InfoSecBulletin Cybersecurity for mankind
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns of a big rise in attacks on internet-connected programmable logic controllers (PLCs) used in water and wastewater systems. The agency’s alert is urgent because hackers affected over 30 local water systems in Minnesota. The attacks began last Sunday and went on until Monday.
CISA’s alert talks about hackers attacking exposed programmable logic controllers (PLC). They change passwords to keep operators out, change IP addresses to cut off devices from the internet, and take other steps that mess up operations.
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
“CISA urges critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible.”
Many organizations that run water and wastewater systems are being targeted, even those with strong cybersecurity programs. The bulletin says that visible operational technology (OT) might have undocumented cellular modems set up by operators, vendors, or system integrators.
Internet-facing assets are exposed to defacement attacks, configuration changes, operational disruptions, and even physical damage, the agency said.
CISA suggests taking these assets off the internet right away. If that can’t be done, organizations should use a VPN or secure gateway for safe access.
Additionally, default passwords should be changed, and access should be limited to an IP address allow-list.
The agency told owners of Rockwell Automation MicroLogix 1400 PLCs to check vendor advice for getting access back if passwords were changed.
Source: Censys
Censys said there are now over 4,100 Rockwell Automation/Allen-Bradley devices on the internet, 4,100 Siemens devices, and more than 2,000 Schneider Electric devices.
The map above shows devices that can be reached over the public internet. This does not mean these systems are being targeted or hacked. About the MicroLogix 1400 controllers in CISA’s bulletin, Censys says many are using old firmware versions that are no longer sold.
The security company pointed out that many cellular modems are not documented, causing issues. They reported that almost half of the exposed Rockwell devices can be accessed through Verizon Business, AT&T, T-Mobile, Comcast, Charter, and Starlink networks.
Source: Censys
Censys also shared a longer list of signs of compromise (IoCs) in its report, along with tips for finding threats.
Earlier this week, the Minnesota IT Services (MNIT) agency activated the state’s cybersecurity incident response plan after identifying what it described as “a coordinated cyberattack targeting operational technology at more than 30 Minnesota community water systems.”
