Topic · ics-ot

ICS / OT

Industrial Control Systems and Operational Technology — vulnerability advisories and policy affecting Siemens, ABB, Rockwell, Schneider, and the federal facilities that run them.

RSS feed ↗

trade-press
AI sharpens threat to underfunded commercial critical infrastructure
A Pentagon cyber warfare official says the economics of defending commercially owned critical infrastructure weren't right before AI, and the gap is widening.
John Garstka, director of cyber warfare under the Pentagon's acquisition arm, warned at the Billington Cybersecurity Summit on Sept. 8 that AI is compounding the cybersecurity challenges facing commercially owned critical infrastructure providers, the same entities the Defense Department depends on for missions like those of U.S. Transportation Command. Garstka said providers "below the cybersecurity poverty line" are most exposed, and noted that Iranian nation-state actors are already creating effects against commercial critical infrastructure. DOD has run workshops with the Maryland National Guard on water, wastewater, and energy sectors to help operators build continuity plans for cyber attacks.
YESTERDAY
trade-press
DOE Opens Comment on Foreign Bulk-Power Equipment Ban
EO 14421 doesn't just block future sales, it authorizes the Energy Secretary to force isolation, disconnection, or replacement of equipment already bolted to the grid.
The Department of Energy published an RFI on September 9 seeking public input on implementing Executive Order 14421, which prohibits acquisition, importation, transfer, or installation of foreign-produced bulk-power system electric equipment. The EO (issued August 26, 2026, under IEEPA and the National Emergencies Act) also grants the Energy Secretary authority to impose conditions on existing foreign equipment, including isolation, monitoring, disconnection, or replacement. Comments are due within 30 days; a public webinar is set for September 16. DOE has 120 days from the EO to publish implementing rules.
YESTERDAY
trade-press
FY27 NDAA would reshape DoD cyber oversight around mission survival
The House bill's CORA reporting requirement asks whether systems can fight through an attack, not whether the paperwork is in order.
The FY2027 NDAA's House proposal would mandate semiannual Cyber Operational Readiness Assessment (CORA) reporting from installation to combatant-command level, explicitly scoped to OT environments, mission-critical systems, weapon platforms, and industrial control systems. Reporting would flow through the DoD CIO and the commander of DoD Cyber Defense Command. The shift marks the first time Congress has moved to bring cyber and OT readiness into the department's formal reporting cadence, asking a question compliance metrics can't answer: can the mission survive when the network is under attack?
TUE
regulator
CareCam IP Camera Bootloader Uses Hardcoded Credential
The vendor, headquartered in China, didn't respond to CISA's coordination attempts, operators are left with network isolation as the only mitigation.
CISA published an advisory for CVE-2026-85083, a hardcoded-credential vulnerability in the bootloader of CareCam Pro IP cameras running on ANJIA AJL33PC0801 hardware with firmware compiled August 2020. An attacker with physical access can gain privileged bootloader access and compromise the device completely, modify firmware, alter configuration, take full control. CareCam didn't respond to CISA's coordination attempts, so no vendor fix has been announced. The vulnerability isn't remotely exploitable, but organizations using these cameras in commercial facilities worldwide have no remediation path beyond network segmentation and physical access controls.
TUE
trade-press
Nobody tracked the cellular modems on water controllers
The devices showed up on carrier invoices but never in an IT asset inventory. Matching the two costs nothing and can start Monday.
In July, intruders compromised water and wastewater controllers across multiple states through an exposure no asset inventory caught: the devices were connected to public cellular networks, not the city LAN. The modems appeared on carrier invoices but nowhere on network scans. The former CIO of Waco, Texas, writing from direct experience, argues the core problem isn't technical. No single person owns accountability for the whole municipal network. Matching carrier invoices to actual devices costs nothing in tools or headcount and can start this fiscal year with money already in a budget request.
TUE
trade-press
IST sprints to build AI-OT cyber framework for cash-strapped operators
The 100-day multistakeholder push targets critical-services operators who lack cyber talent, budget, and tools, the tier below existing CISA and NIST guidance.
The Institute for Security and Technology launched a 100-day initiative on August 27 to produce policy guidance for OT/ICS operators who are "target rich, cyber poor", lacking dedicated cybersecurity talent, budget, or tools. Five working groups will address consequence analysis, sector engagement, pragmatic guidance for those operators, novel mitigations, and policy-incentive design, with a report due December 10. IST's framing acknowledges a gap between existing CISA and NIST AI-security guidance and the operational reality of cash-constrained critical-services providers facing AI-enabled threats.
FRI
regulator
ArmorStart LT Gets Stored XSS, DoS Patches in v2.002
Two unauthenticated remote vectors (one that injects scripts, one that kills the webserver) fixed in a firmware update Rockwell shipped alongside the disclosure.
CISA published advisory ICSA-26-246-04 for Rockwell Automation ArmorStart LT, covering two vulnerabilities in firmware v2.001 and earlier. CVE-2026-19471 lets an unauthenticated attacker plant stored cross-site scripting payloads on the embedded webserver (CVSS 7.3). CVE-2026-19472 crashes that same webserver via a crafted HTTP PUT request (CVSS 7.5). Both are network-accessible and require no authentication. Rockwell shipped the fix in v2.002 and recommends all users update. The advisory is a republication of Rockwell's own disclosure; no known public exploitation has been reported to CISA.
THU
regulator
ControlFLASH installer grants Everyone write access to directory
The vulnerable permission is removed by patch v15.08, but until then any user on the engineering workstation can drop code into the installation path.
CISA republished a Rockwell Automation advisory for ControlFLASH ≤v15.07: the installer grants the "Everyone" group write permissions on the product installation directory, enabling arbitrary code execution at the logged-in user's privilege level. Version 15.08 removes the permission. Organizations that can't patch immediately can strip the Everyone group from the folder manually. Critical manufacturing, energy, and water systems are the affected sectors. No known public exploitation, and the vulnerability is local, not remotely exploitable.
THU
regulator
Rockwell 1756-ENBT module has no-patch DoS vulnerability
The module is discontinued, so the fix is a hardware swap, and operators in critical manufacturing, water, and transportation have to weigh replacement capex against availability risk on systems that may lack redundancy.
CISA published an advisory for CVE-2025-10478, a denial-of-service vulnerability affecting all versions of the Rockwell Automation 1756-ENBT EtherNet/IP bridge module. A single crafted CIP packet can remotely crash the device; recovery requires a physical restart. Rockwell has discontinued the 1756-ENBT and won't issue a patch. The recommended path is an upgrade to the 1756-EN2T or 1756-EN4TR, but no migration timeline, cost guidance, or compatibility verification process has been published for operators running legacy ControlLogix environments.
THU
regulator
Ignition 8.1.53 ships blank project-creation role, CISA flags CVE-2026-77393
Any authenticated user who can execute gateway scripts can create projects, the default setting requires no role at all.
CISA disclosed CVE-2026-77393 in Inductive Automation Ignition 8.1.53 and earlier: the "Create Project Role(s)" setting shipped blank, so any authenticated user who can execute gateway scripts can create projects. The flaw is a default-configuration issue, not a broken access control, populate the setting and the vulnerability closes. Inductive Automation recommends upgrading to 8.1.54, which restricts project creation to Designer sessions and drops reliance on the setting entirely. The 8.3 series is unaffected. CVSS 3.1: 8.8. Critical manufacturing and energy environments are the primary concern.
THU
regulator
Tycon TPDIN-Monitor-WEB3 firmware patches hard-coded creds, CSRF, missing auth
The patch is a legacy .hex file, no signed container path for the v2.2.9 units that need it most, so every deployed device requires a manual flash.
CISA disclosed three vulnerabilities in Tycon Systems TPDIN-Monitor-WEB3 firmware ≤2.2.9: hard-coded credentials (CVE-2026-77847, CVSS 6.5), cross-site request forgery (CVE-2026-82712, CVSS 8.8), and missing authorization (CVE-2026-82684, CVSS 8.1). The devices are deployed worldwide in critical manufacturing and energy networks. Tycon released firmware v2.4.2, but units on v2.2.9 can't ingest the signed .tfw container, they need the legacy Intel HEX build, which means a direct, out-of-band flash for every fielded unit.
THU
regulator
Silent 9.8 Buffer Overflow Found in Pyramid NetStaX Stack
A large Class 3 request overflows the receive buffer without generating a CIP error, so a device can crash or corrupt memory with no indication of the cause.
CISA published an advisory September 3 for CVE-2026-78012, a stack-based buffer overflow (CVSS 9.8) in Pyramid Solutions' NetStaX EtherNet/IP Stack affecting all eight product variants below v5.6.1, the Adapter and Scanner Development Kits and DLL Kits, spanning critical manufacturing, energy, water, and chemical sectors. A large Class 3 explicit-message request overflows the receive buffer without generating a CIP error or warning; the originating device gets no indication the request failed. NetStaX v5.6.1 adds a compile-time assertion paired with a runtime payload-size check, plus clearer documentation of packet and buffer-size constant relationships.
THU
regulator
IXON VPN Client CRLF injection flaw scores 9.6 CVSS
A privileged subprocess reads injected config lines that persist across reboots, cloud-side blocking stops new connections but does nothing about existing backdoors.
CISA published ICS Advisory ICSA-26-246-02 for CVE-2026-75925, a CRLF injection vulnerability in IXON VPN Client versions below 1.4.7. An unauthenticated attacker can inject configuration directives that a privileged subprocess later executes as root or SYSTEM. The injected configuration persists across restarts. IXON's cloud began rejecting connections from unpatched clients on August 5, 2026, so unpatched installations can no longer complete the exploit chain. Legacy installations that were already compromised before the cloud-side block, however, retain any injected backdoors, and the cloud rejection does nothing to remove them.
THU
regulator
OPC UA LDS installer flaw lets local attackers hijack high-privilege sessions
The fix is a reissued installer, not a patch, updating means scheduling a maintenance window and re-running the deployment, not pushing a binary swap.
CISA published an advisory for CVE-2026-77477, a privilege-escalation vulnerability in OPCFoundation OPC UA LocalDiscoveryServer installers prior to version 1.04.420. A local attacker with keyboard and display access during installation can intercept a high-privilege console window and run arbitrary commands. Affected sectors include chemical, energy, water, food and agriculture, and critical manufacturing. OPCFoundation recommends updating to the 1.04.420 installer. The vulnerability carries a CVSS 3.1 score of 4.6, low severity on paper, but the LDS ships inside SIMATIC NET PC Software, WinCC, PCS 7, and a long tail of industrial products where installers may have been run once and forgotten.
THU
trade-press
Thompson pushes DHS worldwide threats hearing on Iran cyber campaign
The ranking member's letter arrives while CISA's Iran PLC advisory has been updated once since April and the agency remains hamstrung by a DHS shutdown that keeps roughly two-thirds of its staff out of the office.
House Homeland Security ranking member Bennie Thompson (D-MS) is pressing Chairman Andrew Garbarino (R-NY) to convene a worldwide threats hearing, citing the July 22 update to CISA's joint advisory on Iran-affiliated actors exploiting internet-connected PLCs across U.S. critical infrastructure. Thompson also flags AI and quantum computing risks, the loss of nearly one-third of CISA's workforce over 18 months, and a DHS shutdown that Noem acknowledged has hampered the agency's threat-sharing with critical infrastructure stakeholders.
SEP 2
regulator
CISA and FBI Release Crisis Comms Guidance for IT/OT Outages
The guidance covers principles like clarity, accountability, and transparency but stops short of mandated timelines, template libraries, or notification protocols, providers still have to build their own playbook.
CISA and the FBI published joint guidance on crisis communications for service providers managing IT and OT outages. The document walks through core messaging principles (clarity, accountability, transparency) and stresses the need to plan for cascading disruptions and unreliable telecoms during incidents. It's advisory, not a mandate. No templates, no specific notification timelines for customers or law enforcement, and no framework for resolving the tension between early disclosure and investigative holds. Providers who already have a crisis comms plan won't find new obligations here; those who don't have a starting point.
SEP 2
trade-press
ONCD's Project Watershed 250 deploys red teams to Texas water utilities
The six-month pilot marks a departure from the federal government's advisory-only posture, putting operational capabilities directly into the hands of small water utilities at no cost.
The Office of the National Cyber Director launched Project Watershed 250 on August 31, a six-month pilot delivering red-team services and AI-enabled cyber tools directly to Texas water utilities. CISA, EPA, the FBI, Texas Cyber Command, and private-sector firms including Dragos are participating. The program targets small and rural utilities that lack dedicated security teams, the same ones hit in June's coordinated attacks. It marks a departure from the federal government's standard advisory posture toward directly provisioning operational capabilities at no apparent cost.
SEP 1
trade-press
NIST opens SP 800-213A comment as scope question surfaces
Third IoT guidance revision in two years, and NIST still hasn't settled whether the catalog controls devices or products.
NIST opened a pre-draft comment period on SP 800-213A, the federal IoT device cybersecurity requirement catalog, with comments due October 15. The agency's explicitly asking whether the revised catalog should expand its scope from IoT devices to IoT products, bringing it in line with SP 800-213 Rev. 1, which made the same shift in June. For contractors and integrators supplying IoT products to federal agencies, this is the window to shape how the catalog defines compliance requirements. The alternative's inheriting definitions written without them.
SEP 1
regulator
Rockwell Historian ME Hit by RCE and DoS Bugs
The RCE scores 8.6, the DoS 4.8, but both sit at the network-adjacent attack surface, and the affected sectors span chemical, manufacturing, food, healthcare, and water.
CISA and Rockwell Automation disclosed two vulnerabilities in Historian ME Series B 5.202 and Series C 7.101. CVE-2025-12768 is an out-of-bounds write that allows a low-privilege authenticated attacker on an adjacent network to achieve remote code execution (CVSS 8.6). CVE-2026-12661 is a stack-based buffer overflow that lets a network-adjacent authenticated attacker crash the device via crafted web-interface requests (CVSS 4.8). The advisory lists corrected versions but doesn't specify version numbers or a patch timeline. Affected sectors include chemical, critical manufacturing, food and agriculture, healthcare, and water and wastewater systems worldwide.
SEP 1
regulator
Rockwell RSLinx Classic needs 4.60 upgrade to fix four DoS flaws
Two of the four vulnerabilities carry CVSS 4.0 scores of 9.2, and none require authentication, a malformed CIP packet to port 44818 is all it takes to crash the service.
CISA issued an advisory covering four denial-of-service vulnerabilities in Rockwell Automation RSLinx Classic versions 4.50 and earlier. Each can be triggered remotely by sending a malformed CIP packet to the affected service, no authentication required. The fix is an upgrade to version 4.60. The product is deployed globally across critical manufacturing, and the two highest-severity CVEs (CVE-2026-9621, CVE-2026-9622) score 9.2 under CVSS v4.0. Rockwell hasn't published a timeline for mitigations on systems that can't move off 4.50.
SEP 1
regulator
CISA Flags High-Severity DoS Flaw Across Rockwell Logix Platform
Safety controller recovery requires a full program redownload, not a reboot, not a power cycle, a complete reflash with the project file.
CISA published an advisory for CVE-2021-42260, a high-severity denial-of-service vulnerability in Rockwell Automation ControlLogix 5580, GuardLogix 5580, CompactLogix 5380, Compact GuardLogix 5380, and CompactLogix 5480 controllers. Corrupt crafted data can trigger a major nonrecoverable fault (MNRF). Safety controllers require a full program download to recover; non-safety controllers need a stage 2 reset. Rockwell recommends updating to firmware versions 34.015, 35.014, 36.013, or 37.011 and later. The advisory covers firmware lines 34 through 37 across all five current-generation Logix families.
SEP 1
regulator
Logix Platform DoS Hits ControlLogix, CompactLogix, GuardLogix
No mitigation exists short of a firmware upgrade, if the controller is reachable on the network, the clock starts when the advisory publishes.
CISA released an advisory for CVE-2026-9637, an uncontrolled resource consumption vulnerability in Rockwell Automation's Logix platform (ControlLogix 5580, CompactLogix 5380, GuardLogix 5580, and Compact GuardLogix 5380) affecting versions through V36.x. The flaw is exploitable remotely with low attack complexity (CVSS 7.5 under v3.1, 8.7 under v4.0) and produces a denial-of-service condition requiring a power cycle to recover. Remediation is a firmware upgrade to V37.011 or patched versions V34.015, V35.014, and V36.013. No public exploitation has been reported to CISA.
SEP 1
regulator
Rockwell FactoryTalk Activation Manager gets privilege escalation patch
An attacker with Windows credentials on the machine can hijack a console window spawned during install or repair to grab SYSTEM, update to V5.03 closes it.
CISA published an advisory for CVE-2026-16675 (CVSS 7.8), a privilege escalation vulnerability in Rockwell Automation FactoryTalk Activation Manager V5.02 and below. The flaw arises from custom installer actions that spawn visible console windows running with SYSTEM privileges during installation or repair. An authenticated attacker with Windows credentials can hijack those windows to obtain a SYSTEM-level command prompt, gaining full access to local files, processes, and system resources. Rockwell recommends updating to V5.03. No known public exploitation has been reported to CISA.
SEP 1
trade-press
Flashpoint: hacktivism now a state hybrid-warfare arm
The gamified DDoS model lets Iran and Russia scale disruptive operations against US critical infrastructure through low-skilled volunteers, not just advanced tradecraft.
Flashpoint's Aug. 26 report traces a structural shift in hacktivism: from lone-wolf defacements to disciplined, state-aligned hybrid-warfare operations. Iranian-aligned and pro-Russia groups are targeting supply chains, financial infrastructure, and OT/ICS across North America. The report flags "gamification" (DDoS-as-patriotic-game, with cryptocurrency rewards) as the scaling mechanism that lets low-skilled participants disrupt critical utilities without the state sponsor deploying its own advanced capabilities.
AUG 31
trade-press
CRS maps three paths for water-sector cyber standards
Voluntary coordination failed, the 2023 EPA memo got sued out of existence, and now Congress is staring at three bills with no shared theory of how to set standards, fund compliance, or enforce either.
A new Congressional Research Service report catalogs the legislative options for water-sector cybersecurity after July 2026 attacks hit utilities in seven states. Three competing approaches are on the table: Capito's WRDA bill funds technical assistance under existing SDWA authorities; the Schiff-Klobuchar package directs EPA to set baseline cybersecurity standards through rulemaking; and the Trahan-Markey bill creates a wastewater cyber grant program. The CRS report flags unresolved questions on whether standards would apply uniformly to the roughly 170,000 U.S. water systems (many already struggling with existing SDWA requirements) and whether EPA or state regulators have the expertise to oversee them.
AUG 28
regulator
Ebyte NA111-M Gateways Face 13 Critical Flaws, No Patch
Ebyte promised CISA a patch then went dark, the second time in three days the vendor has left gateway owners with critical exposures and no mitigation path.
CISA published advisory ICSA-26-239-05 Wednesday detailing 13 authentication and cryptographic vulnerabilities in Ebyte NA111-M gateway firmware 9013-2-17. Nine flaws carry CVSS 9.8; all allow unauthenticated remote attackers to access or modify device configuration and disrupt availability. Ebyte acknowledged the vulnerabilities and indicated a patch was under development, then stopped responding to CISA. This is the second Ebyte advisory in three days (ICSA-26-237-06 covered NE2-D11 flaws Monday with the same vendor-silence pattern) leaving contractors, MSPs, and C3PAOs worldwide with critical exposures and no mitigation path.
AUG 27
regulator
Ebyte NA111-M Gateways Face 13 Critical Flaws, No Patch
Ebyte promised CISA a patch then went dark, the second time in three days the vendor has left gateway owners with critical exposures and no mitigation path.
CISA published advisory ICSA-26-239-05 Wednesday detailing 13 authentication and cryptographic vulnerabilities in Ebyte NA111-M gateway firmware 9013-2-17. Nine flaws carry CVSS 9.8; all allow unauthenticated remote attackers to access or modify device configuration and disrupt availability. Ebyte acknowledged the vulnerabilities and indicated a patch was under development, then stopped responding to CISA. This is the second Ebyte advisory in three days (ICSA-26-237-06 covered NE2-D11 flaws Monday with the same vendor-silence pattern) leaving contractors, MSPs, and C3PAOs worldwide with critical exposures and no mitigation path.
AUG 27
regulator
CISA Flags Three Xiiaozet LK100W Firmware Flaws
Two of the three vulnerabilities are remotely exploitable without credentials, but one requires authentication, and the vendor has published a fix.
CISA published ICS advisory ICSA-26-239-01 covering three vulnerabilities in Xiiaozet LK100W devices running firmware below version 2.1.240. The most severe (CVE-2026-78239 (missing authentication for critical function) and CVE-2026-76943 (authentication bypass)) each carry a CVSS v3.1 score of 9.8 and can be exploited remotely without credentials. CVE-2026-78037, an OS command injection with a CVSS v3.1 score of 8.8, requires authentication. Xiiaozet recommends updating to v2.1.240. No active exploitation has been reported to CISA, and no federal deployment deadline accompanies the advisory.
AUG 27
regulator
ASE2000 test set needs immediate patch for XXE, TLS flaws
The TLS fix doesn't just close a hole, it corrects certificate validation logic that let an attacker complete the handshake and impersonate a trusted peer.
CISA is alerting operators of Applied Systems Engineering ASE2000 V2 Communications Test Sets that versions 2.25 through 2.37 carry two critical vulnerabilities: an XXE flaw (CVE-2018-1285, CVSS 9.8) in the bundled log4net library that allows remote code execution, and improper TLS certificate validation (CVE-2026-18717, CVSS 7.4) that lets an attacker impersonate a trusted peer on IEC 60870-5-104 connections. Upgrade to v2.38 fixes both. The vendor offers interim mitigations (restricting write access to config files and isolating affected hosts) until the patch is applied.
AUG 27
regulator
Mitsubishi Electric CNC Controllers Hit by Remote DoS Vulnerability
The attack vector is the same TCP port 683 that's been targeted in prior Mitsubishi CNC advisories, patch, filter, or isolate.
CISA published ICSA-26-078-05 for CVE-2025-2399, an out-of-bounds read vulnerability (CWE-1285) in 18 versions of Mitsubishi Electric CNC Series controllers. A remote attacker sending crafted packets to TCP port 683 can trigger a denial-of-service condition. Fixed firmware is available for most affected product lines; M800V/M80V Series get version BC, M800/M80/E80 Series get version FN, and M700V/M70V/E70 Series get version LK. C80 and NC Trainer2 lines have no patch yet, Mitsubishi Electric recommends firewalls, VPNs, IP filters, and physical access restrictions as compensating controls.
AUG 27
regulator
No fix planned for Fuel-Boss Backflush Systems RCE
Backflush variant operators get only network isolation against two remotely exploitable RCE flaws rated up to CVSS 9.4, with no vendor patch on the roadmap.
CISA published an ICS advisory for two remote code execution vulnerabilities (CVE-2018-19518, CVE-2019-11043) affecting all four variants of All-Line Equipment's Fuel-Boss V1 fuel management system, deployed worldwide across critical manufacturing, defense industrial base, emergency services, and transportation sectors. Standard and Portal variants have vendor fixes available by phone. Master/Slave fixes are pending. Backflush Systems operators get no planned patch, only a recommendation to air-gap or restrict IP access at the router.
AUG 27
regulator
Mitsubishi CC-Link IE TSN modules vulnerable to remote DoS
A single crafted UDP packet can trigger denial-of-service across 30-plus industrial I/O, converter, and communication LSI models, recovery requires a system reset.
CISA published ICS advisory ICSA-25-128-03 for CVE-2025-3511, an improper input validation flaw (CWE-1284) in Mitsubishi Electric's CC-Link IE TSN remote I/O modules, analog-digital and digital-analog converters, FPGA modules, communication LSIs, and MELSEC iQ-R and iQ-F series master/local and CPU modules. A remote attacker can cause DoS, timeout errors, or communication delays by sending a specially crafted UDP packet. Affected firmware versions are 09 or earlier for I/O modules, 07 or earlier for converter modules, and varying ceilings for communication and CPU modules. Mitsubishi recommends updating firmware and (where updates aren't available) applying network segmentation and firewall filtering as interim mitigations.
AUG 27
trade-press
Trump declares energy emergency to ban foreign grid equipment
The 2020 order tripped up utilities on compliance; the 2025 version adds an emergency declaration and a 120-day clock, with the same criteria still undefined.
Trump signed an executive order Wednesday declaring a national energy emergency and prohibiting foreign-produced equipment in the U.S. bulk-power system when it poses cybersecurity or operational risk. The order revives the framework of his May 2020 directive (which the Biden administration suspended) and adds broader language citing "digital backdoors." Primes, contractors, equipment vendors, and utilities face a 120-day clock for Energy Department implementing rules. The criteria that made the 2020 version difficult for utilities to comply with (what qualifies as a "significant national security risk," the scope of covered software, and the phase-in for existing installations) remain undefined.
AUG 26
trade-press
DOJ Seizes QScan, QTRouter Tools Used to Breach Fed, Senate, NASA
The domain seizures knocked both platforms offline, but Nanjing Xinjiuwei is still operating, and the Senate was breached as recently as this year.
The Justice Department and FBI seized domains hard-coded into QScan and QTRouter, disabling both Chinese state-sponsored hacking platforms. The tools, built by Nanjing Xinjiuwei Network Technology and used by China's MSS and PLA, enabled the QTFY group to breach the Federal Reserve, DOE, DOJ, U.S. Senate, NASA, defense contractors, and hospitals since 2018; the Senate was hit this year. The domain seizures were surgical and effective, but the company behind the tools hasn't been touched, and QTFY exploited devices across more than 130 countries.
AUG 26
trade-press
Water utility detects CISA red team; government agency doesn't
The government SOC wasn't asleep; thousands of false-positive alerts buried the real ones, and organizational silos did the rest.
CISA published a rare public red-team report Tuesday detailing two voluntary assessments: one a government organization, the other a water utility. Both were breached through spearphishing. The water utility's SOC triaged phishing alerts and quarantined affected workstations in 2, 10, and 20 minutes; the government agency's SOC received the alerts but didn't respond, its defenders numbed by thousands of false positives that included higher-severity noise. Both organizations had identical blind spots. Cloud risk was underestimated. Conditional Access for workload identities was missing. And neither had a process to revoke compromised access tokens.
AUG 25
trade-press
Quantum-GUARD Act directs FERC to harden grid against quantum attacks
FERC gets told to study quantum threats to the grid, but the bill stops short of setting migration deadlines of the kind the executive branch already imposed on federal agencies.
The Quantum-GUARD Act, introduced by Sens. Mike Rounds (R-SD) and Chris Coons (D-DE), directs FERC to review electric-grid reliability standards for quantum-computer threats and to explore post-quantum cryptography for IT and OT systems. The bill authorizes FERC to "take such action the Commission determines to be appropriate." That's language that stops short of mandating migration timelines. For grid operators running quantum-vulnerable SCADA on legacy public-key crypto, Monday looks the same as Friday.
AUG 25
trade-press
Trump AI order compresses critical infrastructure threat timelines
AI shrinks the discovery-to-exploitation window for OT and ICS targets from weeks to hours, and EO 14409 signals that federal expectations for operator defenses are moving faster than formal rulemaking.
Executive Order 14409, signed June 2, reframes advanced AI as a national-security asset, and, by extension, a critical-infrastructure protection problem. The order directs CISA to issue binding operational directives on AI vulnerability management within 30 days and mandates a voluntary frontier-model review framework within 60. For infrastructure operators, the operational takeaway is blunt: AI compresses the threat timeline from discovery to exploitation, and the federal government is treating that compression as a here-and-now problem, not a future one. NIST is already developing an AI RMF profile for CI; CISA published joint OT-AI principles in December 2025. The EO pulls those threads into a coordinated expectation that operators mature AI governance now, ahead of formal regulation.
AUG 25
trade-press
Iran conflict accelerates cyber attacks on US water, supply chains
Flashpoint's H1 2026 report maps how the February strikes on Iran erased the line between state-affiliated targets and the commercial sector, pulling logistics providers and water utilities into the blast radius.
Flashpoint's H1 2026 threat landscape report, published August 13, identifies the February 28 strikes on Iran as a "massive structural accelerator" for cyber operations synchronized with kinetic military campaigns. The firm tracked Iranian-affiliated actors targeting US water utilities via programmable logic controllers (attacks that CISA, EPA, and the FBI warned about on July 30 without providing attribution) alongside disruptions to commercial shipping software, agricultural wholesalers, and banking platforms. Flashpoint's central finding: the boundary between state targets and commercial infrastructure has been functionally erased, with logistics providers, OT systems, and enterprise financial networks drawn into the targeting envelope regardless of their government affiliation.
AUG 25
trade-press
Water Watch Center opens for small utilities amid Iran-linked intrusions
The program targets the sector's structural problem (small systems with PLCs still exposed online and no budget to fix them) while attribution remains unconfirmed.
The National Rural Water Association and DEF CON Franklin launched the Water Watch Center at DEF CON, backed by five cybersecurity firms, to deliver direct mitigation support to water utilities serving fewer than 10,000 people. The initiative arrives as at least 12 states report intrusions against water infrastructure (more than 30 Minnesota systems were hit late last month) with U.S. officials weighing but not yet confirming Iranian responsibility. Acting CISA Director Nick Andersen told NextGov/FCW that PLCs with default or no passwords remain a live problem, and the agency's guidance hasn't changed: get operational technology off the internet and set a password.
AUG 25
trade-press
4,000 Rockwell Controllers Remain Internet-Facing After Water Attacks
Three joint federal advisories in 90 days and manufacturer warnings dating to 2018 haven't closed the water sector's ICS exposure, because no regulation requires utilities to remove controllers from the public internet.
Forescout's scan found 4,000-plus Rockwell Automation controllers exposed on the public internet in the U.S., including 22 in cities recently hit by water-system cyberattacks. Nineteen of those 22 ran firmware vulnerable to a 2017 RCE flaw. The findings land amid an FBI/EPA investigation into attacks across 12-plus states that caused pressure loss, flooding, and operator lockouts. This is the third major exposure event in 90 days: Censys flagged 3,900 exposed Rockwell PLCs in April, then the attacks arrived, and now Forescout shows the surface hasn't shrunk. Manufacturers have warned since 2018. CISA's mitigations fact sheet says to remove OT from the public internet. No federal regulation requires it, so the controllers stay reachable.
AUG 25
regulator
Hard-Coded VNC Password Among Four ANDRITZ HIPASE-250 Flaws
The vendor fixed all four in v8.00 back in December 2024, but energy-sector operators still running ≤7.20 remain exposed to unauthenticated data access and a shared VNC credential.
CISA published an advisory covering four vulnerabilities in ANDRITZ HIPASE-250 and 250 SCALA versions ≤7.20, deployed widely in the energy sector. CVE-2026-65313 is the most severe, a provisioning script sets a fixed, hard-coded x11vnc password on every engineering workstation, letting an adjacent-network attacker with knowledge of the shared credential gain VNC access (CVSS 8.1). CVE-2026-65310 exposes live process data and server configuration without authentication, CVE-2026-65309 stores passwords in reversible format, and CVE-2026-65311 lets an unauthenticated attacker suppress audit logging. ANDRITZ addressed all four in v8.00, released December 2024.
AUG 25
trade-press
CISA issues real-time water OT guidance as Iran-linked attacks spread
The operational shift from advisory to prescriptive isolation requirements marks CISA's most direct intervention yet during an active campaign.
CISA released urgent guidance Thursday telling water and wastewater operators to validate and isolate external OT connections after threat actors targeting exposed PLCs triggered boil water notices and operational disruptions across multiple states. The advisory, which does not attribute the activity but lands amid reports of Iran-linked attacks on water systems in at least seven states, warns that even mature organizations should scan for undocumented cellular modems installed by vendors or integrators. The guidance supplements CISA's new CI Fortify isolation framework, released jointly with the Australian Signals Directorate and other international partners, and arrives alongside a federal-agency open-source software security guide, updated SBOM minimum elements, and refreshed SCuBA cloud configuration baselines.
AUG 25
regulator
Siemens Patches Critical Command Injection in Siveillance Video
CVE-2026-3014 scores 9.1 despite requiring authentication, the scope change means compromised edit permissions cascade to full system compromise; hotfixes now cover three version branches.
CISA republished a Siemens advisory Tuesday for CVE-2026-3014, an OS command injection vulnerability in Siveillance Video management servers with a CVSS 3.1 score of 9.1. Affected versions: V2023 R3 before V23.3.27, V2024 R1 before V24.1.16, and V2025 before V25.1.15. The flaw requires authenticated access with edit permissions (it isn't unauthenticated internet-facing RCE) but the scope change and full CIA impact keep it critical. Siemens released hotfix revisions for all three branches, with no workaround offered.
AUG 25
trade-press
OT coalition demands CISA binding directive on agency OT security
When private-sector OT vendors formally ask the government to compel the government to secure its own operational technology, the voluntary-guidance era has run out of road.
The Operational Technology Cybersecurity Coalition on Friday asked CISA to issue a binding operational directive establishing baseline OT security requirements for federal civilian agencies. The request follows Iran-linked attacks on more than 30 water utilities across seven states, and comes one day after CISA warned utilities to take exposed PLCs offline. The coalition also called on Congress to renew the State and Local Cybersecurity Grant Program and extend the Cybersecurity Information Sharing Act of 2015, both set to expire in September. A BOD would bind only federal agencies, not the municipal water utilities actually being targeted, but the coalition argues it would set a floor the private sector could follow.
AUG 25
regulator
Siemens Solid Edge Patches Seven File-Parsing RCEs
Seven file-parsing bugs, all 7.8, spanning three CAD formats, the patch is clean, but the format spread says the parsers weren't hardened as a group.
Siemens patched seven vulnerabilities in Solid Edge's file-parsing engine, all allowing remote code execution at CVSS 7.8 when a user opens a crafted file. Solid Edge SE2025 needs V225.0.15; SE2026 needs V226.0.7. The local attack vector requires user interaction, but CAD workflows routinely exchange files across organizations, opening a malicious file isn't the rare event the CVSS vector assumes.
AUG 25
trade-press
CISA tells water utilities: pull PLCs off the internet now
The alert marks CISA's sharpest operational directive yet for the water sector, not monitor, not patch, but deprovision immediately.
CISA issued a public alert Thursday warning of a "significant increase" in coordinated attacks on water utility programmable logic controllers across at least seven states, with Minnesota reporting more than 30 systems affected since July 26. Attackers are modifying PLC passwords and IP addresses, locking out operators, triggering boil water notices, and forcing sustained manual operations. CISA's direction is unambiguous: remove publicly exposed PLCs and OT from the internet as soon as possible, and validate undocumented cellular modem connections that may not appear in routine scans. The alert does not name Iran, though concurrent investigations and an earlier April advisory tied similar OT targeting to Iranian-affiliated actors.
AUG 25
regulator
Siemens LOGO! Crypto Fix Requires Hardware Upgrade
The hardcoded-key and unsalted-hash vulnerabilities in LOGO! Soft Comfort survive a software-only V9 upgrade, closing only when the underlying hardware is also replaced with LOGO! V9 BM.
Siemens LOGO! Soft Comfort versions before V9 ship with a hardcoded AES master key for project-file encryption (CVE-2026-57262) and store project passwords as unsalted SHA-256 hashes (CVE-2026-57263). Both carry a 6.8 CVSS v3.1 base score with a local attack vector. Siemens' fix updates the software to V9, but a compatibility-mode footnote in the advisory means the vulnerabilities persist unless users also upgrade to LOGO! V9 BM hardware. That turns a patch cycle into a procurement and downtime project.
AUG 25
trade-press
CISA orders water utilities to pull internet-exposed ICS after Minnesota attacks
Second suspected Iran-linked strike on U.S. water infrastructure in 18 months, and utilities are still leaving PLCs wide open.
CISA issued a formal alert Thursday directing all U.S. water utilities to disconnect internet-exposed programmable logic controllers and industrial control systems. The order follows coordinated attacks on more than 30 Minnesota community water systems July 26, 27, which forced manual operations in several towns and triggered a boil-water notice in Braham. Investigators suspect Iran-aligned actors, though formal attribution remains pending. This is the second confirmed campaign against U.S. water infrastructure by suspected Iran-linked groups since the Aliquippa, Pennsylvania defacement in late 2023. The advisory reiterates guidance CISA and EPA have published repeatedly since November 2023 (most recently in a December 2024 joint fact sheet on exposed HMIs) which many utilities have ignored.
AUG 25
regulator
CISA Flags CVSS 10 Bug in Haiwell HMI Gateway
The OS command injection requires no authentication and hands attackers root on gear deployed across energy, manufacturing, and water sectors.
CISA published an advisory Thursday for CVE-2026-19188, a CVSS 10 OS command injection vulnerability in Haiwell IoT Cloud HMI Gateway version 3.40.1.12. The flaw sits in the Net Check feature's cmdPing Socket.io event, which passes unsanitized user input directly to the OS and doesn't require authentication. The gateway is deployed worldwide across energy, critical manufacturing, and water and wastewater sectors. Haiwell has released patch Scada-v3.50.1.19. No known public exploitation has been reported.
AUG 25
regulator
CISA Flags Rently Smart Home Credential Flaw
An authenticated attacker can retrieve master pins and override user permissions; Rently patched the flaw in late June with no user action required.
CISA published an advisory for CVE-2026-75960, an insufficiently protected credentials vulnerability (CWE-522, CVSS 8.1) in Rently Smart Home versions 20.1.0 and prior. An authenticated attacker can retrieve pins including the master pin and override user permissions. The product is deployed in commercial facilities and communications infrastructure in the U.S. and India. Rently says the vulnerability was patched in late June and no user action is required, but hasn't specified a patch version number or whether the update is automatic for deployed instances.
AUG 25