⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
CISA warns of a significant increase in cyber threat actors targeting programmable logic controllers in the Water and Wastewater Systems Sector, urging organizations to remove exposed PLCs from the internet. The activity has caused operational disruptions, and CISA recommends specific mitigations including disconnecting PLCs and using VPNs.
This advisory from CISA describes a vulnerability in Watchfire Controller Software, identified as CVE-2026-5846. The issue stems from hard-coded RSA private keys and X.509 certificates used for HTTPS/TLS, which could enable an attacker to gain full control of the controller.
This CISA advisory highlights multiple vulnerabilities in Johnson Controls OpenBlue Employee (FMS Employee) software. The flaws include unrestricted file upload, stored cross-site scripting, and HTML injection, which could allow an attacker to upload malicious files or execute script-based attacks.
CISA published an advisory on high-severity vulnerabilities in Schneider Electric IGSS SCADA/HMI software. Successful exploitation could lead to remote code execution on industrial control systems.
MZ Automation libiec61850 contains multiple out-of-bounds read vulnerabilities affecting the GOOSE subscriber component. An unauthenticated attacker can send specially crafted multicast frames to trigger a heap out-of-bounds read, leading to a denial-of-service condition.
View CSAF Summary Successful exploitation of these vulnerabilities could crash the device being accessed.