Search: “maritime”

Coast Guard, FBI board US-bound foreign ships in order to probe for cyberattacks

US Coast Guard and FBI boarded two foreign tankers bound for the US after indications their vessel networks were compromised, investigating possible Iranian involvement.

The Coast Guard and FBI conducted joint offshore security boardings of two commercial ships in the Gulf of Mexico on August 21 and 24 to examine their operational and IT systems following indications both networks were compromised. The vessels reportedly carried oil and natural gas, and one was hacked in the Strait of Gibraltar and lost communications for over 30 hours. No operational disruptions, vessel instability, or environmental impacts have been reported, and authorities are investigating whether Iran or another group exploiting US-Iran tensions was behind the attacks.

CyberScoop·updated 18:46 UTC · 3h ago·first 14:48 UTC · 7h agoData breach in the wild 2 sources

Batten the Hatches: Cybersecurity with Military Mariners

Interviews with 20 U.S. Navy and Coast Guard mariners reveal informal, safety-oriented shipboard cyber risk models that may delay attribution and containment.

The study conducts semi-structured interviews with 20 military mariners from U.S. Navy and Coast Guard vessels to understand how service members recognize and respond to cyber risk aboard ships. Unique consequences of compromising military systems identified include weapon takeover and purposeful geopolitical escalation. Cybersecurity is organizationally abstract on ships, so mariners build cyber risk models from informal experience rather than formal instruction. A safety-oriented incident-response model creates resilience but may delay cyber attribution and containment.

arXiv cs.CR·Sep 11, 13:04 UTC · 5d agoResearch

Understanding Operator Attitudes Toward AI-Supported Decision Making in Maritime Operations

A survey of maritime professionals finds positive but scenario-sensitive attitudes toward AI collision-avoidance assistants, urging design for calibrated reliance.

The study surveyed maritime stakeholders on attitudes toward AI-supported collision-avoidance assistants for Maritime Autonomous Surface Ships, measuring technology anxiety, trust in automation, and explanation quality with established questionnaires plus thematic analysis of open responses. Results show generally positive disposition, no clear age-related openness differences, stable trust across scenarios, and multidimensional, scenario-sensitive explanation ratings. Participants valued decision support and situation awareness but worried about AI reliability, over-reliance, and skill loss; the authors recommend designing for calibrated reliance with domain experts in the loop rather than maximizing automation or trust.

arXiv cs.AI / cs.LG / cs.CL·Sep 10, 16:57 UTC · 6d agoAI research1

Finland appeals court revives case against Eagle S Officers over cable breaks

Finnish appeals court ruled Finland can prosecute Eagle S officers for 2024 Baltic Sea cable breaks, reviving the case and EUR 105M damages claims.

The Helsinki Court of Appeal ruled Finland has jurisdiction to prosecute three senior officers of the Eagle S, the Russia-linked tanker that severed multiple subsea cables on December 25, 2024, overturning a district court dismissal. The court found the crew's conduct after Finnish authorities made contact was not a 'maritime accident' under the UN Convention on the Law of the Sea, noting the ship dragged its anchor roughly 90 kilometers and cut four more cables. Owners of the Estlink 2 power cable, Fingrid and Elering, are seeking about EUR 105 million ($122 million), and the ruling will guide the related Fitburg anchor-dragging case. The decision can be appealed to Finland's Supreme Court until October 26, 2026.

The Record·Aug 27, 15:32 UTC · 20d agoPolicy & legal

Countering misuse of AI: September 2026 / Anthropic

Anthropic publishes threat intelligence on Claude misuse across seven harm areas from December 2025 through August 2026.

Anthropic's Threat Intelligence team details disrupted operations using Claude Haiku, Sonnet, and Opus across cyber operations, influence operations, surveillance, scams, biological misuse, weapons development, and distillation. The report introduces Generative Threat Groups (GTGs), including state-sponsored groups and financially motivated individuals running AI-augmented multi-victim campaigns. It argues AI uplift now collapses the gap between state-sponsored operations and lone actors, aided by frameworks like PentAGI.

Lobsters · security·updated 13:01 UTC · 9h ago·first Sep 11, 09:46 UTC · 5d agoAI safety & security 18 sources1

Billion-dollar boat seller MarineMax reports cyberattack to SEC

The Record·Aug 5, 00:00 UTC · Aug 5, 2026Policy & legal

First Galileo SAS Authenticated Time Solution

Researchers demonstrate the first timing solution computed from Galileo's new Signal Authentication Service, protecting receivers against GNSS spoofing.

Galileo's new Signal Authentication Service (SAS) on the E6-C signal directly authenticates ranging measurements, closing a gap left by OSNMA, which only protects navigation data. Researchers built a snapshot software receiver implementing a simplified SAS protocol and computed an authenticated receiver clock bias from recordings of both SAS-capable satellites, collected with a Septentrio SDR prototype. The results demonstrate feasible authenticated timing ahead of full SAS operational deployment.

arXiv cs.CR·Sep 14, 16:26 UTC · 2d agoResearch

10th August – Threat Intelligence Report

North Carolina Ports suffered a cyberattack forcing Wilmington and Morehead City operations onto manual processes; the authority says it is contained.

Check Point's weekly threat intelligence bulletin reports that North Carolina Ports, the US authority operating the ports of Wilmington and Morehead City among others, suffered a cyberattack. The incident forced some operations onto manual processes. The authority claims it has contained the attack.

Check Point Research·Aug 10, 13:53 UTC · Aug 10, 2026Data breach

Saving Jet Fuel

Tutorial optimizes flight paths to cut jet fuel costs using open-source Scikit-decide planning framework and OpenAP aircraft performance models.

A technical walkthrough demonstrates wind-aware flight path optimization using Scikit-decide, an open-source framework for reinforcement learning and automated planning, paired with OpenAP fuel-consumption models built by Dr. Junzi Sun at TU Delft and NOAA wind data. A Boeing 787-9 flying EWR to FCO can require roughly $68K in fuel, and adjusted routing could save thousands. The post uses Python 3.12, DuckDB with spatial extensions, and QGIS for map rendering.

Hacker News · AI·Sep 15, 23:17 UTC · 23h agoAI tools & infraHN 45↑ · 19 comments

Coast Guard says it is monitoring cyberattack that disrupted North Carolina's ports

CyberScoop·Aug 7, 14:24 UTC · Aug 7, 2026Exploit / PoC in the wild

ST Engineering iDirect iQ-Series Terminals (Update A)

CISA advisory details four flaws in ST Engineering iDirect iQ-Series VSAT terminals <=4.5.2.1, enabling device data theft, CSRF-driven reboots, and local privilege escalation.

CISA's Update A to ICSA-26-183-01 covers ST Engineering iDirect iQ-Series, 3315-Series and 9-Series terminals at firmware <=4.5.2.1, deployed across communications, defense, energy and transportation. CVE-2026-38059 exposes unauthenticated /api/identity and /api/ endpoints leaking serial number, DID, TPK, MAC address and firmware version, potentially enabling terminal impersonation; CVE-2026-38057 is a CSRF flaw letting an attacker force terminal reboots and satellite link loss via /api/reboot. CVE-2026-38056 enables local privilege escalation using the factory-configured technician account (CVSS 3.1 8.8, CVSS 4.0 9.4), and CVE-2026-38058 exposes crackable MD5-crypt root password hashes. All four flaws were reported to CISA by Ahmed Alqahtani of Aramco.

CISA Advisories·Sep 10, 12:00 UTC · 6d agoAdvisoryCVE-2026-38059CVE-2026-38057CVE-2026-38056+1 CVEs

CEVA Logistics Cyberattack Disrupts European Warehouses and Shipments

Cyberattack on CEVA Logistics disrupted eight European warehouses and exposed customer data of clients including Valve, Ajax, and De Bijenkorf.

CEVA Logistics, part of CMA CGM Group, suffered a July 29 cyberattack that disrupted eight European warehouses and halted shipments of stored goods. Customer data linked to Valve, Ajax, and Dutch retailer De Bijenkorf was exposed, potentially including names, contact details, and online order information; Valve said payment details and passwords were not accessed. No ransomware group has claimed responsibility and the company has not disclosed technical details. A database containing customer lists, shipping records, and banking details was reportedly later offered for sale on a dark web marketplace.

Security Affairs·Aug 12, 20:05 UTC · Aug 12, 2026Data breach in the wild

Trezor Supply Chain Breach Now Impacts 81,000 Customers

Trezor says a breach at shipping partner ShipMonk exposed data of 81,000 customers, 67,000 more than first reported, including orders back to 2019.

Trezor's September 4 update revealed that stolen ShipMonk data also included order data from November 2019 to August 2021, expanding the incident beyond the May 10 to August 8, 2026 window disclosed on August 13, and raising affected customers to 81,000, a 479% increase over the original estimate. Exposed fields include names, emails, phone numbers, shipping addresses, and order numbers; no wallet credentials or recovery seed data were reported stolen. Trezor blamed ShipMonk for retaining data despite repeated written deletion assurances, is considering legal action, and warned customers of heightened phishing, scam calls, and physical security risks.

Infosecurity Magazine·Sep 8, 09:08 UTC · 8d agoData breach1

Persistent Attempts at Cyberespionage Against Southeast Asian Government Target Have Links to Alloy Taurus

Alloy Taurus (GALLIUM) compromised Southeast Asian government networks from 2022 to 2023 using Exchange web shells and undocumented .NET backdoors Reshell and Zapoa.

Unit 42 tracked persistent multiwave intrusions at a Southeast Asian government starting in early 2022 and continuing through 2023, attributing the activity with moderate confidence to Alloy Taurus (aka GALLIUM), a Chinese state-aligned espionage group. Attackers exploited Exchange Server vulnerabilities to deploy web shells including China Chopper, then ran reconnaissance with Fscan and WebScan, created administrative accounts, and installed undocumented .NET backdoors named Reshell and Zapoa. They established resilience by installing SoftEther VPN, brute-forced Active Directory credentials with Kerbrute, and dumped credential stores with GoDumpLsass and LsassUnhooker. The campaign reflects long-term espionage tradecraft to maintain a foothold.

Palo Alto Unit 42·Aug 17, 10:54 UTC · Aug 17, 2026Threat actor in the wild1

The EU CRA's Real Question: What Shipped, and When Did You Know?

ActiveState argues the EU CRA's 24-hour ENISA exploit-notification duty, effective September 11, 2026, makes current SBOMs and provenance visibility a legal necessity.

An ActiveState essay warns that the EU Cyber Resilience Act's reporting obligations take effect on September 11, 2026, requiring manufacturers of products with digital elements sold into the EU to notify ENISA within 24 hours of learning a vulnerability is actively exploited, with a fuller report within 72 hours. The law's engineering requirements only apply from December 11, 2027, leaving a visibility-first runway, and Article 13 requires the SBOM to stay current unlike one-time artifacts generated under US Executive Order 14028. The author contrasts the 24-hour notification clock with an industry-average 55 days to remediate high or critical vulnerabilities and recommends automated SBOM regeneration or consuming pre-vetted, attested open source components.

BleepingComputer·Sep 8, 20:24 UTC · 8d agoPolicy & legal

12 Best Container Security Tools Compared (2026): Features & Pricing

GBHackers compares pricing and features of 12 container security platforms, from free Trivy, Falco, and SUSE NeuVector to commercial Sysdig, Wiz, and Aqua.

A procurement-focused comparison of twelve container security vendors including Sysdig, Wiz, Aqua Security, SUSE NeuVector, and CrowdStrike, centered on billable units (per node, workload, developer, or vCore) and pricing mechanics. The piece argues free open-source tools like Trivy, Falco, and NeuVector set a floor that commercial products must justify exceeding through enforcement and scale. It also notes rising container threats, including Kubernetes flaws exploited to jump from containers to cloud accounts and exposed container registries.

GBHackers·09:46 UTC · 12h agoIndustry 14 sources

Top 10 Best Container Security Tools in 2026

2026 roundup ranks Aqua, Sysdig, Prisma Cloud, Wiz, Snyk and CrowdStrike among the ten best container security tools across build-ship-run.

Buyer's guide compares ten container security products by lifecycle fit: Aqua leads full lifecycle, Sysdig leads runtime detection via Falco and eBPF, Wiz offers agentless graph visibility, Snyk covers developer-first shift-left. It notes Trivy and Falco as free production-grade open-source foundations. The guide argues standalone container security is increasingly absorbed into CNAPP platforms from Palo Alto, Wiz and CrowdStrike.

Cyber Security News·Sep 15, 06:36 UTC · 1d agoTools1

Identifying a BOLA Vulnerability in Harbor, a Cloud

Unit 42 found a BOLA flaw, CVE-2024-22278 (CVSS 6.4), letting Maintainers improperly alter Harbor project metadata; fixed in versions 2.9.5, 2.10.3, and 2.11.0.

Unit 42 researchers identified a broken object-level authorization flaw, CVE-2024-22278, in Harbor, a CNCF-graduated cloud-native container registry with 1.8 million downloads. The flaw (CVSS 6.4) lets users with the Maintainer role create, update, and delete project metadata, actions reserved for ProjectAdmin, risking data exposure, integrity compromise, and circumvention of vulnerability scanning. Harbor patched the issue in versions 2.9.5, 2.10.3, and 2.11.0. The finding came from Unit 42's automated BOLA detection tool built on generative AI.

Palo Alto Unit 42·Aug 17, 12:35 UTC · Aug 17, 2026VulnerabilityCVE-2024-22278

Water sector example added to the NCSC’s Secure connectivity principles

NCSC UK adds a water sector example to its Secure Connectivity Principles, the first ICS community-authored content on its site.

The UK NCSC has added a water sector example to its Secure Connectivity Principles guidance. It is the first content authored by the Industrial Control System Community of Interest to appear on ncsc.gov.uk. The guidance helps ICS operators apply secure connectivity practices.

NCSC UK·Aug 11, 12:00 UTC · Aug 11, 2026Advisory

The Smishing Deluge: China-Based Campaign Flooding Global Text Messages

Unit 42 attributes a global smishing campaign with 194,000+ phishing domains impersonating tolls, banks, and couriers to the Smishing Triad.

Palo Alto Unit 42 attributes ongoing smishing texts about toll violations and package misdelivery to the Smishing Triad, targeting U.S. residents since April 2024. Researchers identified 194,345 FQDNs across 136,933 root domains registered since January 2024, mostly via Hong Kong registrar Dominet (HK) Limited with Chinese nameservers and hosting concentrated on U.S. cloud services. The decentralized campaign impersonates banking, cryptocurrency, e-commerce, healthcare, law enforcement, and social media services, and its scale points to a large phishing-as-a-service operation. Phishing pages harvest national ID numbers such as Social Security numbers, home addresses, payment details, and login credentials.

Palo Alto Unit 42·Aug 17, 12:45 UTC · Aug 17, 2026Phishing & fraud in the wild1

Medical device maker Boston Scientific says a cyberattack is causing a ‘global disruption’ to its operations

Boston Scientific says a cyberattack has caused global disruption to its operations, with no confirmation yet on device impact or data exfiltration.

Boston Scientific, a major medical device manufacturer, disclosed that a cyberattack is causing global disruption to its operations. The company has not confirmed whether medical devices are affected or whether any customer data was exfiltrated. The investigation appears to be ongoing, and healthcare-sector exposure raises patient-safety and supply-chain concerns.

TechCrunch · Security·Aug 26, 18:23 UTC · 21d agoData breach

[Control Systems] Siemens security advisory (AV26-890)

Canada's Cyber Centre relayed a Siemens advisory affecting Reyrolle 7SR5, Teamcenter, Siveillance Control, Desigo CC and other products.

Advisory AV26-890, dated September 8, 2026, flags Siemens vulnerabilities in Reyrolle 7SR5 (versions prior to V2.70), Teamcenter, Siveillance Control, SIMATIC AX Runtime, Desigo CC, Industrial Edge Management, and SIMOVE Fleetmanager and SIPLANT across multiple versions and models. The Cyber Centre encourages users and administrators to review the Siemens advisory and apply available updates. No specific CVEs or exploitation details are provided in the relayed advisory.

Canadian Centre for Cyber Security·Sep 8, 17:27 UTC · 8d agoAdvisory

Trump Targets Foreign Technology in New U.S. Power Grid Security Order

Trump's Executive Order 14420 declares a national emergency to restrict foreign-made bulk-power grid equipment over cyber, sabotage and supply-chain risks.

Executive Order 14420, signed August 26, declares a national emergency regarding the foreign supply of bulk-power system electric equipment to the United States. It empowers the Energy Secretary to restrict transactions with designated Covered Foreign Entities involving equipment, software, firmware, digital services, maintenance services, and remote-access capabilities. Covered equipment includes transformers, generators, inverters, RTUs, PLCs, intelligent electronic devices, and protective relays, with transmission rated 69 kV or higher in scope while local distribution is excluded. Already-installed foreign equipment may be subject to identification, isolation, monitoring, or replacement requirements, with phased compliance and pre-qualified vendor exemptions permitted.

Security Affairs·Aug 28, 18:00 UTC · 19d agoPolicy & legal

From Hypervisor to Container: Cloud Security Vulnerabilities, Defense Mechanisms, and Open Challenges

Survey of 120+ cloud security papers (2008-2025) reviews hypervisor and container isolation attacks, scoring defenses with the ADPO framework and CIA impact scale.

This survey reviews over 120 security publications from 2008 to 2025 on breaches of cloud isolation boundaries via virtual machines and containers. Threats examined include VM escape, VM hopping, CPU cache side-channels, container breakouts, vulnerable container images, and DDoS attacks. The authors introduce ADPO, a 0-3 scoring framework rating defenses on accuracy, deployment ease, performance impact, and operational overhead, plus a 1-5 CIA severity mapping for attack impact.

arXiv cs.CR·Sep 15, 05:57 UTC · 1d agoResearch

Logistics Giant Ceva Suffers Data Breach Impacting European Clients

Ceva Logistics suffers a supply chain attack and data breach with a large blast radius impacting European clients.

Ceva Logistics, a major global logistics provider, suffered a data breach impacting its European clients. The incident appears to be a supply chain attack with a large potential blast radius affecting downstream customers. Details on compromised data volumes and the initial intrusion vector remain limited.

Infosecurity Magazine·Aug 11, 10:45 UTC · Aug 11, 2026Data breach

Cyberattack causes network outage at Boston Scientific, disrupts global operations

Boston Scientific disclosed a cyberattack that caused a network outage, disrupting global operations including order processing and shipping.

The medical device maker detected the incident on August 25, activated incident response protocols with third-party cybersecurity experts, and told the SEC that access to systems supporting operations, including order processing and shipping, was disrupted. Boston Scientific employs about 59,000 people across 127 countries and posted more than $20 billion in net sales in 2025; it has not determined whether the incident is material and no group has claimed responsibility. The company joins a recent run of medtech attacks including Stryker, iRhythm, Novo Nordisk and Xsolis.

Help Net Security·Aug 27, 00:00 UTC · 20d agoData breach

An Empirical Security Analysis of Open-Source Software Used in Onboard Satellite Systems

Study of 126 onboard satellite OSS repositories finds 2,827 security findings, 72% medium severity or higher, dominated by memory safety and code quality weaknesses.

Researchers performed an empirical security analysis of 126 public repositories of open-source software used in onboard satellite systems using SBOM generation, software composition analysis, static application security testing, infrastructure-as-code analysis, and secret scanning. After cleaning and deduplication the pipeline produced 2,827 findings, with medium-severity findings accounting for 49% and 72% classified medium or higher. A CWE-based taxonomy mapped all findings to eight weakness families, with Memory Safety and Code Quality dominating, followed by Input Validation and Injection. Project-developed code accounted for 81.4% of findings, though external dependency code remained relevant; findings do not establish mission-specific exploitability.

arXiv cs.CR·Sep 14, 11:54 UTC · 2d agoResearch1

Cyberattack on Steam hardware shipper leaks names, addresses, and order data

Help Net Security·Aug 10, 00:00 UTC · Aug 10, 2026Data breach

Scans Targeting Hospitality Applications, (Wed, Sep 16th)

Scans from a bulletproof-hosting IP target the abandoned PIAF-HMS hospitality application, which contains numerous unpatched SQL injection flaws.

SANS ISC observed requests for /PIAF-HMS/ using the unusual user-agent Farez-Sorter/1.0, along with paths like /admin/, /ucp/, /hms/, and /hotel/, starting September 15 from the single source IP 94.102.49.125 (IP Volume, AS202425, a bulletproof hoster). PIAF-HMS, a PBX in a Flash Hospitality Management System, was last updated 10 years ago and a SQL injection vulnerability was reported recently; the code shows many injection flaws and lacks authentication and access control. The handler notes hotels are soft targets for personal data theft and guest MitM attacks, and asks for community insight on the campaign.

SANS Internet Storm Center·18:44 UTC · 3h agoExploit / PoC

Cyberattack on North Carolina Ports ‘contained’ as Coast Guard, state officials investigate

The Record·Aug 6, 17:16 UTC · Aug 6, 2026Ransomware

Scans for Proxmox Servers, (Wed, Sep 9th)

SANS observed increased scanning and brute-force attacks on port 8006 targeting unsupported Proxmox VE 7 servers after a recent vulnerability advisory.

SANS Internet Storm Center reported a bump in scans for port 8006 and additional brute-force traffic against Proxmox VE servers following a Proxmox advisory about a vulnerability in older releases. The flaw only affects Proxmox VE version 7, which has been unsupported for a couple of years. Observed activity includes POST requests to /api2/json/access/ticket with root@pam usernames and weak passwords, fingerprinting requests, and POSTs to /api2/extjs/access/ticket; failed logins return 401 status codes and non-TLS POSTs return 308 redirects.

SANS Internet Storm Center·Sep 9, 17:46 UTC · 7d agoExploit / PoC