30
CategoryAll
Smart search ranks by meaning as well as keywords (one row per story, last 45 days).
How an Emerging Industrial Protocol Family Could Put OT at Risk
New research shows unprotected Time-Sensitive Networking industrial protocols could let attackers disrupt or manipulate physical processes in OT environments.
Research covered by Dark Reading examines an emerging family of industrial protocols based on Time-Sensitive Networking (TSN) and finds that unprotected implementations could be attacked to disrupt or manipulate physical processes. The findings highlight growing OT risk as these protocols proliferate in industrial deployments; no confirmed exploitation is reported.
38
Russian-Linked Hackers Accessed Polish Power Plant OT Network Through Private APN, Says CERT.PL
CERT.PL disclosed that Russian-linked hackers accessed a Polish combined heat and power plant's OT network through a private APN in 2025.
Poland's CERT (CERT.PL) released details of a 2025 attack on a Polish combined heat and power plant. Russian-linked hackers accessed the plant's OT network through a private APN. The disclosure adds to a series of intrusions against Polish critical infrastructure attributed to Russian-linked actors.
58
60
Mitsubishi Electric Multiple FA Products (Update D)
CISA warns Mitsubishi Electric CC-Link IE TSN remote I/O modules are vulnerable to denial-of-service via crafted UDP packets (CVE-2025-3511).
CISA published Update D of advisory ICSA-25-128-03 covering Mitsubishi Electric factory automation products. Affected products include CC-Link IE TSN Remote I/O modules NZ2GN2S1-32D, NZ2GN2S1-32T, NZ2GN2S1-32TE, and NZ2GN2S1-32DT at firmware version 09 or earlier (CVE-2025-3511). A remote attacker can send a specially crafted UDP packet to cause denial-of-service conditions, timeout errors, or communication delays on the affected products.
20
Researchers open-source a Wi-Fi cyber range for security training
NTNU and Aegean researchers open-source a software-emulated Wi-Fi cyber range using mac80211_hwsim with LLM-assisted scenario building.
Researchers from the Norwegian University of Science and Technology and the University of the Aegean published a design and prototype for a cyber range dedicated to IEEE 802.11 security training, emulating access points and clients with mac80211_hwsim, Linux namespaces, hostapd, wpa_supplicant, dnsmasq, and FreeRADIUS. The platform bundles Aircrack-ng, Wireshark, and custom tools WPAxFuzz and Bl0ck, and can convert plain-language scenario descriptions into deployable definitions via a locally hosted Llama model. A working prototype covering scenario creation and deployment is on GitHub; monitoring, access control, and orchestration zones remain future work.
28
Deep Learning-Based Detection of Electrical Faults and Power Quality Disturbances in Aerospace Power Systems
Compact ResNet detects electrical faults in 400 Hz aircraft power systems with 95.87 percent accuracy after deployment on Xilinx Zynq MPSoC.
The study targets multiclass fault and power quality disturbance detection in 400 Hz aerospace networks using a high-fidelity simulation model inspired by the Boeing 787 electrical architecture, covering 21 normal, disturbance, switching, open-circuit, and short-circuit conditions. Two 73,500-sample datasets are built from 1D waveforms and STFT time-frequency representations, augmented with domain randomization and class-specific GANs, and the time-series dataset is released via IEEE DataPort. A compact ResNet with 175,685 parameters achieved 96.94 percent software test accuracy, and 95.87 percent after 8-bit quantization on a Xilinx Zynq UltraScale Plus ZCU102 with 6.90 ms mean accelerator latency per record.
30
Lightweight Zero Trust via Automotive SDN
Researchers map automotive SDN with MACsec/MKA and CORECONF/YANG to NIST SP 800-207, satisfying five of seven Zero Trust tenets without added infrastructure.
Zonal in-vehicle networks ship Ethernet, MACsec, and TSN but treat the network itself as trusted, with no standardized runtime way to revoke access, rotate keys, or contain a compromised ECU. The paper first analyzes what Open Alliance TC17 v1.0 MACsec/MKA with pre-shared CAKs already provides against the seven NIST SP 800-207 Zero Trust tenets. It then adds CORECONF/YANG management per Open Alliance TC19, mapping the SDN Controller and Agents one-to-one onto NIST's PE, PA, and PEP, and instantiates a YANG-based network-access-control flow and key-management scheme. The result fully covers five of the seven tenets and partially covers two, without any ZTA-specific infrastructure.
28
Wicked Problem, Parsimonious Solution: Securing Electric Vehicle Charging Station Software
Position paper proposes hierarchical software quality assurance to characterize and secure EV charging station software attack surfaces.
The authors argue that charging station supply-equipment software is a largely unprotected and poorly characterized attack surface in EV charging infrastructure. They advocate applying hierarchical software quality assurance (HSQA) to this specialized software, spanning from individual vulnerabilities such as CVEs to high-level characteristics like the CIA Triad. HSQA embeds quality and security considerations across the entire software development lifecycle to assess and improve charging station software security.
25
n8n security advisory (AV26-880)
Canada's Cyber Centre flagged multiple n8n vulnerabilities in versions prior to 1.123.76 and several 2.x releases, urging users to update.
The Canadian Centre for Cyber Security issued advisory AV26-880 stating that n8n is affected by vulnerabilities in versions prior to 1.123.76 and prior to 2.35.4, 2.36.2, 2.37.7, and 2.38.2. The advisory links to the n8n-io GitHub repository for details. Users and administrators are encouraged to review the advisory and apply the necessary updates.
22
This month in security with Tony Anscombe – August 2026 edition
ESET's August 2026 recap covers the Hugging Face hack, attacks on critical infrastructure, and a spoofed in-flight Wi-Fi network.
ESET's monthly video with Tony Anscombe recaps major cybersecurity stories from August 2026. Topics include the Hugging Face hack, attacks against critical infrastructure, and a spoofed in-flight Wi-Fi network used against passengers.
25
Five Eyes Guidance Improve Edge
Five Eyes intelligence agencies issued joint guidance aimed at improving security of edge network devices.
Based on the headline, Five Eyes cyber agencies released guidance recommending organizations improve the security posture of edge devices such as routers and remote-access appliances. No article text is available, so specific recommendations are unavailable.
38
A Deep Generative Model for Synthesizing Labeled Wireless Signals
Researchers propose IIns-GAN, a GAN that synthesizes realistic labeled ultra-wideband wireless signals, cutting dataset costs for wireless sensing training.
The paper introduces Inter-Instance Generative Adversarial Networks (IIns-GAN), a deep generative method that synthesizes realistic wireless signals with position-related labels to avoid costly real-world measurement and labeling. Unlike environment-model-based synthesis, the generated signals adapt to different environment scenarios and support training tasks such as distance estimation and environment identification. Experiments on public Ultra-Wideband (UWB) datasets show the synthetic signals closely mirror real measurements and improve model training performance.
20
Help shape the future of resilient private 5G
The UK NCSC invites organizations to collaborate on developing secure, resilient and deployable private 5G network technologies.
The UK National Cyber Security Centre is seeking collaboration with organizations developing technologies and approaches for secure, resilient and deployable private 5G networks. The blog post is an open call to help shape future private 5G resilience.
15
Cortex Cloud Archives
Palo Alto Networks publishes a product category page for Cortex Cloud, an AI and automation platform for cloud and SOC workflows.
This item is a product category archive page for Palo Alto Networks' Cortex Cloud, describing it as an AI and automation-driven platform spanning code to cloud to SOC. The page contains no new research, incident, or product release details beyond marketing language about prioritizing risks and accelerating remediation.
8
Self-Verifying Anomaly Detection using Explainable AI for Cybersecurity of DER Networks
ExCYDER framework self-verifies anomaly detection alerts for DER power grids using LightGBM and SHAP, reaching over 98% detection accuracy.
The paper presents ExCYDER, an explainable AI anomaly detection framework for Distributed Energy Resource networks that combines LightGBM with SHAP to validate whether each model decision aligns with its feature-attribution evidence. On a realistic DNP3 dataset it achieved over 98% detection accuracy, 14.5 ms SHAP latency per alert, and confidence deviation within 5%. The self-verifying mechanism distinguishes coherent from inconsistent alerts, improving interpretability and auditability for DER-focused security operations centers.
40
Bipartisan Senate bill aims to prepare energy sector for Q
Bipartisan Senate bill would direct FERC to factor quantum computing threats and post-quantum cryptography into US electric grid cybersecurity reliability standards.
The Quantum Grid Utility Assurance and Resilient Defense (Quantum-GUARD) Act, introduced by Senators Mike Rounds and Chris Coons, would require FERC to consider quantum computing threats when reviewing electric reliability standards and to explore post-quantum cryptography use in both IT and OT systems, plus a technical sandbox to study quantum impacts. It aligns with NIST's post-quantum algorithm work, and a June executive order moved the federal PQC migration deadline from 2035 to 2030. Industry experts noted the hard part is upgrading infrastructure such as SCADA communications and software update integrity ahead of those deadlines.
40
n8n security advisory (AV26-916)
Canadian Cyber Centre advisory AV26-916 warns n8n before versions 2.37.7, 2.38.2, and 1.123.76 is affected by an undisclosed vulnerability; patch required.
The Canadian Centre for Cyber Security issued advisory AV26-916 on September 11, 2026, stating that n8n is affected by a vulnerability in versions prior to 2.37.7, 2.38.2, and 1.123.76. Fixed releases [email protected], [email protected], and [email protected] are available via GitHub. No CVE identifier or exploitation details are provided; administrators are urged to review linked resources and apply updates.
22
OpenAI targets small utilities with $1 billion cyber defense initiative
OpenAI commits $1 billion to Daybreak for Frontline Defenders, subsidizing frontier cyber AI access and training for small utilities, governments, and critical infrastructure operators.
OpenAI President Greg Brockman announced Daybreak for Frontline Defenders, a $1 billion global commitment expanding subsidized access to Daybreak cyber models, training, and technical support. Daybreak for America will target small water and electricity providers, local governments, and banks, including a pilot with the MS-ISAC for state, local, tribal, and territorial defenders. The Daybreak Defense Network brings more than 35 enterprise partner products into the program, and attendees at OpenAI's utility summit represent 40 states serving over half the US population. Security experts welcomed the effort but cautioned that OT environments still need human-led implementation and testing before AI tooling can be safely rolled out.
75
Powering AI is an architecture problem
Sponsored analysis argues AI data centers need medium-voltage, inline power architecture after Virginia grid faults knocked over 3GW of load offline.
A sponsored MIT Technology Review piece recounts a July 22, 2026 transmission fault in Ashburn, Virginia that shed more than 3 GW of data center load, and a 2024 incident where one failed surge arrester dropped about 60 facilities and 1,500 MW. It argues legacy UPS-based power stacks fail at AI scale because campuses can swing 70% of load in milliseconds and trip offline during grid disturbances. The proposed fix moves protection to medium voltage (13.8 kV and above) in inline enclosures near substations, improving density, permitting timelines, and backup power economics. A full-scale system tested at the DOE National Laboratory of the Rockies cleared ERCOT large-load ride-through requirements.
18
A battery storage cyberattack would look exactly like a badly tuned controller
Risk modeling suggests a few hundred compromised grid-scale batteries dispatched through cloud optimizers could trigger blackouts in Texas or Great Britain.
Centrii analysis estimates 1,500 compromised one-megawatt units (5.4% of ERCOT's ~28 GW fleet) or 400 units (about 29% of Great Britain's ~1,400-unit fleet) could destabilize the grids, with modeled damage of $12-65 billion in Texas and a national blackout costing £2-10 billion in Britain. The study puts the probability of a major attack affecting at least one million people by 2031 at 92.1%, dropping to 61.4% with IEC 62443 certification and quarterly drills, based on 10,000 Monte Carlo runs. Because hostile battery swings are phased like legitimate frequency response, control rooms would see nothing unusual; Centrii proposes hunting for a reverse-governor signature where inverter output feeds oscillations. Spain's April 2025 blackout took an expert panel until March 2026 to rule out cyberattack, partly because key plants had no recordings.
30
Next
Palo Alto Networks product-category page describing Next-Generation Firewall threat detection, including encrypted traffic; no standalone article.
The page is a product category listing for Palo Alto Networks Next-Generation Firewalls, stating the products detect known and unknown threats, including in encrypted traffic, using intelligence from many thousands of customer deployments. It contains no research findings, vulnerabilities, or incident details relevant to defenders.
10
[Control systems] Schneider Electric security advisory (AV26-912)
Canada's Cyber Centre relays a Schneider Electric advisory covering multiple vulnerabilities in EcoStruxure IT Data Center Expert and PowerLogic T300, urging users to apply updates.
The Canadian Centre for Cyber Security issued advisory AV26-912 noting that as of September 9, 2026 Schneider Electric is affected by vulnerabilities in EcoStruxure IT Data Center Expert versions 9.1.2 and prior, and PowerLogic T300 versions 2.9.8-5620 and prior. The issues include an improper neutralization of special elements used in an OS command on the PowerLogic T300. The advisory recommends reviewing vendor notifications, performing suggested mitigations, and applying necessary updates.
18
Event-Native Symbolic-Temporal Spike Encoding Framework for Heterogeneous Cyber Streams
An event-native spike encoding framework lets recurrent spiking neural networks run intrusion detection directly on heterogeneous packet and CAN bus streams.
The paper maps heterogeneous cyber events—categorical identifiers, local frequency context, and inter-event timing—directly into sparse spike-compatible inputs for spiking neural networks. This avoids flow aggregation and fixed windows that add buffering latency and obscure temporal structure in traditional IDS pipelines. Compact recurrent SNNs under edge-oriented neuromorphic hardware constraints achieve a hybrid anomaly metric of 0.987 on packet-level Network IDS and 0.980 on message-level CAN IDS.
20
To keep the AI hacking genie bottled up, try one-way networks
Intuition Machines CEO proposes data diodes and one-way networks to physically prevent frontier AI models from escaping training sandboxes, citing the OpenAI Hugging Face incident.
Eli-Shaoul Khedouri, CEO of Intuition Machines, argues that sandboxes, permissions, and VMs are insufficient to contain frontier models, pointing to OpenAI's hack of Hugging Face as evidence. He proposes high assurance architectures modeled on classified SCIF environments: one-way optical data diodes for training inputs and telemetry, a sel4-verified receiver, immutable snapshots of registries like PyPI, GitHub, and npm, and mocked web services. He estimates under five percent overhead per gigawatt for such clusters, but notes frontier labs have not adopted them, largely because of competitive speed rather than cost.
45
Cyberattack causes network outage at Boston Scientific, disrupts global operations
Boston Scientific disclosed a cyberattack that caused a network outage, disrupting global operations including order processing and shipping.
The medical device maker detected the incident on August 25, activated incident response protocols with third-party cybersecurity experts, and told the SEC that access to systems supporting operations, including order processing and shipping, was disrupted. Boston Scientific employs about 59,000 people across 127 countries and posted more than $20 billion in net sales in 2025; it has not determined whether the incident is material and no group has claimed responsibility. The company joins a recent run of medtech attacks including Stryker, iRhythm, Novo Nordisk and Xsolis.
70
Palo Alto Networks security advisory (AV26-905)
Canada's Cyber Centre relayed Palo Alto Networks advisories covering PAN-OS, Cloud NGFW, Prisma Access, and Prisma Browser vulnerabilities, including PAN-OS CVE-2026-0310 buffer overflow.
The Canadian Centre for Cyber Security issued advisory AV26-905, noting that as of September 10, 2026, multiple Palo Alto Networks products are affected by vulnerabilities. Affected products include Cloud NGFW on AWS and Azure, multiple PAN-OS versions, Prisma Access, and Prisma Browser prior to 151.26.5.170. The advisory references CVE-2026-0310, a PAN-OS buffer overflow via XML processing (PAN-SA-2026-0012), and the September 2026 Chromium monthly vulnerability update. Administrators are encouraged to review the vendor links and apply available updates.
20
[Control systems] Schneider Electric security advisory (AV26-871)
Canada's Cyber Centre relayed Schneider Electric advisories for vulnerabilities in NetBotz 5-750/755 (5.5.2 and prior) and PowerChute Serial Shutdown (1.5 and prior).
The Canadian Centre for Cyber Security issued control-systems advisory AV26-871 noting Schneider Electric products affected by vulnerabilities as of September 1, 2026. Affected products include NetBotz 5-750/755 versions 5.5.2 and prior, and PowerChute Serial Shutdown versions 1.5 and prior, the latter with an improper restriction of excessive authentication attempts flaw. Administrators are urged to review Schneider Electric's security notifications and apply the suggested mitigations and updates.
24
Attack Chains, Not Just Attack Surfaces: Why Testing Individual Techniques Misses the Point
Filigran introduces Attack Chaining in OpenAEV to continuously simulate multi-stage attack paths, exposing gaps that isolated MITRE ATT&CK technique testing misses.
Filigran announced Attack Chaining, a new scenario type in its OpenAEV platform that links individual techniques into automated, continuously-run multi-stage attack paths, using each step's real output (credentials, tokens, open ports) to branch dynamically toward a final objective. The article cites Filigran's State of Threat Management report, in which 93% of security leaders reported a business-impacting cyberattack in the past 12 months, 88% said AI accelerates attackers, and 84% blamed siloed tools and disconnected testing. The 2025 DGFiP breach is cited as an example where individually survivable weaknesses chained into a major intrusion. The feature includes conditional chaining logic, live attack path mapping, structured findings for identifying chokepoints, and predefined scope and safety guardrails.
18
HPE security advisory (AV26-928)
Canada's Cyber Centre relayed an HPE advisory covering multiple vulnerabilities in EdgeConnect SD-WAN Gateways and Orchestrator, urging prompt updates.
On September 16, 2026, the Canadian Centre for Cyber Security published advisory AV26-928 noting that as of September 15, 2026, HPE is affected by multiple vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways and Orchestrator across multiple versions, per HPE bulletin HPESBNW05135 rev.1. The Cyber Centre encourages users and administrators to review the linked HPE security bulletins and apply available updates. No exploitation details or CVE identifiers are provided in the advisory text.
30