https://cybersecuritytracker.ai/?cats=ot-icsCurated cybersecurity news and vulnerability intelligence.Sun, 26 Jul 2026 22:32:50 GMThttps://helpnetsecurity.com/2026/07/24/car-research-automotive-software-vulnerabilitiescst-3146Modern vehicles contain substantial embedded software running operating systems like Android, Linux, QNX, and VxWorks across dashboard displays and safety-critical systems. Carmakers have transitioned to software-dependent architectures over the past decade, introducing potential vulnerability exposures in these systems. The article examines security risks inherent in automotive software stacks.Fri, 24 Jul 2026 06:30:41 GMThttps://techcrunch.com/2026/07/23/us-government-says-iran-linked-hackers-are-disrupting-american-water-and-energy-providerscst-3129The US government issued an updated advisory warning that Iranian-linked hackers are exploiting systems used by water and energy infrastructure providers. The advisory indicates ongoing targeting of critical infrastructure sectors essential to public services.Thu, 23 Jul 2026 17:27:08 GMThttps://databreaches.net/2026/07/23/iranian-affiliated-cyber-actors-exploit-programmable-logic-controllers-across-us-critical-infrastructure-2?pk_campaign=feed&pk_kwd=iranian-affiliated-cyber-actors-exploit-programmable-logic-controllers-across-us-critical-infrastructure-2cst-3126Iranian-affiliated cyber actors are actively targeting internet-connected operational technology devices, particularly programmable logic controllers, across multiple U.S. critical infrastructure sectors, causing disruptions. U.S. government agencies issued an urgent advisory warning organizations of the ongoing threat. The campaign highlights persistent efforts by nation-state actors to compromise industrial control systems.Thu, 23 Jul 2026 12:45:42 GMThttps://securityweek.com/us-warns-of-iranian-hackers-targeting-siemens-schneider-and-rockwell-ics-devicescst-3060Federal agencies released an advisory detailing attack techniques used by Iranian hackers to compromise programmable logic controllers from Siemens, Schneider Electric, and Rockwell Automation. The advisory documents methods for targeting these critical industrial control system (ICS) devices.Thu, 23 Jul 2026 05:28:50 GMThttps://therecord.media/federal-agencies-broaden-alert-on-iran-linked-ot-attackscst-3035Federal agencies issued an alert regarding attacks attributed to Iran targeting operational technology (OT) environments. The incidents involved malicious manipulation of industrial control systems, including human machine interface and supervisory control and data acquisition displays.Wed, 22 Jul 2026 19:18:00 GMThttps://helpnetsecurity.com/2026/07/21/benjamin-bachmann-bilfinger-ot-securitycst-2878Benjamin Bachmann, Bilfinger's Director of Group Information Security, discusses operational technology (OT) security misconceptions in an interview with Help Net Security. He addresses the limitations of air gap protection, the importance of visibility into legacy equipment through network monitoring, and how ransomware operators price demands based on operational downtime. The discussion covers incident containment negotiation and threat actor motivations in industrial environments.Tue, 21 Jul 2026 06:00:29 GMThttps://therecord.media/india-nuclear-plant-kudankulam-world-leaks-documentscst-2859Indian officials stated that documents allegedly leaked by the World Leaks cybercrime group from the Kudankulam Nuclear Power Plant do not contain safety or security information. The incident highlights claims by the threat actor but officials have assessed the leaked materials as non-sensitive.Mon, 20 Jul 2026 18:20:00 GMThttps://isc.sans.edu/diary/rss/33164cst-2803Internet-wide scans targeting Hikvision cameras have shifted to probing the OPEN Intelligent Security API (ISAPI), a REST-based interface that provides broad control over camera settings and features. The scans specifically target the /ISAPI/System/status endpoint to detect ISAPI-capable devices and potentially support credential brute-forcing. While ISAPI supports both Basic and Digest authentication with optional AES encryption, the encryption key derivation from passwords and exposed initialization vector undermine security if Basic authentication is used over unencrypted connections.Sun, 19 Jul 2026 15:00:38 GMThttps://unit42.paloaltonetworks.com/siemens-rox-ii-zero-day-vulnerabilitiescst-2749Three chained zero-day vulnerabilities were discovered in Siemens ROX II operational technology switches that enable privilege escalation and persistent root access when exploited together. The vulnerabilities form a complete attack chain affecting industrial control systems that rely on these network switches. Unit 42 published a technical analysis detailing the flaw sequence.Fri, 17 Jul 2026 10:00:24 GMThttps://securityweek.com/legacy-systems-real-world-impacts-the-reality-of-ot-securitycst-2696An article examining the challenges of balancing vulnerability disclosure in operational technology environments where legacy systems, safety concerns, and critical infrastructure risks complicate security practices. The piece addresses the tensions inherent in securing aging systems that cannot always be quickly patched or updated.Thu, 16 Jul 2026 15:15:00 GMThttps://wired.com/story/what-happens-if-china-hacks-the-us-water-supply-war-game-volt-typhooncst-2147Insurers conducted a classified tabletop exercise simulating a large-scale cyberattack on US water infrastructure by the Volt Typhoon threat group, modeling cascading failures such as ruptured pipes and hospital evacuations. The exercise revealed significant gaps in preparedness and response coordination for such a critical infrastructure breach.Wed, 08 Jul 2026 10:00:00 GMThttps://helpnetsecurity.com/2026/07/08/miranda-ritchie-orbia-industrial-cybersecuritycst-2130Miranda Ritchie, CISO at Orbia, discusses integrating security into industrial systems that manage water, chemical, and manufacturing processes. She addresses the unique risks of operational technology (OT) environments, including geographically dispersed sites and legacy hardware, and advocates for embedding security teams early in project development and adopting zero-trust principles aligned with safety culture.Wed, 08 Jul 2026 06:00:52 GMThttps://ncsc.gov.uk/blogs/building-more-resilient-cni-what-industry-pen-testers-told-uscst-284Penetration testers shared recommendations on hardening critical national infrastructure (CNI) defenses based on their field experience. The guidance focuses on practical steps organizations can implement to increase resistance to security testing and real-world attacks.Wed, 01 Jul 2026 12:00:00 GMThttps://cisa.gov/news-events/ics-advisories/icsa-26-181-02cst-268Frangoteam FUXA SCADA/HMI versions 1.3.1 and earlier contain an authentication bypass vulnerability (CVE-2026-13207) that allows unauthenticated attackers to enumerate user accounts and role assignments through dot-segment path normalization in the REST API. The vulnerability exploits improper path normalization before authentication middleware is applied, allowing attackers to access protected endpoints by using sequences like /api/./users or /api/project/../users. Frangoteam recommends upgrading to version 1.3.2 or later to remediate the issue.Tue, 30 Jun 2026 12:00:00 GMThttps://sentinelone.com/labs/labscon25-replay-please-connect-to-the-foreign-entity-to-enhance-your-user-experiencecst-607Joe FitzPatrick presents research on undocumented connectivity features in imported networked devices, particularly highlighting cellular radios discovered in U.S. highway solar inverters and the widespread reliance on foreign-manufactured hardware by small businesses and infrastructure operators. He argues that current safeguards like import bans and FCC regulations are ineffective at managing supply chain risks and recommends alternatives including right-to-repair policies with offline use guarantees, hardware bills of materials, and comprehensive privacy legislation. The talk examines how devices default to connecting to foreign entities and the practical challenges of using such hardware without establishing external connections.Wed, 06 May 2026 13:00:29 GMThttps://recordedfuture.com/research/hacking-embodied-aicst-1965Humanoid and quadruped robots are increasingly deployed in manufacturing, critical infrastructure, and military operations, but security has lagged behind rapid adoption. Researchers demonstrated that commercially available robots can be compromised via Bluetooth, exfiltrate data to remote servers, and spread compromises across robot fleets wirelessly. Organizations deploying embodied AI must treat robots as cyber-physical endpoints with comprehensive security controls, network isolation, and fleet continuity plans.Tue, 05 May 2026 00:00:00 GMThttps://wiz.io/blog/securing-critical-infrastructure-in-cloud-eracst-1399This article discusses strategies for securing critical infrastructure in cloud environments, addressing the intersection of policy frameworks and technological implementations needed in modern deployments. The piece presents a blueprint for organizations managing critical systems as they transition toward cloud-based architectures.Thu, 30 Oct 2025 12:00:00 GMThttps://huntress.com/blog/first-do-no-harm-when-and-where-siem-fits-in-healthcare-it-settingscst-906This article discusses the role of Security Information and Event Management (SIEM) systems within healthcare IT environments, examining when SIEM tools are valuable, where they have limitations, and how they fit into a broader security infrastructure. The piece provides guidance on integrating SIEM into healthcare security architectures to optimize detection and response capabilities.Wed, 18 Dec 2024 00:00:00 GMThttps://greynoise.io/blog/new-report-reveals-hidden-risks-how-internet-exposed-systems-threaten-critical-infrastructurecst-1927A Censys report identified approximately 145,000 internet-exposed industrial control systems (ICS) and thousands of insecure human-machine interfaces (HMI), creating readily exploitable entry points for attackers. Real-world incidents demonstrate active threats, including state-backed actors from Iran and Russia targeting HMI systems to compromise water infrastructure in Pennsylvania and Texas. GreyNoise research confirms attackers are actively scanning for HMI vulnerabilities and prioritizing remote access services as lower-friction attack vectors compared to direct ICS protocol exploitation.Thu, 21 Nov 2024 00:00:00 GMThttps://huntress.com/blog/nerc-cip-014-standard-explainedcst-933Huntress provides an explanation of NERC CIP-014, a North American Electric Reliability Corporation (NERC) standard designed to enhance physical security at electric utility facilities. The standard was established to address vulnerabilities in the power grid infrastructure and outlines specific security requirements for utility operators.Mon, 07 Oct 2024 18:41:00 GMThttps://greynoise.io/blog/challenging-assumptions-enhancing-the-understanding-of-securing-internet-exposed-industrial-control-systemscst-1934Censys and GreyNoise released research at LABSCon 2024 examining real-world threats to internet-exposed Industrial Control Systems (ICS). The findings show that attackers prioritize common Remote Access Service (RAS) protocols over ICS-specific communications when targeting internet-connected human-machine interfaces (HMIs), challenging previous assumptions about how critical infrastructure is compromised.Fri, 20 Sep 2024 00:00:00 GMThttps://huntress.com/blog/the-undeniable-benefits-of-healthcare-security-awareness-trainingcst-983Huntress discusses the benefits of implementing security awareness training programs within healthcare organizations. The article emphasizes how security awareness can help build a culture of security and protect against threats in the healthcare sector.Tue, 30 Apr 2024 06:00:00 GMThttps://huntress.com/blog/interconnected-devices-inject-risk-into-patient-safetycst-987Healthcare providers face security risks from interconnected medical devices that could compromise patient safety and data protection. The article discusses how managed Endpoint Detection and Response (EDR) solutions and expert partnerships can help healthcare organizations address these device security challenges and maintain continuity of care.Mon, 08 Apr 2024 00:00:00 GMThttps://huntress.com/blog/the-health-sector-is-under-attack-but-you-can-fight-back-cst-1003Healthcare organizations face escalating cyber threats, and the U.S. Department of Health and Human Services is introducing new cybersecurity measures while small and mid-sized healthcare providers are encouraged to strengthen their defenses. The article emphasizes proactive security postures as a critical response to the current threat landscape.Thu, 15 Feb 2024 00:00:00 GMThttps://huntress.com/blog/securing-healthcare-handling-cyber-threats-with-carecst-1007This article discusses the cybersecurity threat landscape in healthcare and outlines defensive strategies to protect patient data and systems. The piece emphasizes the importance of addressing cyber threats within the healthcare sector's operational context.Fri, 12 Jan 2024 00:00:00 GMT