The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
74 stories match. Clear filters
-
ICSA-26-295-13: Siemens WinCC
Highest CVSS 8.8. Affects SIMATIC WinCC V7.5, SIMATIC WinCC V8.0, SIMATIC WinCC V8.1. Multiple SIMATIC WinCC versions are affected by a database privilege escalation vulnerability that could allow an authenticated user with access to the database to execute commands on the underlying host system…
-
ICSA-26-295-14: Siemens SIMATIC S7 PLCs Web Server
Highest CVSS 9.6. Affects SIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0), SIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0), SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SJ01-0AB0) and 154 more. SIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that…
-
ICSA-26-295-15: Siemens RUGGEDCOM CROSSBOW Station Access Controller
Highest CVSS 9.8. Affects RUGGEDCOM CROSSBOW Station Access Controller (SAC). RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a denial of service, or obtain…
-
ICSA-26-295-16: Siemens SIMATIC S7-1500 TM MFP
Highest CVSS 10.0. Affects SIMATIC S7-1500 TM MFP - GNU/Linux subsystem. Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not…
-
ICSA-26-295-17: Siemens Industrial Edge Devices
Highest CVSS 9.1. Affects Industrial Edge Cloud Device (IECD), Industrial Edge Own Device (IEOD), Industrial Edge Virtual Device (IEVD) and 63 more. Siemens Industrial Edge Devices contain multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access…
-
ICSA-26-295-18: Siemens RUGGEDCOM APE1808 Devices
Highest CVSS 7.5. Affects RUGGEDCOM APE1808. Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens recommends to contact customer support to receive patch and…
-
MITRE ATT&CK v20 adds AI abuse, MFA bypass, and water utility PLC attacks
Nine new Enterprise techniques include direct and indirect prompt injection, abuse of an organization's own AI agents for data theft, and theft of app-specific passwords that skip MFA. Coding-agent and IDE config files now count as compromised dependencies. ICS gets nine detection strategies, a…
-
Siemens Software Center bug exploited in ClickFix malware campaign (CVE-2026-110936)
A DLL side-loading flaw (CVSS v4 8.4) in Siemens Software Center was disclosed Oct 15 and fixed in 4.0.9.8. On Oct 19 Siemens confirmed in-the-wild abuse. Attackers pair the legitimate signed Software Center executable with their own DLLs and deliver it through fake CAPTCHA (ClickFix) lures from…
Also covered by CISA KEV, CISA ICS Advisories
-
Building automation and refrigeration attacks: Armis and Dragos data adds scale to the French grocery incident
Attackers hit thousands of refrigeration controllers across hundreds of French grocery stores, causing spoilage and fires. Armis: 73% of organizations have a building automation system with known exploited flaws. Dragos: ransomware incidents against industrial orgs hit 1,020 in Q1 2026 and 1,140…
-
Former engineer sentenced to 32 months for locking 3,000+ devices at an industrial company
Daniel Rhyne, 57, a former core infrastructure engineer at a New Jersey industrial company, used admin credentials in Nov 2023 to delete 13 domain admin accounts, reset 301 user passwords, and lock 254 servers and 3,284 workstations. He demanded 20 bitcoin (about $750,000). Arrested Aug 2024…
-
NCC Group: August ransomware hits 2026 high, industrial sector takes 31%
1,073 attacks in August, up 12% from July. Industrial sector accounted for 329 (31%). North America took 44%, Europe 26%. Qilin led with 164 attacks (15%). The newer Aurora operation, active since late April, gets in through weak or unauthenticated VPN access, harvests credentials with PowerShell…
-
NIST releases draft SP 800-82 Rev. 4, overhauling OT security guidance
NIST released a 321-page initial public draft of SP 800-82 Rev. 4, the core OT security guide, dated September 21. The rewrite aligns with Cybersecurity Framework 2.0, adds consequence-driven risk management (focusing on preventing unsafe/destructive outcomes, not just network protection), and…
-
Health-ISAC publishes a nine-domain MedTech security baseline for device procurement and lifecycle decisions
Health-ISAC's Medical Device Security Council released a MedTech Security Baselines paper naming nine foundational cybersecurity capability domains for healthcare delivery organizations and device manufacturers to use during evaluation, procurement, deployment, exception review, and lifecycle…
-
Ransomware attacks on manufacturers up 40 percent, with half the attacks from groups that did not exist two years ago
Black Kite counted 1,183 new manufacturing ransomware incidents in the first seven months of 2026, a 40 percent rise over the same period in 2025. Half the attacks came from groups that did not exist two years ago, and one new group, The Gentlemen, accounted for 12 percent of this year's attacks…
-
Cyolo and Nozomi Networks integrate asset intelligence with OT access controls
The integration links Nozomi asset discovery to Cyolo access enforcement so that OT access decisions carry asset context. Vendor news, not an incident.
-
Yokogawa opens an Industrial Cyber Resilience Center in Singapore
Yokogawa Engineering Asia opened an Industrial Cyber Resilience Center at its Singapore office to support OT cybersecurity for regional industrial customers. Automation vendors continuing to build dedicated OT security service arms is a competitive signal worth tracking.
-
Dispel opens a free remote-access program for small US water and electric utilities
Dispel launched its Community Power and Water Program at the American Public Power Association Cybersecurity and Technology Summit, extending secure remote access tooling used by large utilities to small ones. Internet-exposed PLCs at small water and electric utilities remain one of the most…
-
DOE funds three OT security vendors under the SENTRY energy cybersecurity program
The Department of Energy's Office of Cybersecurity, Energy Security, and Emergency Response named Frenos, Raptor Dynamix, and Bastazo as recipients under the Securing Energy Technology Resiliency program. Federal funding direction is a reasonable leading indicator of where energy-sector OT…
-
Nozomi finds four memory-corruption flaws in the Siemens SCALANCE LPE9403 PROFINET stack
Nozomi Networks Labs used emulation-driven snapshot fuzzing with the Unicorn CPU emulator to find four memory-corruption vulnerabilities in the PROFINET Discovery and basic Configuration Protocol implementation on the Siemens SCALANCE LPE9403 industrial edge device. DCP is a Layer 2 protocol with…
-
Schneider Electric, Siemens, and AVEVA publish September ICS Patch Tuesday advisories, critical authentication flaw in Modicon M580
Schneider Electric published four new advisories and updated four existing ones, including one originally issued in 2019. The most severe new issue is CVE-2026-3869, a critical authentication vulnerability in Modicon M580 and Modicon M580 Safety controllers, rated CVSS 9.2. Schneider also fixed…
-
CISA publishes healthcare and industrial advisories: NextGen Mirth Connect, Orthanc DICOM Server, AVEVA Pipeline Integrity Monitor
CISA released three advisories on September 10. ICSMA-26-253-01 covers NextGen Healthcare Mirth Connect, where versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, potentially disclosing stored credentials for connected systems, writing…
-
ICS Patch Tuesday: Schneider Electric ships a CVSS 9.2 authentication flaw fix for Modicon M580, Siemens fixes two critical account takeover and root access bugs
Schneider Electric published four new advisories and updated four others. The most severe is CVE-2026-3869, a critical authentication vulnerability in Modicon M580 and Modicon M580 Safety controllers scoring CVSS 9.2, affecting every M580 running an application level below 4.00 and every M580…
-
NSA, CISA, and FBI name six China-based AI firms in a joint advisory on industrial-scale model distillation
The three agencies issued a joint advisory naming DeepSeek, Alibaba, Moonshot AI, MiniMax, StepFun, and Z.AI as running what it calls aggressive, malicious, and targeted knowledge distillation campaigns against US frontier models since at least late 2024, likely with Chinese government awareness…
-
Project Watershed 250: White House, Texas, and Forescout launch water-sector OT defense initiative
Forescout announced its participation in Project Watershed 250, a joint effort with the White House and the State of Texas to give water and wastewater utilities continuous OT monitoring, adversary-focused assessments, vulnerability prioritization, and network segmentation support. The program…
-
Talassoft Industrial Management Software SQL injection
CVE-2026-18630 (CVSS 8.8) is an SQL injection flaw in Talassoft Industrial Management Software from TMT Machine Industry and Trade Ltd, allowing low-privilege network attackers unauthorized database access.