-
Hacking the Thermostat That Guards the Cloud: 5 CVEs in Trane HVAC Controllers
Five chained vulnerabilities in Trane Tracer SC+ HVAC controllers give remote attackers root access to data center cooling systems. A broken substitution cipher, hardcoded global credentials, and unauthenticated API endpoints combine into a full compromise chain. Firmware v6.30.2313 patches all five flaws.
-
BRIDGE:BREAK in the Wild: The Lantronix Serial-to-IP Flaw That Gives Attackers Root Access to Your OT Network
CVE-2025-67038 in Lantronix EDS5000 serial-to-IP converters is actively exploited in the wild. Forescout confirmed attackers reverse-engineered the firmware patch to build an exploit weeks before public disclosure. CISA added it to the KEV catalog June 23, 2026 with a 72-hour patch deadline.
-
AI Is Now Writing Zero-Day Exploits: Google Confirms the Threshold Has Been Crossed
For the first time, Google has confirmed that a cybercrime group used AI to develop a working zero-day exploit. The GTIG AI Threat Tracker reveals autonomous malware, industrialized vulnerability research by nation-states, and polymorphic evasion — with profound implications for OT/ICS defenders.