NSA, CISA, FBI, DOE, and EPA warn of active AI-assisted attacks against Siemens S7 PLCs across US critical infrastructure sectors. Five U.S. federal agencies issued a joint advisory this week warning of an active hacking campaign against Siemens S7 Series programmable logic controllers. The advisory, CISA AA26-231A, is co-signed by NSA, FBI, DOE, and EPA and covers every S7 generation, from the S7-200 to the S7-1500 F-series safety controllers. The advisory is direct about one thing from the first paragraph: this is not a theoretical risk. “The threat actors are conducting reconnaissance and capability development against U.S.-based Siemens PLC installations using AI-generated exploitation scripts disguised as legitimate monitoring tools. The actors leverage Internet scanning services to find Internet-exposed PLCs running outdated software or that are otherwise poorly protected.” reads the advisory. “The U.S. critical infrastructure sectors most targeted by this threat activity include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities. This is not a theoretical risk—it is an active threat. “ The key detail is how the attackers try to hide their activity. They make their scripts look like legitimate OT monitoring software, making it harder for security teams to notice them while they map the target environment. The tools themselves are not custom malware. The attackers use the open-source snap7.dll and python-snap7 libraries, which are legitimate industrial automation tools. These libraries can communicate directly with Siemens PLCs over S7comm on TCP port 102, allowing access to PLC memory, configuration data and ladder logic programs. “Using AI to generate exploitation scripts represents an evolution in threat actor capabilities, dramatically reducing the technical expertise and time required to develop working ICS exploitation scripts and malicious tools. In addition, AI enables adversaries to rapidly leverage additional attack vectors and adapt to defensive measures.” continues the advisory. “Threat actors can easily collect public information about vulnerabilities and weaknesses, find exposed and exploitable PLCs, and use AI-generated scripts to act on that information. If PLCs are exposed to the Internet, they are at high risk for exploitation.” Researchers warn that a defender who patches a vulnerability may now find the attacker’s tooling already adapted before the change window closes. The observed activity breaks into two phases. Actors use scanning services like Censys and ZoomEye to locate Internet-exposed PLCs, then run read operations to understand the target environment before any writes happen. The authoring agencies assess this as pre-positioning: the actors are building a map and testing their techniques against specific CPU models, refining as they go, before they’re ready to cause disruption. The target list covers Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities. The Defense Industrial Base is also named, given its use of S7-series hardware. If these actors move from read to write, the potential consequences include process disruption, equipment damage, and safety incidents through manipulation of interlocks or emergency shutdown systems, and cascading effects across interconnected supply chains. The advisory flags third-party exposure as a specific problem. Asset owners who rely on system integrators or managed service providers for remote PLC access may not know their controllers are reachable from the Internet. If an external support partner holds credentials for your S7 devices and you haven’t recently verified that those connections are segmented and monitored, this advisory is a good prompt to check. There are several clear signs defenders can monitor. They should look for S7comm connections from devices that are not normally used for engineering, PLC read or write activity outside scheduled maintenance, and scans of multiple IP addresses on TCP port 102. It is also worth checking for Python processes loading snap7.dll on systems where it should not be present. Connections from unexpected countries or locations should also raise an alert. On the mitigation side, the agencies prioritize inventory first, then patching with Internet-facing controllers at the top of the queue. Block TCP port 102 at the perimeter firewall, require password protection on all controllers, configure protection levels to limit what an unauthenticated or low-privilege session can read or write, and deploy ICS-aware monitoring capable of baselining legitimate S7comm behavior. Disabling the PLC web server where it’s not needed and limiting simultaneous S7comm sessions also appear in the guidance, alongside TIA Portal’s know-how protection and complete restart protection features. The advisory closes by recommending direct engagement with Siemens ProductCERT for model-specific hardening and patch compatibility verification, which matters in OT environments where a firmware update can interact badly with third-party integrations and can’t simply be rolled back. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
Citrix has warned customers to immediately secure their systems against two vulnerabilities affecting NetScaler Gateway secure remote access solutions and NetScaler ADC networking appliances. The most severe of the two, tracked as CVE-2026-19490, can allow remote attackers without privileges to bypass authentication when the appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy), depending on the NetScaler firmware version and whether SAML Action is configured. Admins can check if an appliance is vulnerable to attacks targeting CVE-2026-19490 by inspecting their NetScaler configuration for SAML action configuration (add authentication samlAction .*) string and Auth or VPN vserver ('add authentication vserver .*' and 'add vpn vserver .*') strings.
Unit 42 details how attackers exploit enterprise collaboration tools for identity phishing and credential theft. Discover key defense strategies. The post Identity Abuse Through Trusted Communication Channels appeared first on Unit 42.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds an MLflow vulnerability to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Progress LoadMaster vulnerability, tracked as CVE-2026-64849 (CVSS score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-64849 is a critical server-side request forgery (SSRF) vulnerability in MLflow, a platform for managing machine-learning workflows. The issue affects MLflow versions before 3.15.0 and a remote attacker can exploit the issue without authentication. The vulnerability allows attackers to make requests from an exposed MLflow server to internal services, including cloud metadata endpoints, potentially exposing temporary cloud credentials. Attackers are actively exploiting CVE-2026-64849 to access cloud metadata services and steal credentials and secrets. Cybersecurity firm watchTowr also observed widespread scanning for exposed MLflow instances just hours after the CVE was assigned on August 17, 2026. “watchTowr Intel is observing in-the-wild exploitation of a critical unauthenticated Server-Side Request Forgery vulnerability in MLflow (CVE-2026-64849), the open-source platform for managing the machine learning and AI development lifecycle, with over 60 million monthly downloads.” watchTowr said in a post on LinkedIn. “Attackers are exploiting the vulnerability to reach cloud metadata services directly, and exfiltrating cloud credentials and secrets. Within hours of the CVE being assigned, Attacker Eye, our global honeypot network, detected attackers indiscriminately scanning for exposed MLflow systems online, capturing attempts against cloud-hosted instances.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks within the U.S. These clusters include UNC6293, UNC7005, and UNC5976. "These clusters engage in persistent, adaptive
U.S. healthcare IT company CareCloud disclosed that the data breach incident it suffered earlier this year has impacted more than 3.7 million individuals. The healthcare technology organization is publicly traded and provides electronic health records, medical billing, practice management, and revenue-cycle services. The company disclosed the incident in March via a filing with the U.S. Securities and Exchange Commission (SEC), noting that the attack caused an 8-hour network disruption on its platform and cut access to one of its databases. At the time, the firm said the compromised environment contained patient data, indicating the risk of sensitive medical information being stolen. Following the incident, CareCloud launched an investigation to determine its scope and how many people were potentially impacted.
Huntress observed a 155x increase in password spraying attacks in H1 2026, including a campaign that generated more than 81 million login attempts in two weeks. The attacks exploited legacy authentication and gaps in MFA policies that left some login flows unprotected.
Cybersecurity researchers have disclosed details of a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token (JWT) from a co-located Worker in the production environment at up to 12 bits per second, 360 times the rate of an earlier attack demonstrated in 2021. The end-to-end experiment used an attacker Worker and a victim Worker controlled by the researchers,
Cybersecurity researchers at Hunt.io have disclosed details of a campaign that they say compromised more than 14,530 Dahua devices between June 17 and July 22, 2026, using credential attacks, two authentication-bypass flaws, and a peer-to-peer (P2P) relay technique. The activity, codenamed Operation CameraSwarm, was reconstructed from a 407 MB exposed working directory containing 2,616 files
Comcast is promoting WiFi-based motion detection as a part of its new Xfinity Shield home protection platform, allowing routers and wireless devices to detect people moving through a home without cameras or motion sensors. This feature was announced as part of a new Xfinity Shield product offering on Tuesday, a new application suite that combines cybersecurity, physical home monitoring, and family safety features through Xfinity WiFi and the Xfinity app. Part of this new offering is WiFi Shield, which is included at no additional cost for Xfinity Internet customers with compatible gateways. It combines Xfinity's CyberSecure network protection, Family Settings, and WiFi Motion, with Home Watch, Away Watch, and Dark Watch modes used to control when notifications are generated. Comcast is also launching Shield Select for $15 per month, which adds an indoor camera, door/window sensor, cloud video storage, and 24/7 urgent response functionality.
Confirm this action.
Leaving now will discard your changes.