Vulnerabilities and intrusions affecting industrial control systems, SCADA, PLCs, and the operational-technology stack — plus the wider "physical-layer" surface of firmware in embedded devices and covert channels against air-gapped machines. Where a bug can mean a plant trip, not just a data breach. Combined article + CVE feed for the ICS / OT beat.https://0daynews.com/en-ushttps://0daynews.com/articles/2026-08-18-mlflow-fuxa-cve-exploitation-cloud-scada/https://0daynews.com/articles/2026-08-18-mlflow-fuxa-cve-exploitation-cloud-scada/Attackers are exploiting an SSRF in MLflow's AI platform and scanning FUXA SCADA installs—critical flaws in both enabling cloud credential theft and full RCE.Tue, 18 Aug 2026 20:00:00 GMTICS / OTarticlehttps://0daynews.com/articles/2026-08-15-cisa-icsa-26-225-01-ics-deserialization-cve-2025-7639/https://0daynews.com/articles/2026-08-15-cisa-icsa-26-225-01-ics-deserialization-cve-2025-7639/CISA advisory ICSA-26-225-01 covers CVE-2025-7639, a deserialization flaw that lets authenticated ICS operators execute code at elevated privilege.Sat, 15 Aug 2026 12:00:00 GMTICS / OTarticlehttps://0daynews.com/articles/2026-08-13-ics-patch-tuesday-siemens-schneider-phoenix-contact/https://0daynews.com/articles/2026-08-13-ics-patch-tuesday-siemens-schneider-phoenix-contact/Siemens, Schneider Electric, and Phoenix Contact issued security bulletins on August 12. CISA published parallel ICS advisories the same day. OT operators should review now.Thu, 13 Aug 2026 06:00:00 GMTICS / OTarticlehttps://0daynews.com/articles/2026-08-11-malicious-sim-code-exec-cellular-iot-modules/https://0daynews.com/articles/2026-08-11-malicious-sim-code-exec-cellular-iot-modules/SIM Toolkit commands give rogue SIMs code execution on cellular modules in EV chargers, industrial routers, and car telematics units, University of Birmingham and Fuzzware researchers confirm.Tue, 11 Aug 2026 16:30:00 GMTICS / OTarticlehttps://0daynews.com/articles/2026-08-11-poland-heat-plant-private-apn-ot-breach/https://0daynews.com/articles/2026-08-11-poland-heat-plant-private-apn-ot-breach/Attackers breached a Polish heat plant via private cellular APN, shutting down a steam turbine. The OT intrusion went undisclosed for months.Tue, 11 Aug 2026 06:00:00 GMTICS / OTarticlehttps://0daynews.com/articles/2026-08-10-iran-water-plc-attacks-multistate/https://0daynews.com/articles/2026-08-10-iran-water-plc-attacks-multistate/Internet-exposed PLCs at water utilities across 12+ U.S. states are under active attack, with Iran-linked actors suspected. Default credentials and unencrypted protocols remain the core exposure.Mon, 10 Aug 2026 23:45:00 GMTICS / OTarticlehttps://0daynews.com/articles/2026-08-02-ntu-84-flaws-4g-5g-core-networks/https://0daynews.com/articles/2026-08-02-ntu-84-flaws-4g-5g-core-networks/Researchers at NTU Singapore found 84 flaws in open-source 4G/5G core software, enabling DoS and session hijacking via GTP-C and PFCP protocol weaknesses.Sun, 02 Aug 2026 04:00:00 GMTICS / OTarticlehttps://0daynews.com/articles/2026-07-31-cisa-water-utilities-plc-attacks/https://0daynews.com/articles/2026-07-31-cisa-water-utilities-plc-attacks/CISA flags a surge in attacks targeting internet-exposed PLCs in U.S. water and wastewater systems. Patch, segment, and remove direct internet exposure.Fri, 31 Jul 2026 18:00:00 GMTICS / OTarticlehttps://0daynews.com/articles/2026-07-29-minnesota-water-ot-attack/https://0daynews.com/articles/2026-07-29-minnesota-water-ot-attack/30 Minnesota water systems hit in a coordinated OT cyberattack July 26-27, knocking Braham's plant offline and triggering statewide incident response.Wed, 29 Jul 2026 16:10:00 GMTICS / OTarticlehttps://0daynews.com/articles/2026-07-29-ot-isolation-field-reality-explainer/https://0daynews.com/articles/2026-07-29-ot-isolation-field-reality-explainer/CISA and ASD's joint OT isolation guidance is correct in what it recommends. What it leaves to inference is the physical-layer reality that makes the recommendation hard to execute.Wed, 29 Jul 2026 06:00:00 GMTICS / OTarticlehttps://0daynews.com/articles/2026-07-28-cisa-asd-ot-isolation-guidance/https://0daynews.com/articles/2026-07-28-cisa-asd-ot-isolation-guidance/CISA and Australia's ASD jointly urge critical infrastructure operators to pre-plan and rehearse OT isolation before a cyberattack forces the decision mid-incident.Tue, 28 Jul 2026 20:00:00 GMTICS / OTarticlehttps://0daynews.com/articles/2026-07-20-aivd-mivd-russian-intel-ip-cameras-nato-military-transport-ukraine/https://0daynews.com/articles/2026-07-20-aivd-mivd-russian-intel-ip-cameras-nato-military-transport-ukraine/AIVD and MIVD say Russian intel is hijacking exposed IP cameras across EU, NATO states, and Ukraine to watch military convoys and weapons shipments to Kyiv.Mon, 20 Jul 2026 14:15:00 GMTICS / OTarticlehttps://0daynews.com/articles/2026-07-15-knx-cve-2023-4346-cisa-kev-account-lockout-bod-26-04/https://0daynews.com/articles/2026-07-15-knx-cve-2023-4346-cisa-kev-account-lockout-bod-26-04/CVE-2023-4346 turns the KNX Association's account-lockout mechanism into a device-purge weapon on a building-automation bus. CISA added it to KEV under BOD 26-04.Wed, 15 Jul 2026 20:15:00 GMTICS / OTarticlehttps://0daynews.com/articles/2026-07-13-fsb-centre-16-cve-2018-0171-router-hygiene-csa/https://0daynews.com/articles/2026-07-13-fsb-centre-16-cve-2018-0171-router-hygiene-csa/US, UK, and eleven allied governments co-signed a July 13 advisory naming FSB Centre 16 as the actor still pulling configs off end-of-life Cisco routers via CVE-2018-0171.Mon, 13 Jul 2026 11:20:00 GMTICS / OTarticlehttps://0daynews.com/articles/2026-07-11-u-boot-libfdt-fit-parsing-six-brly-flaws/https://0daynews.com/articles/2026-07-11-u-boot-libfdt-fit-parsing-six-brly-flaws/Binarly disclosed six bugs in U-Boot's FIT-image parsing on July 9 — two potential RCE, four DoS — all tracing to unchecked libfdt calls present since 2013.07.Sat, 11 Jul 2026 11:15:00 GMTICS / OTarticlehttps://0daynews.com/articles/2026-07-09-talos-vdr-wolfssl-geovision-vtk-dicom-disclosure/https://0daynews.com/articles/2026-07-09-talos-vdr-wolfssl-geovision-vtk-dicom-disclosure/Cisco Talos published a bulk third-party disclosure covering 3 WolfSSL, 14 GeoVision, and 1 VTK-DICOM vulnerabilities — all patched before publication.Thu, 09 Jul 2026 22:35:00 GMTICS / OTarticlehttps://0daynews.com/articles/2026-07-07-tenda-router-backdoor-cve-2026-11405-unpatched/https://0daynews.com/articles/2026-07-07-tenda-router-backdoor-cve-2026-11405-unpatched/CERT/CC flagged an authentication backdoor in multiple Tenda router firmware builds. Tenda didn't respond. No fix is coming — here's the mitigation.Wed, 08 Jul 2026 01:15:00 GMTICS / OTarticlehttps://0daynews.com/articles/2026-07-06-trojpix-air-gap-video-cable-emanation-shandong/https://0daynews.com/articles/2026-07-06-trojpix-air-gap-video-cable-emanation-shandong/Shandong University researchers show a covert-channel technique that turns invisible pixel changes into a radio signal a nearby receiver can decode from the display cable itself.Mon, 06 Jul 2026 15:00:00 GMTICS / OTarticlehttps://0daynews.com/articles/2026-07-04-armored-likho-busysnake-power-sector-kaspersky/https://0daynews.com/articles/2026-07-04-armored-likho-busysnake-power-sector-kaspersky/Kaspersky attributes a previously undocumented threat actor, Armored Likho, to a campaign hitting government agencies and the electric power sector across Russia, Brazil, and Kazakhstan using the BusySnake stealer.Sat, 04 Jul 2026 05:15:00 GMTICS / OTarticle