Topic
Security of operational technology and industrial control systems, including PLC exposure, segmentation failures and physical-process impact.
Grid-tech vendors have had to report actively exploited vulnerabilities and severe incidents under the EU Cyber Resilience Act since 11 September 2026. SBOMs and vulnerability handling become mandatory on 11 December 2027.
Reality
CISA and six partner agencies updated AA26-097A on July 22, extending the vendor scope beyond Rockwell and adding detection guidance for tampered reusable code modules.
Reality
The FBI and EPA's advisory I-073026-PSA blames a water-sector campaign across at least seven states on MicroLogix controllers left reachable on the open internet. The remedy they describe is network placement.
Reality
Five US agencies report attackers scanning for exposed S7 PLCs and using a public library to read and write data blocks. The mitigation list reads like a commissioning checklist.
Reality
The governor's office raised an Iranian-backed campaign against drinking water systems and would not say whether the two Colorado utilities hit in late August were part of it. Both remain unnamed.
Reality
Ridge Security disclosed CVE-2026-42542, a flaw that lets an unauthenticated attacker crash a TDengine server with one malformed packet on port 6030. A patch shipped in 3.4.1.6, and the only proven payoff is a crash.
Reality
Coast Guard Cyber Command says its teams found malicious cyber activity aboard both hulls after offshore boardings in the Gulf of Mexico, while the engine-room manipulation and the 30-hour communications outage rest on one Iranian state media report.
Perspective Coverage
3 publishersReality
Vedere Labs did get Claude Code to move a working exploit onto a second WAGO controller, and the price of doing it puts a measurable ceiling under the pitch that AI now writes OT exploits at machine speed.
Reality
CISA says attackers reached programmable logic controllers over the internet during July 2026, changed IP addresses and passwords, and left some utilities unable to monitor their own equipment. No actor has been named.
Reality
CISA counted more than 100 internet-exposed water and wastewater systems targeted in July. The typical example is a controller wired straight to a cellular modem, a path that leaves no proxy log and often no inventory entry.
Reality
The count federal agencies had not published arrives attached to a remediation list that begins with taking inventory, which says more about this campaign than the attribution does.
Reality
Pentest Partners found corporate wireless coverage in an OT control room putting office devices on the control LAN. Firewall rules were not where the segmentation broke.
Reality
CVE-2026-75112 in OTTO Fleet Manager puts warehouse automation on the same credential-handling footing as ordinary IT. Rockwell says it found the issue in routine internal testing.
Reality
A Siemens-specific follow-up to the July PLC warning describes internet-wide discovery paired with AI-generated Python tooling that reads and writes ladder logic.
Reality
DEF CON Franklin and the NRWA are funding small-utility defense with philanthropy and volunteer labor, not appropriations. The arithmetic decides who actually gets helped.
Reality
A wind-farm FortiGate and a Teltonika router put intruders onto a DSO-managed APN, where a WAGO controller with default credentials was waiting. A steam turbine stopped.
Reality