This is a developing story, first reported 2026-07-30 by BleepingComputer covering the AI-fuzzing angle; the new finding from The Hacker News adds the wider scope and comparative benchmark. (src: The Hacker News)

• Interpol deploys global system to intercept fraudulent payments before cash-out. Interpol is leveraging a coordinated global mechanism that allows law-enforcement agencies to act quickly when a fraudulent transaction is detected, halting payments before cybercriminals can convert funds. Operational details are limited but the programme represents a shift toward real-time cross-border financial interception. (src: Dark Reading)

• California DROP platform launches August 1 for bulk data deletion. The Delete Request and Opt-out Platform (DROP) enables California residents to reduce their digital footprint across participating data brokers, with hundreds of thousands already registered. If the process runs smoothly, other states may follow — a regulatory trend that will affect how organisations handle deletion requests at scale. (src: Dark Reading)

• Guidance: build certificate and key inventories before rotating roots of trust. A practical piece argues that the most valuable move any security team can make is building a comprehensive certificate and key inventory — because after a root of trust is pulled, ownership and traceability collapse without one. Relevant for teams managing PKI at scale or preparing for CA migrations. (src: Dark Reading)

Themes

AI as a dual-use force multiplier. ESET's report on malicious AI skills and Google's record AI-assisted fuzzing results (1,072 of 1,442 bugs found via AI) illustrate both sides of the same coin — offensive AI is maturing into operational tooling while defensive AI is dramatically expanding vulnerability discovery. Teams should expect attacker AI capabilities to advance in parallel.

Unauthenticated OT protocols remain systemic. The data-centre cooling finding mirrors the pattern CISA flagged for water-utility PLCs: critical infrastructure routinely runs management protocols without encryption or authentication. Whether it's building-management systems or industrial controllers, the attack surface is less about sophisticated exploits and more about reaching networks that were never designed to be exposed.