InfoSecBulletin Cybersecurity for mankind
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns of a big rise in attacks on internet-connected programmable logic controllers (PLCs) used in water and wastewater systems. The agency’s alert is urgent because hackers affected over 30 local water systems in Minnesota. The attacks began last Sunday and went on until Monday.
CISA’s alert talks about hackers attacking exposed programmable logic controllers (PLC). They change passwords to keep operators out, change IP addresses to cut off devices from the internet, and take other steps that mess up operations.
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
“CISA urges critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible.”
Many organizations that run water and wastewater systems are being targeted, even those with strong cybersecurity programs. The bulletin says that visible operational technology (OT) might have undocumented cellular modems set up by operators, vendors, or system integrators.
Internet-facing assets are exposed to defacement attacks, configuration changes, operational disruptions, and even physical damage, the agency said.
CISA suggests taking these assets off the internet right away. If that can’t be done, organizations should use a VPN or secure gateway for safe access.
Additionally, default passwords should be changed, and access should be limited to an IP address allow-list.
The agency told owners of Rockwell Automation MicroLogix 1400 PLCs to check vendor advice for getting access back if passwords were changed.
                                Source: Censys
Censys said there are now over 4,100 Rockwell Automation/Allen-Bradley devices on the internet, 4,100 Siemens devices, and more than 2,000 Schneider Electric devices.
The map above shows devices that can be reached over the public internet. This does not mean these systems are being targeted or hacked. About the MicroLogix 1400 controllers in CISA’s bulletin, Censys says many are using old firmware versions that are no longer sold.
The security company pointed out that many cellular modems are not documented, causing issues. They reported that almost half of the exposed Rockwell devices can be accessed through Verizon Business, AT&T, T-Mobile, Comcast, Charter, and Starlink networks.
                                    Source: Censys
Censys also shared a longer list of signs of compromise (IoCs) in its report, along with tips for finding threats.
Earlier this week, the Minnesota IT Services (MNIT) agency activated the state’s cybersecurity incident response plan after identifying what it described as “a coordinated cyberattack targeting operational technology at more than 30 Minnesota community water systems.”
