-
Hacking the Thermostat That Guards the Cloud: 5 CVEs in Trane HVAC Controllers
Five chained vulnerabilities in Trane Tracer SC+ HVAC controllers give remote attackers root access to data center cooling systems. A broken substitution cipher, hardcoded global credentials, and unauthenticated API endpoints combine into a full compromise chain. Firmware v6.30.2313 patches all five flaws.
-
BRIDGE:BREAK in the Wild: The Lantronix Serial-to-IP Flaw That Gives Attackers Root Access to Your OT Network
CVE-2025-67038 in Lantronix EDS5000 serial-to-IP converters is actively exploited in the wild. Forescout confirmed attackers reverse-engineered the firmware patch to build an exploit weeks before public disclosure. CISA added it to the KEV catalog June 23, 2026 with a 72-hour patch deadline.
-
Sandworm Doesn’t Need Zero-Days: Russia’s Most Dangerous Cyber Unit Exploits Already-Compromised Industrial Environments
Nozomi Networks’ analysis of 5.5 million alerts from 10 industrial customers reveals that Sandworm (APT44) systematically exploits already-compromised OT environments. Every infected system gave an average of 43 days of advance warning. After detection, Sandworm escalates — targeting PLCs, HMIs, and engineering workstations directly.
-
AI Is Now Writing Zero-Day Exploits: Google Confirms the Threshold Has Been Crossed
For the first time, Google has confirmed that a cybercrime group used AI to develop a working zero-day exploit. The GTIG AI Threat Tracker reveals autonomous malware, industrialized vulnerability research by nation-states, and polymorphic evasion — with profound implications for OT/ICS defenders.
-
When Your Building Fights Back: EnOcean SmartServer Vulnerabilities Expose Building Management Systems to Root-Level Takeover
Two critical vulnerabilities in EnOcean SmartServer IoT (CVE-2026-20761, CVE-2026-22885) allow remote, unauthenticated attackers to gain root access to building management system controllers via crafted IP-852 UDP packets. Analysis, MITRE ATT&CK mapping, and defensive recommendations.
-
AI in the Breach: How an Adversary Used Claude and GPT to Target a Water Utility’s OT Environment
Dragos documents the first real-world case of an adversary using AI tools to target water utility OT infrastructure. Claude autonomously identified SCADA systems and launched credential attacks — without prior ICS knowledge.
-
Backdooring PLCs at Scale: How Three CODESYS Vulnerabilities Let Attackers Own Industrial Control
Three CODESYS vulnerabilities (CVE-2025-41658/59/60) let attackers backdoor Soft PLCs from hundreds of manufacturers. Full attack chain analysis and defensive playbook for OT security teams.
-
Iranian APT Actors Are Actively Compromising Internet-Exposed PLCs Across US Critical Infrastructure
On April 8, 2026, a joint advisory from the FBI, CISA, NSA, EPA, DOE, and US Cyber Command confirmed that Iranian-affiliated advanced persistent threat (APT) actors are actively exploiting internet-connected programmable logic controllers (PLCs) across multiple US critical infrastructure sectors. The attacks — attributed to actors linked to the CyberAv3ngers group and Iran’s Islamic…