116 articles
OT / SCADARockwell Automation and CISA release advisory for ControlLogix 5580 controllers, patching a critical CIP protocol memory stride overflow (CVE-2026-70820).
OT / SCADAEmerson discloses critical vulnerability CVE-2026-69880 in Ovation Distributed Control System OCR400 controllers allowing remote code execution and turbine control logic tampering.
RansomwareA premier defense aerospace supplier files SEC Form 8-K Item 1.05 after ransomware actors compromise unclassified R&D enclaves and exfiltrate sensor avionics telemetry.
OT / SCADASiemens issues critical ProductCERT advisory for SCALANCE X industrial switches where a cryptographic verification bypass allows remote unsigned firmware injection.
RansomwareGlobal maritime shipping conglomerate files SEC Form 8-K disclosing a material ransomware intrusion freezing container terminal logistics across international ports.
VulnerabilityDefense aerospace contractor files SEC Form 8-K disclosing a material cyber incident involving compromised enterprise OAuth application tokens and telemetry theft.
OT / SCADASEC Form 8-K disclosure details a nation-state intrusion targeting municipal water SCADA gateways and programmable logic controllers.
Deep DiveContinuous zero-days in Citrix, Fortinet, and enterprise gateways demonstrate that reactive patching is failing. Only hardware MTE and Rust re-architectures offer an exit.
Data BreachThe exfiltration of 8.8M Danish CPR records exposes the systemic risk of partner API queries. Security leaders must replace static trust with verifiable credentials.
Data BreachDanish authorities confirmed an unauthorized entity abused legitimate commercial partner API credentials to exfiltrate 8.8 million CPR citizen identity records.
LinuxAttackers are weaponizing an exploit chain in Zammad helpdesk combining session fixation (CVE-2026-102489) with root privilege escalation (CVE-2026-102490).
GoogleGoogle published the Android October 2026 bulletin fixing high-severity System elevation of privilege flaws (CVE-2026-28640) requiring zero user interaction.
GoogleGoogle released Chrome 154.0.8037.97 resolving a critical out-of-bounds write flaw in WebGL (CVE-2026-103628) that exposes memory to arbitrary code execution.
Threat IntelKiteworks fixed a CVSS 10 root code-execution flaw in Email Protection Gateway (CVE-2026-54154) and three 9.8 account takeovers. Upgrade EPG and Core to 9.5.1.
MicrosoftLonglegs (Storm-2603) used on-prem SharePoint access, a BYOVD EDR killer and SYSVOL replication to push Warlock ransomware to 33+ hosts. IOCs inside.
Data BreachA phishing click let hackers copy Arizona court backup files: SSNs of ~1.3M FARE debtors, protective-order records and 150,000+ foster care reports.
Citrix NetScalerCitrix fixes CVE-2026-88779, a SAML memory overflow that crashes NetScaler ADC and Gateway. Last week's 14.1-73.37 and 13.1-64.23 builds are still vulnerable.
Cyber AttackANSSI's DGFiP report: infostealer credentials, weak MFA and an unmonitored portal let attackers steal impots.gouv.fr and cadastre data undetected.
MicrosoftExchange Server CVE-2026-96940 lets authenticated users read other mailboxes. Microsoft rates it Exploitation More Likely. Install the September 2026 v2 SU.
MicrosoftCisco Talos ties China-nexus UAT-11587 to Antino, a Rust backdoor taking orders via Outlook and exfiltrating via OneDrive, on ~350 endpoints in 8 countries.
MicrosoftProofpoint: China-aligned TA419 posed as an ex-White House OSTP official and an Anthropic employee to steal AI policy experts' Microsoft 365 sessions.
RansomwareA multinational law enforcement sweep led by German, Spanish, and Romanian police has dismantled KillSec, arresting three operators and seizing 110TB of data.
Threat IntelHardcoded passwords in Teledyne FLIR Aware2 software expose PackBot and FirstLook tactical EOD and defense robots to remote unauthenticated takeover.
Threat IntelAn authentication bypass and SQL injection in ground-station before v0.8.0 allows remote attackers to plant admin accounts and seize telemetry consoles.