Loading story…
CISA published guidance explaining why secure variants of common industrial communication protocols remain under-adopted across critical infrastructure OT environments, despite being available for decades. The guidance highlights persistent reliance on legacy protocols designed for uptime rather than security, leaving common gaps—no authentication, no integrity, and no confidentiality—that enable attackers with OT network access to impersonate devices, alter messages in transit, or issue unauthorized commands. CISA based its findings on interviews with asset owners/operators across sectors including Water/Wastewater, Transportation, Chemical, Energy, and Food/Agriculture, and pointed to secure alternatives such as DNP3 Secure Authentication, CIP Security, Modbus Security, and OPC UA, while noting real-world barriers like cost, complexity, and operational fragility.
Separately, reporting described Operational Relay Box (ORB) networks—mesh-like relay infrastructure built from compromised IoT devices, SOHO routers, and VPS nodes—used by threat actors to obscure attack origins and blend malicious traffic into residential/business broadband patterns, complicating blocking and attribution. The ORB discussion was tied to a Singapore CSA disclosure that UNC3886 targeted major telecom operators (M1, SIMBA, Singtel, StarHub), reportedly exploiting zero-day perimeter firewall vulnerabilities and deploying rootkits for stealth and persistence. In OT device security, CERT@VDE warned of a cluster of critical vulnerabilities in WAGO 852 series industrial managed switches (models 8052-1322 and 0852-1328, firmware 2.64 and earlier), including CVE-2026-22906 (hardcoded AES-ECB key enabling credential recovery from configuration files) and additional critical issues (CVSS 9.8) in the web management stack (modified lighttpd and custom CGI) that can be triggered via oversized cookie parsing to crash devices or potentially enable remote code execution—conditions that materially increase the risk of remote takeover within OT networks.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CISA published guidance explaining why secure versions of common ICS/OT protocols remain underused, citing cost, operational complexity, uptime concerns, and PKI management challenges. The agency recommended phased deployment of signing and selective encryption, along with secure-by-default vendor support and crypto-agility.
Singapore's Cyber Security Agency disclosed that state-sponsored group UNC3886 targeted all four major Singapore telecommunications operators—M1, SIMBA Telecom, Singtel, and StarHub. The campaign reportedly involved exploitation of zero-day perimeter firewall vulnerabilities and deployment of advanced rootkits for persistence and evasion.
CERT@VDE disclosed multiple critical vulnerabilities affecting WAGO 852 series Industrial Managed Switches, including hardcoded cryptographic material, stack buffer overflows, and an authentication-bypass flaw. The issues could allow attackers to recover credentials, bypass authentication, crash the web service, or potentially achieve remote code execution on devices running firmware 2.64 and earlier.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Government and industry reporting warns that operational technology and industrial control systems remain dangerously exposed through weak remote access, poor segmentation, and internet-facing devices, giving both state-backed and criminal actors paths into critical infrastructure. A joint **CISA/NSA** advisory said adversaries routinely exploit legacy OT environments, public system information, and insecure remote connections to move from reconnaissance to manipulation of physical processes, while a separate **CISA/FBI** alert tied Chinese state-sponsored intrusions to U.S. natural gas pipeline operators and said the actors stole SCADA and ICS information to build capabilities for future disruption. Recent exposure research also found **6,300** internet-reachable industrial-control and building-automation devices near U.S. data centers, including **BACnet**, **Fox/Niagara**, **Modbus**, and Vertiv/Liebert systems that could affect cooling and power operations. The threat has already translated into real-world disruptive activity and increasingly specialized tooling. Dragos reported **FrostyGoop**, a Golang-based ICS malware that communicates over **Modbus TCP** and was likely used to disrupt heating services in Lviv, Ukraine, after attackers apparently entered through an internet-facing router and traversed poorly segmented networks. Other cited incidents and assessments include Israel’s thwarted attempt against water facilities, persistent Russian probing of U.S. power infrastructure, and leaked-document analysis describing a Russian capability designed to attack rail and petrochemical control systems through telecommunications access. Across the reporting, the common defensive priorities were to eliminate direct public exposure, harden and inventory remote access, enforce MFA, replace default credentials, patch supported systems, restrict engineering tools, and closely monitor OT network and protocol activity.
Aug 15, 2026
Rockwell Automation, Siemens, and Schneider Electric issued July industrial security advisories covering dozens of OT vulnerabilities, with Rockwell disclosing multiple high-impact flaws in control and I/O products. The most severe Rockwell issue, **CVE-2026-10577**, affects `1715 Redundant IO` and exposes a network-accessible debug port without authentication, allowing remote attackers to run intrusive CLI commands, read or delete files, stop tasks, modify memory, and change I/O states; the flaw carries a **CVSS v4.0 score of 10.0**. Rockwell also reported **CVE-2026-9636**, a CIP Security certificate revocation handling weakness in several `CompactLogix 5380`, `ControlLogix 5580`, `GuardLogix 5580`, and `1756-EN4` devices that could let a network attacker connect with a certificate that should no longer be trusted, and **CVE-2025-11698**, a buffer overflow in Logix controller recovery images that can trigger a major non-recoverable fault and cause denial of service. Separately, CERT VDE published **VDE-2026-031** for **CVE-2026-4769**, a critical **WAGO System I/O Field** vulnerability caused by an undocumented internal diagnostic function exposed without authentication during early boot. An unauthenticated remote attacker can exploit the startup window to access internal system processes and fully compromise affected `0765-series` devices; the issue is rated **CVSS 3.1 9.8** and **CVSS 4.0 9.3**. Siemens also disclosed **CVE-2025-40945**, an untrusted search path flaw in the IAM Client SDK used across products including `COMOS`, `Designcenter NX`, `Simcenter`, `Solid Edge`, `Teamcenter Visualization`, and `Tecnomatix`, enabling local privilege escalation for authenticated users and reinforcing the breadth of current patching demands across industrial environments.
Jul 17, 2026
Public disclosures highlighted multiple high-severity vulnerabilities across industrial control systems, open-source software, and consumer networking gear, with several issues enabling **unauthenticated remote compromise**. Johnson Controls disclosed **CVE-2025-26385** (CVSS 10.0), a critical SQL injection affecting multiple building/ICS management products (including *ADS/ADX, LCS8500, NAE8500, SCT, CCT*) that can allow remote, unauthenticated attackers to execute arbitrary SQL to alter/delete/exfiltrate data; CISA guidance emphasized isolating control system networks from the internet, segmentation, and controlled remote access (e.g., VPNs). Additional unauthenticated remote issues include **CVE-2026-25069** in *SunFounder Pironman Dashboard* (path traversal in log API endpoints enabling arbitrary file read/deletion) and **CVE-2025-51958** in the *DokuWiki* `runcommand` plugin (unauthenticated command execution via `lib/plugins/runcommand/postaction.php`). Other disclosures include developer-tooling and application-layer injection flaws and multiple router memory-corruption bugs with public exploit references. *Orval* fixed **CVE-2026-25141**, a code-injection issue where incomplete escaping can be bypassed using **JSFuck**-style payloads, and *Cybersecurity AI (CAI)* addressed **CVE-2026-25130**, where `subprocess.Popen(..., shell=True)` enables argument/command injection leading to RCE (notably via the `find_file()` tool). Data-layer issues include **CVE-2025-69662** in *geopandas* (`to_postgis()` SQL injection) and **CVE-2026-24854** in *ChurchCRM* (authenticated SQL injection via `PerID` in `/PaddleNumEditor.php`, patched in 6.7.2), while **CVE-2025-36384** affects *IBM Db2 for Windows* (local privilege escalation via unquoted search path). SOHO router flaws **CVE-2026-1686** (*Totolink A3600R*) and **CVE-2026-1637** (*Tenda AC21*) describe remotely reachable buffer/stack overflows with publicly available exploit material, increasing the likelihood of opportunistic exploitation where exposed management interfaces exist.
Jun 29, 2026