The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
74 stories match. Clear filters
-
France blames Iran for fridge cyberattacks, says some caused fires
In the first attribution since the October attacks, the French authorities identified the perpetrators as part of Shahid Kaveh, an IRGC cyber unit previously linked to attacks on industrial controllers at U.S. water utilities.
-
U.S. Agencies Warn Refrigeration Controller Attacks Could Cause Fires and Inventory Losses
U.S. government agencies have warned that threat actors are actively targeting industrial refrigeration and cold-chain monitoring systems globally with an aim to cause service disruptions, fire hazards, and loss of inventory. "The actors may exploit vulnerabilities or weaknesses in unpatched or…
-
Iris Ohyama data cloud breach exposes info of 7.7 million customers
Japanese manufacturer Iris Ohyama, the operator of the Iris Plaza shopping platform, disclosed that personal information belonging to about 7.7 million people may have been exposed after unauthorized access to a third-party cloud service the company used. [...]
-
UK Warns Its Critical Infrastructure Faces Grave Risk
Britain's new Labour-led government is making a concerted push to get ahead of the AI risks to its national networks and the industrial complex.
-
FBI, CISA warn of cyberattacks targeting refrigeration systems
The FBI and CISA warn that hackers are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide, potentially causing food spoilage, equipment damage, and fire hazards. [...]
-
CISA and Government Partners Release Fact Sheet on Hardening Industrial Refrigeration and Cold Chain Monitoring Systems Against Malicious Activity
Cybersecurity and Infrastructure Security Agency (CISA) CISA and Government Partners Release Fact Sheet on Hardening Industrial Refrigeration and Cold Chain Monitoring Systems Against Malicious Activity [ ] 11/05/2026 1:00 PM EDT Today, the Cybersecurity and Infrastructure Security Agency (CISA)…
-
Google, Partners Disrupts 1.3 Million-Device-Strong XCPE Botnet
Google alleges that Android device manufacturer Videostrong ran the operation, which infected set-top boxes and IoT devices with a backdoor to create infrastructure for criminal activity.
-
Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors
A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an…
Also covered by Help Net Security
-
Google disrupts million-device XCPE Android malware botnet, bans TV box maker
Google and industry partners have dismantled the XCPE malware botnet consisting of more than 1.3 million Android TV streaming TV boxes that Google says its manufacturer intentionally infected with malware to generate revenue through cybercrime activities. [...]
Also covered by The Hacker News
-
Google disrupts XCPE botnet, bans the company behind it
Google shut down the servers behind XCPE, a backdoor hidden in the firmware of Android TV set-top boxes. Google’s Threat Intelligence Group attributes the operation with high confidence to Videostrong Technology, the company that manufactured many of those boxes. More than 1.3 million devices were…
-
Protecting OT, IoT and medical devices without disrupting operations
A smarter OT security strategy starts with visibility, context and prioritization.
-
Ivanti patches two more Connect Secure zero-days chained in attacks
Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1. [...]
Also covered by SecurityWeek
-
Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild. The vulnerabilities are listed below - CVE-2026-111357 (CVSS…
Also covered by CISA KEV, CISA KEV, Cybersecurity News
-
ICSA-26-258-06: Siemens Mendix SAML
Highest CVSS 8.7. Affects Mendix SAML (Mendix 10 compatible), Mendix SAML (Mendix 11 compatible), Mendix SAML (Mendix 9.24 compatible). Mendix SAML module contains a vulnerability that could allow unauthenticated remote attackers to hijack an account in specific SSO configurations. Mendix has…
-
ICSA-26-302-01: Siemens Mendix SAML Module
Highest CVSS 6.8. Affects Mendix SAML (Mendix 10 compatible), Mendix SAML (Mendix 11 compatible), Mendix SAML (Mendix 9 compatible). Mendix SAML module contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access by replaying a…
-
CISA ICS advisories ICSA-26-300-01 and -02: EPICS Base (CVSS 9.8) and Mitsubishi Electric/ICONICS SCADA suite (CVSS 9.1)
Facts per the aggregator: EPICS Base 7.0.10 and earlier has four unauthenticated integer overflow flaws (fixed in 7.0.11). Mitsubishi Electric and ICONICS products (GENESIS64, MC Works64, Hyper Historian, MobileHMI) have authentication bypass and arbitrary operation flaws plus a legacy libwebp…
-
Wazuh and AI for Enhanced SOC Workflows
Artificial Intelligence (AI) has become one of this decade's defining technologies. From healthcare and finance to manufacturing and education, organizations increasingly rely on AI to automate repetitive tasks, uncover patterns hidden within large datasets, and support faster decision-making…
-
Les supermarchés de l'UE paient d'un firmware de réfrigérateur non mis à jour
Des centaines de magasins ont subi des pertes se chiffrant en millions d'euros parce qu'ils avaient fait appel à des tiers pour gérer le micrologiciel OT obsolète qui pilotait leurs systèmes de climatisation.
-
ICSA-26-295-02: Siemens Industrial Edge App Publisher
Highest CVSS 8.3. Affects Industrial Edge App Publisher. The Industrial Edge App Publisher contains a vulnerability chain involving improper certificate validation and the rendering of unescaped data from backend responses. These issues can be combined to allow an attacker on the network to…
-
ICSA-26-295-05: Siemens SENTRON 3NA COM Fuse
Highest CVSS 5.8. Affects SENTRON 3NA COM Fuse. SENTRON 3NA COM Fuse contains a Denial-of-Service vulnerability. Improper handling of a network management message could allow an attacker to trigger a denial-of-service (DoS) condition. Successful exploitation may require the affected network to be…
-
ICSA-26-295-06: Siemens PSS(R)SINCAL
Highest CVSS 7.0. Affects PSS(R)SINCAL V21.5, PSS(R)SINCAL V22.0, PSS(R)SINCAL V22.5. PSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a denial-of-service condition…
-
ICSA-26-295-07: Siemens SIMATIC IPCs
Highest CVSS 7.7. Affects SIMATIC IPC BX-21A, SIMATIC IPC RW-543A, SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G. The products listed below contain a vulnerability that could allow an attacker to boot an operating system or UEFI application signed with that test key, bypassing UEFI…
-
ICSA-26-295-08: Siemens APOGEE, TALON and Desigo PXC/PXM Products
Highest CVSS 8.2. Affects APOGEE MBC (PPC) (BACnet), APOGEE MBC (PPC) (P2 Ethernet), APOGEE MEC (PPC) (BACnet) and 20 more. The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected…
-
ICSA-26-295-10: Siemens SIMATIC S7 Webserver API
Highest CVSS 7.5. Affects .NET Client Library for SIMATIC S7 Webserver API. .NET Client Library for SIMATIC S7 Webserver API contains multiple vulnerabilities that could allow an attacker to obtain sensitive information or write arbitrary files outside the intended download directory. Siemens has…
-
ICSA-26-295-12: Siemens RUGGEDCOM CROSSBOW
Highest CVSS 8.8. Affects RUGGEDCOM CROSSBOW. RUGGEDCOM CROSSBOW contains multiple vulnerabilities that could allow an attacker to execute arbitrary SQL commands on the underlying database, retrieve sensitive administrative credentials, escalate privileges, and perform unauthorized operations such…