Selman Bağırıcı
10 notes
Latest note / 25 October 2026 · 9 minutes
On 21 October 2026 PHP shipped an emergency release for two critical flaws in the language runtime itself.
Read the note ↗ESET found a new backdoor that hides its command server inside an experimental mesh network. UAC-0099 broke into a grain logistics firm, handed the access to Sandworm, and two months later the data was wiped. The case is about division of labour, invisible traffic and how critical the food chain is.
In May 2026, a manufacturer of pharmaceutical packaging and delivery systems took a precautionary global production shutdown. Around the same time, an electronics manufacturer's North American sites experienced roughly two weeks of disruption. Dragos reports that it observed no direct manipulation of control systems in these cases.
AI hands an attacker who knows nothing about OT the water utility's vendor and default password, unprompted. Does that mean we rewrite the defense? Combining Dragos's observations with the SANS five critical controls, the answer is no.
What happens when the PLC at a pump station can be read from the other side of the internet? Using the August 2026 advisory issued jointly by five US agencies, I walk through how a PLC ends up on the internet, what becomes possible without a password, and what to look at in the field.
A substation RTU advisory published in October 2026 lists a sixteen-year-old vulnerability. Another advisory published in September tells users of a communication module discontinued in 2021 that there is no patch and the module must be replaced. Why do OT devices live this long, and what do we do when we have to live with an old vulnerability?
In August 2026 the US Coast Guard and the FBI boarded a crude oil tanker bound for Texas and examined the ship's IT and OT systems. Why should a ship be thought of like a plant ashore, what makes it harder, and what do we actually know about the incident?
What do a cellular field connection, a private APN and encryption actually protect? CERT Polska’s incident analysis shows how access at one site can extend to another site’s management interface.
How can production be affected while the PLC program remains protected? PROFINET DCP and a brief Modbus comparison reveal the boundary between reaching a device and being allowed to change it.
Some redundancy mechanisms open a new path after a failure; others send the backup copy before anything breaks. Let us examine the difference through substation communications.
No notes match your search.