The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
74 stories match. Clear filters
-
Rockwell Automation DataMosaix Private Cloud unauthenticated data exposure
DataMosaix Private Cloud (CVE-2024-7952, CVSS 8.7) contains hardcoded links to JSON files reachable without authentication, exposing customer data. This is a late disclosure of an existing CVE, newly published in today's vulnerability feeds.
-
Internet-exposed OT and edge devices remain the top disruptive-risk focus
This digest synthesizes a UK NCSC advisory (Aug 27) on rising OT targeting and a Claroty Team82 analysis of 200+ cyber-physical attacks over 12 months, finding 82% involved VNC-based remote access to exposed assets and 66% involved compromised HMIs or SCADA systems. Recommendations: asset…
-
Falcon ransomware group claims 2.96 TB from medical device maker Globus Medical, including FDA submission and adverse event records
The Falcon ransomware group listed Globus Medical (NYSE: GMED), a publicly traded spinal and orthopedic implant manufacturer, and claims 2.96 TB of data centered on a full Microsoft Power BI environment with more than 51,000 customer records. The claimed contents include FDA feedback, 510(k)…
-
Nearly four in ten German companies now blame a foreign intelligence service for at least one attack
Bitkom surveyed 1,003 German companies with at least 10 employees and found that of those hit by data theft, industrial espionage, or sabotage in the past year, nearly 40 percent attributed at least one incident to a foreign intelligence service, up from 28 percent last year and 7 percent in 2023…
-
CISA says over 100 internet-exposed water systems were targeted in July, most via PLCs on cellular modems
CISA has for the first time quantified the summer wave of attacks on the Water and Wastewater Systems Sector, saying it observed malicious activity against more than 100 internet-exposed systems in July, commonly PLCs wired straight to a cellular modem. The activity is linked to Iranian threat…
-
Joint federal advisory: AI-generated exploitation scripts aimed at Siemens S7 PLCs
Five federal agencies warned that an unidentified threat actor is scanning for internet-exposed Siemens PLCs and building exploitation capability against them. The actor is using AI to generate Python exploitation scripts built on the snap7.dll and python-snap7 libraries, disguised as legitimate…
-
Saturday leak-site wave hits a foundry, a car dealership group, and a barcode manufacturer
At least twelve organizations were posted to ransomware leak sites on August 15. Storm listed Integra Castings, a Canadian iron foundry and division of The CTD Group, and Canadian law firm Tapper Cuddy LLP. Clop claimed Zebra.com, saying it exfiltrated databases and CAD files, and also listed UK…
-
Okta details Work Panel, the console behind industrial-scale vishing
Okta published a look inside Work Panel, a multi-tenant platform that packages everything needed to run a vishing-driven account takeover operation against identity providers, including Okta itself. Registering a phishing domain, cloning a target brand, and standing up an isolated phishing site…
-
Dragos counts 1,140 ransomware incidents against industrial organizations in Q2, up 12 percent
Dragos identified 1,140 ransomware incidents affecting industrial organizations worldwide in Q2 2026, a 12 percent increase over Q1. Manufacturing was hit hardest with 747 incidents, 65 percent of the total. ICS-adjacent organizations, meaning engineering firms, system integrators, and equipment…
-
ICS Patch Tuesday: Siemens, Schneider Electric, Phoenix Contact, Honeywell
Siemens published 10 advisories, including a maximum-severity missing-authentication flaw in SIMATIC IoT2050 Advanced (remote unauthenticated code execution with elevated privileges) and a critical code execution bug in Siveillance Video Management Servers. High-severity issues hit Solid Edge…
-
SAP August 2026 Patch Day: two CVSS 10.0 flaws, plus a manufacturing-platform command execution bug
SAP Commerce Cloud (CVE-2026-58231, CVSS 10.0) lets an unauthenticated attacker abuse a default authentication client and reach functions lacking input validation, enabling arbitrary code execution and compromise of internal components. SAP NetWeaver Application Server ABAP (CVE-2026-34265, CVSS…
Also covered by The Hacker News
-
Siemens SIMATIC IoT2050 Advanced: unauthenticated Node-RED code execution, CVSS 10.0
All versions of the SIMATIC IoT2050 Advanced gateway (6ES7647-0BA00-1YA2) below V4.3.4.1 running Industrial OS with Node-RED installed fail to enforce authentication on the Node-RED HTTP interface. An unauthenticated remote attacker can reach programming nodes capable of running system commands…
-
Joint federal advisory: Gunra ransomware bypasses MFA through Fortinet SSL-VPN and Schneider Electric flaws
FBI, CISA, DC3, NSA, the Secret Service, and South Korea's National Police Agency issued a joint #StopRansomware advisory on Gunra, a Conti-derived RaaS operation that has matured through 2026. Gunra actors modified authentication processing files on a corporate VDI portal so that one specific…
-
Fresh breach disclosures (Aug 10 discovery batch): law firm, French bank unit, Swedish supplier, others
New victim disclosures surfaced Aug 10 across sectors and regions: Barclay Damon (US law firm), BPCE International (unit of France's Groupe BPCE), Axson Teknik AB (Swedish technical/manufacturing supplier), aZaaS (Singapore enterprise tech), and ATMS & Co. LLP (Indian chartered accountancy)…
-
Iran-linked cyberattacks on US water utilities expand to at least 12 states; CISA still finding exposed PLCs
Suspected Iran-backed actors have hit operational technology at water and wastewater systems in at least a dozen states (Michigan, Minnesota, Georgia, New Jersey, South Dakota and others), with South Dakota and Georgia among the latest to disclose. Minnesota alone reported more than 30 community…
-
CERT Polska details novel private-APN pivot that sabotaged a second Polish energy facility
A three-month CERT Polska investigation into the December 29, 2025 attacks (30 wind and solar sites plus a CHP plant) uncovered a previously unseen vector: attackers used a private APN to reach the OT network, aided by a misconfiguration letting arbitrary devices in the APN talk to each other. The…
-
New Jersey and Alabama join at least a dozen states hit by Iran-linked water-ICS attacks
New Jersey and Alabama are the latest to confirm water and wastewater OT systems targeted in an Iran-linked campaign that began in late July, now spanning at least 12 states including Minnesota, Michigan, South Dakota, and Georgia. Attackers are hitting internet-exposed PLCs and ICS; the FBI…
-
CISA, FBI, and EPA warn of active attacks on internet-facing water-sector PLCs
CISA, joined by the FBI and EPA, warns that threat actors are targeting internet-exposed programmable logic controllers in the Water and Wastewater Systems sector. Observed tactics include changing PLC passwords to lock out operators and altering device IP addresses to disconnect them, producing…
-
Dozens of Minnesota water utilities hit in coordinated OT attacks; CISA urges water sector to lock down PLCs
A coordinated campaign hit dozens of Minnesota water and wastewater systems, and CISA responded by urging the sector to lock down internet-exposed controllers. Officials flagged Iranian-affiliated actors, who have both the motive and a track record of targeting water OT. This is real-world OT…
-
Daxin rootkit found still active on a manufacturer's network after 13 years
Symantec found the China-linked Daxin rootkit plus a previously undocumented backdoor named Stupig running on a Taiwanese manufacturer's network, with evidence the intrusion traces back to 2013. Daxin is a kernel-level implant built for stealth and long-dwell espionage, including relaying commands…
-
CISA releases batch of ICS advisories, including Rockwell Automation Logix controllers
CISA published its July 16 batch of industrial control system advisories, among them Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix (ICSA-26-197-06) and the Rockwell Flex 5000 adapter (ICSA-26-197-08), plus SALTO ProAccess Space access control and a NASA cFS…
-
Siemens, Schneider Electric and Rockwell Automation post July advisories, including a CVSS 10 flaw
Siemens published nine advisories (six critical), including a CVSS 10 token-invalidation authentication bypass in OpenCenter X; other critical fixes touch Mendix, Sidis Secured SmartPlug, Simatic S7-1500, Cadra, and Desigo CC. Schneider Electric issued two advisories: a high-severity…
-
CISA publishes batch of June 23 ICS advisories (ICSA-26-174 series)
CISA released a batch of Industrial Control Systems advisories on June 23 (ICSA-26-174-01 through -07), covering vulnerabilities in widely deployed OT vendor equipment. Recent CISA ICS cycles have concentrated on Siemens, Schneider Electric, Rockwell Automation, and ABB products that run in…
-
Tata Electronics confirms breach; World Leaks dumps alleged Apple and Tesla supplier files (backfill, dated June 22-23)
Tata Electronics, a major manufacturing supplier to Apple and Tesla, confirmed a cybersecurity incident after the group World Leaks, widely believed to be a rebrand of Hunters International, posted a roughly 204,000-file, 630 GB cache it says contains component designs, schematics, mechanical…