⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
US agencies warn of AI-assisted attacks on exposed Siemens PLCs; the week also saw GitLab CVE-2026-19478 exploited and trojanized npm packages found.
The weekly recap leads with a US government warning that threat actors use AI-generated scripts and Censys/ZoomEye scanning to attack internet-exposed Siemens S7 PLCs in water, energy and manufacturing, calling it an active threat. Other stories include active exploitation of GitLab CVE-2026-19478 (CVSS 9.4, unauthenticated project rewriting), 14 trojanized npm packages delivering the RedC2 4.0 Linux backdoor, and the Zombie Card attack that revives expired Visa cards for contactless payment fraud. It also covers suspected Russian clusters UNC6293, UNC7005 and UNC5976 phishing campaigns, a faster Cloudflare Workers Spectre JWT leak, and a bespoke Cl0p JSP web shell deployed after exploiting PTC Windchill flaws.
- US agencies call AI-driven attacks on exposed Siemens S7 PLCs an active, not theoretical, threat.
- GitLab CVE-2026-19478 (CVSS 9.4) lets unauthenticated attackers rewrite public projects; exploited within days.
- 14 trojanized npm packages deliver the AI-powered RedC2 4.0 Linux backdoor.
- Zombie Card attack modifies the CDCVM flag to revive expired Visa cards for contactless payments.
- Cl0p used a custom JSP web shell to map vault data and decrypt Windchill credentials.
- CVEs
- CVE-2026-19478
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1505.003 Web ShellT1595.002 Vulnerability ScanningT1036.005 Match Legitimate Name or Location
- Vendors
- SiemensGitLabCloudflareVisa
- Malware
- RedC2
- Organizations
- CensysZoomEyewatchTowrReliaQuestLumen
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19478 | Unauthenticated GraphQL Code Injection in GitLab CE/EE Enables Data Tampering | 9.1 | 6% |
From the original article
11 min read at thehackernews.com
A package gets installed. A login prompt opens. A box sits exposed to the internet.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.