We’re Tracking the Future of Security

Category: Industrial Safety & Monitoring

  • Hardcoded Cryptographic Keys in Wärtsilä Ship Management Software Rated Critical

    Hardcoded Cryptographic Keys in Wärtsilä Ship Management Software Rated Critical

    CISA disclosed two critical vulnerabilities in Wärtsilä FOS-Onboard, fleet-management software used aboard vessels, after the flaws were reported by maritime cybersecurity firm Cydome Security. CVE-2026-78225, rated 9.1 to 9.5 depending on scoring version, is a hardcoded cryptographic server key in the software’s Update Controller component that could let an attacker deliver an unauthorized software update or execute code on affected systems.

    A second flaw, CVE-2026-81855, is a hardcoded client authentication key in a robot-testing-framework component that could let an attacker extract credentials and impersonate a privileged client. Wärtsilä said the vulnerabilities are not exploitable under its recommended installation configuration and has made a patch available to customers on request. CISA lists the affected sector as Transportation Systems, with deployment worldwide.

    Why it matters

    Hardcoded keys are a recurring failure mode in operational technology because they can’t be rotated the way a normal credential can — once exposed, every deployed unit sharing that key is affected until firmware is patched.

    Sources

  • Critical Flaw in Siemens Reyrolle Grid Protection Relays Allows Authentication Bypass

    Critical Flaw in Siemens Reyrolle Grid Protection Relays Allows Authentication Bypass

    CISA published an advisory disclosing 14 vulnerabilities in Siemens Reyrolle 7SR5 protection relays, devices used in electrical substations worldwide to detect faults and trigger circuit breakers. The most severe, CVE-2026-62645, carries a CVSS score of 9.8 out of 10 and stems from the relay’s web interface exposing information that lets an attacker calculate current and past session IDs — enough to bypass authentication entirely without any privileges or user interaction.

    The advisory also describes a related flaw allowing predictable session-ID generation from insufficient entropy, an out-of-bounds write reachable through crafted URLs that can force the device to reboot, and a physical-access vector that could allow unsigned code execution through a maintenance-mode key sequence. Siemens has released firmware version 2.70 to address the vulnerabilities; earlier versions remain exposed.

    Why it matters

    Protection relays are a core safety component of the electrical grid — an attacker who can bypass authentication on one gains the ability to interfere with fault detection and circuit-breaker operation, which is exactly the kind of access that grid-security planners worry about most.

    Sources

  • Italian Startup Exein Hits $1.7B Valuation to Secure ‘Physical AI’ Robots and Drones

    Italian Startup Exein Hits $1.7B Valuation to Secure ‘Physical AI’ Robots and Drones

    Rome-based cybersecurity startup Exein raised $270 million in an oversubscribed funding round, pushing its valuation to $1.7 billion and making it Europe’s most valuable cybersecurity company, the company said this week. The round was led by Headline, with participation from Sofina, Goldman Sachs, the EIB Group’s European Tech Champions Initiative and KfW Capital, among others.

    Exein’s Photon runtime-security platform already secures more than 2 billion connected devices across industrial automation, automotive, energy, healthcare, aerospace and semiconductor manufacturing. The company said it plans to use the new capital to build a proprietary foundation model aimed specifically at securing “Physical AI” systems — industrial robots, drones and autonomous vehicles that increasingly run their own AI models at the edge — with a target release in the first quarter of 2027. Exein reported that annual recurring revenue roughly quadrupled in the first half of 2026 and said it will open a new office in the San Francisco Bay Area as part of a US and Asia-Pacific expansion.

    Why it matters

    As physical-security systems increasingly embed AI models directly on cameras, robots and industrial controllers rather than in the cloud, runtime security for those edge AI systems becomes a new attack surface that traditional endpoint or network security tools were not built to cover.

    Sources

  • Commercial Kitchen Fire Suppression Systems: How Hood and Duct Protection Works

    Commercial Kitchen Fire Suppression Systems: How Hood and Duct Protection Works

    Commercial kitchens present a fire risk unlike almost any other space in a building. Deep fryers, griddles, and open-flame ranges generate sustained high-temperature heat sources sitting directly beneath a network of grease-laden exhaust ductwork. A grease fire that starts at a fryer can travel into the hood plenum and duct system within seconds, turning a contained appliance fire into a structure fire. General-purpose fire suppression, sized for offices or server rooms, is not designed for this problem. Commercial kitchens require dedicated, appliance-specific suppression engineered around the chemistry of cooking-oil fires.

    Why Grease Fires Behave Differently

    Cooking oil and animal fat fires are classified separately from ordinary combustibles because they burn at very high temperatures and can reignite even after flames appear extinguished. Water is actively dangerous on a grease fire, since it can cause the burning oil to splatter and spread. This is why kitchen suppression systems rely on wet chemical agents formulated specifically for this fuel class. When the agent contacts hot oil, it reacts with the fatty acids to form a soap-like layer across the surface, a process known as saponification, that smothers the fire, blocks oxygen, and cools the fuel enough to prevent flashback reignition.

    System Architecture: Hood, Duct, Plenum and Appliance

    A properly engineered kitchen suppression system covers four zones simultaneously: the cooking appliances themselves, the plenum immediately above them, the hood, and the exhaust duct running to the roof. Nozzles are positioned and sized according to each appliance’s fuel type and heat output, since a fryer, a griddle, and a charbroiler each require different discharge patterns and agent volumes. Detection is typically handled by fusible links tuned to activate at a specific temperature, though electronic heat and flame detection is increasingly used alongside or in place of mechanical links for faster response and remote monitoring capability.

    Automatic Shutoff and Building Integration

    Activation of a kitchen suppression system does more than discharge agent. A properly integrated system automatically shuts off the gas or electrical supply to the affected appliances, preventing the fire from being continuously re-fed even after the agent has been applied. Many installations also tie into the building’s manual pull station network and the broader fire alarm system, so that suppression activation triggers audible alarms, notifies the fire panel, and can initiate HVAC shutdown to prevent smoke recirculation.

    Inspection, Testing and Maintenance

    Grease accumulation is the enemy of a reliable kitchen suppression system. Nozzles can become clogged, fusible links coated, and duct interiors lined with flammable residue if inspection schedules slip. Semiannual professional inspection is standard practice in most jurisdictions, alongside more frequent internal checks by kitchen staff, such as verifying nozzle caps are intact, extinguishing agent gauges read in the normal range, and manual pull stations are unobstructed. Duct cleaning is a related but separate maintenance discipline, since a suppression system is only as effective as the duct it is protecting.

    Scaling From Single Restaurants to Large Foodservice Operations

    The same core principles apply whether the facility is a single quick-service restaurant or a hotel with multiple kitchens, a hospital cafeteria, or a stadium concession concourse. What changes at scale is system count, central monitoring integration, and how suppression activation is reported to a security or facilities operations center. Large foodservice operators increasingly want kitchen suppression status, activation events, low-agent alarms, inspection due dates, visible in the same monitoring platform used for the rest of their physical security and life safety systems, rather than isolated on a separate panel that only the fire protection contractor checks.

    Reference sources

  • Diesel Spill at New Jersey AI Data Center Draws Environmental Scrutiny

    Diesel Spill at New Jersey AI Data Center Draws Environmental Scrutiny

    An estimated 5,000 gallons of diesel fuel spilled from a storage tank at an Equinix data center in Secaucus, New Jersey, on the evening of Friday, September 11, 2026, and flowed into Anderson Creek, a tributary of the Hackensack River, according to CBS News New York, which cited the New Jersey Department of Environmental Protection. The facility, which is under construction and expansion, uses diesel tanks to power backup generators. Cleanup crews have used vacuum trucks to remove a mixture of fuel and water from the creek since the spill was detected.

    Equinix said in a statement that it detected the fuel release Friday, stopped it, and immediately contacted relevant agencies. “We are working closely with those agencies, local officials, and community stakeholders to ensure a thorough remediation, while also conducting a full investigation to determine the root cause and prevent recurrence,” the company said, according to CBS News New York. Bill Sheehan of the environmental group Hackensack Riverkeeper told CBS he was informed a computer glitch triggered the spill.

    The incident has renewed local debate over the rapid expansion of AI-driven data center capacity in the New Jersey Meadowlands, with advocacy groups using the episode to press for a statewide moratorium on new data center construction, citing the sector’s growing power and infrastructure footprint.

    Why it matters

    Backup-generator fuel systems are a routine part of data center resiliency design, but this incident is a reminder that the same infrastructure meant to protect uptime carries its own environmental and physical-security exposure that facility teams need to monitor, not just the IT floor.

    Sources

  • CISA Flags Critical Authentication Flaw in mySCADA myPRO Manager Used in Water, Energy Systems

    CISA Flags Critical Authentication Flaw in mySCADA myPRO Manager Used in Water, Energy Systems

    CISA released an advisory on September 15 warning of two vulnerabilities in mySCADA myPRO Manager, industrial control software from Czechia-based mySCADA Technologies that is deployed worldwide across the critical manufacturing, energy, food and agriculture, transportation, and water and wastewater sectors.

    The more severe flaw, CVE-2026-73807, carries a CVSS v3.1 score of 9.8, near the maximum critical rating. CISA said the myPRO Manager command application programming interface fails to properly enforce authentication for privileged functions, meaning an unauthenticated attacker with network access to the API could reach privileged management capabilities without credentials. A second flaw, CVE-2026-82567, allows an unauthenticated attacker to send arbitrary SMS messages through a GSM modem connected to the software’s notification gateway.

    mySCADA Technologies has addressed both issues in myPRO Manager version 2.2 and is notifying connected users of the update, according to the advisory. The vulnerabilities were reported to CISA by Shirshak Secnora OU. CISA said it has not observed public exploitation of the flaws to date but urged operators to minimize internet exposure of control system devices, isolate them behind firewalls, and use virtual private networks for any required remote access.

    Why it matters

    myPRO Manager sits inside operational technology environments spanning energy, water and transportation, where an unauthenticated privilege gap can translate directly into physical-process risk. Asset owners should apply version 2.2 and re-confirm remote-access paths rather than assume perimeter isolation is already in place.

    Sources

  • Wind Farm and Offshore Wind Security Technology

    Wind Farm and Offshore Wind Security Technology

    Wind energy installations, whether onshore wind farms spread across large rural footprints or offshore arrays sited miles from shore, share a security characteristic that distinguishes them from most other energy infrastructure: individual turbines are valuable, largely unmanned, and physically dispersed over an area far too large for constant human patrol, which pushes the sector toward remote sensing and centralized monitoring rather than on-site guarding.

    Perimeter and Site Security for Onshore Wind Farms

    Onshore wind farms typically secure high-value equipment — substations, battery or transformer enclosures, and the base of each turbine tower — with a combination of fencing, intrusion detection and camera coverage focused on these fixed points rather than attempting to monitor the entire land area between turbines. Rural siting also means many wind farms deal with long response times from off-site security or law enforcement, making early detection and remote video verification a higher priority than at urban facilities.

    Offshore-Specific Security Challenges

    Marine Access Control

    Offshore wind installations must control access by vessel rather than by road, using AIS (Automatic Identification System) vessel tracking, marine radar and, in some installations, camera systems designed for maritime environments to detect unauthorized approach to turbine foundations, substations and subsea cable landing points.

    Subsea Cable Protection

    The subsea export and inter-array cables connecting offshore turbines to shore represent a single point of failure that is difficult to physically guard directly; operators generally rely on vessel-tracking exclusion zones, anchor-drag monitoring, and post-incident fault-location systems rather than continuous physical surveillance of cable routes.

    Remote Monitoring as the Core Security Model

    Because most turbines are unmanned between maintenance visits, condition-monitoring systems originally deployed for mechanical and structural health — vibration sensors, SCADA telemetry and remote cameras — are increasingly correlated with security event data so that an unexpected access-panel opening or unscheduled nacelle activity can be flagged through the same monitoring infrastructure used for turbine maintenance, rather than requiring a separate dedicated security system.

    OT Cybersecurity for SCADA and Grid Interconnection

    Wind farm SCADA systems that control turbine operation and manage grid interconnection represent critical infrastructure from a cybersecurity standpoint, since a compromised control system could affect both individual turbine safety and, at scale, grid stability. Network segmentation between turbine control networks and corporate IT, along with monitoring for anomalous SCADA commands, follows the same OT-security principles applied across other critical energy infrastructure.

    FAQ

    How is offshore wind security different from onshore wind security?

    Offshore installations must control access by vessel rather than by land, relying on AIS tracking and marine radar, and must address subsea cable protection, a physical-asset category that has no direct onshore equivalent.

    Do individual wind turbines usually have their own dedicated security systems?

    Most turbines rely on access-panel monitoring and sensor data folded into the same condition-monitoring and SCADA infrastructure used for maintenance, rather than a standalone security system per turbine, given the impracticality of continuously guarding hundreds of dispersed, largely unmanned structures.

    Conclusion

    Wind energy security is shaped by scale and remoteness rather than by a single high-value structure to defend. Onshore farms concentrate protection on fixed high-value points, while offshore arrays add marine access control and subsea cable risk, but both rely fundamentally on remote monitoring and SCADA-integrated detection rather than continuous physical presence.

  • Semiconductor Fabrication Plant Security Technology

    Semiconductor Fabrication Plant Security Technology

    Semiconductor fabrication plants occupy an unusual position in industrial security: the facilities are simultaneously among the most valuable manufacturing sites in the world, among the most contamination-sensitive, and among the most exposed to economic-espionage risk. Protecting a fab means protecting process recipes, yield data and equipment configurations that can represent years of R&D investment, while doing so inside cleanroom environments where conventional security hardware cannot simply be installed without engineering review.

    Intellectual Property Is the Primary Asset at Risk

    Unlike most manufacturing facilities, where the physical product is the main asset of concern, a fab’s greatest value often sits in intangible process knowledge: lithography recipes, etch parameters, and the tool-configuration data that determines chip yield. Semiconductor manufacturers and their national governments have treated the theft of this process knowledge as a strategic economic-security issue, not merely a corporate one, which has pushed leading fabs toward access-control and monitoring regimes closer to those used in defense manufacturing than in general industrial settings.

    Cleanroom-Compatible Physical Security

    Access Control Inside Contamination-Controlled Zones

    Standard access-control hardware, badge readers and cameras must be specified in cleanroom-rated enclosures that do not shed particles, since even minor contamination can affect wafer yield. This constrains equipment choices and typically requires close coordination between the security integrator and the fab’s process-engineering team before any device is installed inside a cleanroom bay.

    Tiered Access by Process Area

    Fabs commonly implement tiered access zones that go well beyond a simple perimeter-and-interior model: photolithography bays, where the most sensitive recipe data is generated, are typically restricted to a smaller population of cleared personnel than general fab-floor access, with additional logging of tool-level login activity layered on top of physical badge access.

    Operational Technology and Equipment Security

    Fab tools are networked to manufacturing-execution systems that schedule wafers, collect yield data and adjust process parameters, making tool-level cybersecurity as important as the physical perimeter. Because process tools from multiple equipment vendors are often serviced by third-party field engineers with remote-access needs, fabs have generally been early adopters of tightly scoped vendor remote-access controls and network segmentation between fab-floor OT systems and corporate IT.

    Visitor, Contractor and Insider Controls

    Fabs draw a large volume of equipment-vendor field engineers, auditors and prospective customers through facility tours, creating sustained insider and visitor-risk exposure. Common controls include escort requirements in sensitive bays, camera-restricted or camera-prohibited zones around specific tool sets, and device-control policies restricting phones and storage media in areas where process data is visible on tool displays.

    FAQ

    Why can’t fabs use standard commercial security cameras everywhere?

    Standard camera housings and other electronic hardware can shed particles or off-gas materials that compromise cleanroom air-cleanliness classifications. Any device installed inside a classified cleanroom area typically needs a cleanroom-rated enclosure validated against the facility’s particulate standards.

    Is fab security mainly about preventing physical theft?

    Physical theft of finished product is a much smaller concern than the theft or leakage of process knowledge and yield data. Most fab security programs are built primarily around protecting intellectual property and process information rather than physical inventory.

    Conclusion

    Semiconductor fab security sits at the intersection of cleanroom engineering constraints, high-value intellectual-property protection and OT cybersecurity for networked process tools. That combination has pushed the sector toward access-control and monitoring practices that are more granular, and more tightly coupled to process engineering, than in almost any other manufacturing vertical.

  • Schneider Electric, Siemens and AVEVA Patch Critical Industrial Control System Flaws in September Patch Cycle

    Schneider Electric, Siemens and AVEVA Patch Critical Industrial Control System Flaws in September Patch Cycle

    Industrial automation vendors Schneider Electric, Siemens and AVEVA published their September 2026 Patch Tuesday advisories, disclosing and fixing a batch of vulnerabilities across products used to run and monitor industrial and critical infrastructure operations.

    A Critical Flaw in Widely Deployed Safety Controllers

    The most severe issue disclosed, tracked as CVE-2026-3869 with a CVSS score of 9.2, is a critical authentication vulnerability affecting Schneider Electric’s Modicon M580 and Modicon M580 Safety programmable controllers, hardware widely used to control physical processes in manufacturing and critical infrastructure environments. Schneider Electric published four new security advisories and updated four others, including one originally issued in 2019, and separately resolved high-severity flaws in its PowerLogic T300 platform (formerly Easergy T300) and EcoStruxure IT Data Center Expert product, along with a medium-severity issue in its SCADAPack x70 line.

    Denial-of-Service Risk in Rockwell’s Historian Software

    Rockwell Automation separately disclosed CVE-2026-12661, a high-severity denial-of-service vulnerability in FactoryTalk Historian Machine Edition, in which a network-adjacent, authenticated attacker can send crafted requests to the web interface to trigger a buffer overflow that crashes the device. AVEVA’s FactoryTalk Historian SE product, which is built on the AVEVA PI Server, carries a related issue that lets an unauthenticated attacker remotely crash or exhaust memory on the PI Message Subsystem, requiring a power cycle to recover affected systems.

    Part of a Broader Monthly Cadence Across the Sector

    Since the previous month’s patch cycle, CISA has separately published advisories covering additional industrial and IoT vulnerabilities from vendors including Inductive Automation, Hitachi Energy, Furuno, Johnson Controls and others, underscoring how large and continuous the flow of disclosed operational technology vulnerabilities has become. None of the newly disclosed Schneider, Siemens, AVEVA or Rockwell flaws in this cycle have been reported as under active exploitation, but organizations running the affected controllers and historian software are advised to apply vendor patches and review network segmentation between control systems and general IT networks.

  • Thermal Cameras Beyond Perimeter Protection

    Thermal Cameras Beyond Perimeter Protection

    Thermal cameras have long been associated with a single job in physical security: spotting intruders along a dark perimeter where visible-light cameras struggle. That reputation undersells the technology. Because thermal imaging detects heat rather than reflected light, it has found a growing set of applications well beyond perimeter intrusion detection.

    Why Thermal Works Where Visible Light Fails

    A thermal, or infrared, camera does not capture light in the way a conventional camera does. It measures the infrared radiation every object emits based on its temperature and converts that data into a visible image. Because it does not rely on ambient or artificial light, a thermal camera performs consistently in total darkness, through smoke, light fog and other conditions that degrade visible-light imaging, which is the original basis for its use along fences and open perimeters.

    Early Fire and Overheat Detection

    Because thermal cameras measure temperature directly, they can identify a developing fire or equipment overheating before flames or smoke are visible to a conventional camera or even to a person on site. This has made thermal imaging a growing complement to traditional smoke and heat detectors in settings like waste and recycling facilities, warehouses storing combustible materials, and outdoor stockpiles at industrial sites, where a slow-building fire in a large pile of material can go undetected by point smoke detectors for hours.

    Industrial Condition Monitoring

    Fixed thermal cameras are increasingly used for continuous monitoring of industrial equipment such as electrical switchgear, transformers, motors and bearings, where an abnormal temperature rise can be an early indicator of a developing fault. Unlike a handheld thermal camera used for periodic inspection, a fixed unit can watch critical equipment continuously and trigger an alert as soon as a reading crosses a defined threshold, extending thermal imaging from a security tool into a predictive-maintenance and safety tool.

    Health and Occupancy Screening

    Thermal cameras also saw expanded use for elevated-temperature screening at building entrances, though public health authorities and manufacturers alike have cautioned that a thermal camera at a doorway is a coarse screening tool rather than a diagnostic one, since ambient temperature, camera calibration and where on the face the reading is taken all affect accuracy. More durable applications in this space include monitoring processing areas in food and pharmaceutical facilities, where consistent thermal conditions matter for product safety and equipment performance.

    Combining Thermal With Analytics

    Modern thermal cameras increasingly pair with the same AI-based analytics used on visible-light cameras, applying object classification and behavioral detection to the thermal image. This combination is particularly useful for outdoor perimeter and critical-infrastructure sites, where a thermal-plus-analytics camera can both detect a person or vehicle in total darkness and classify what it has detected, reducing false alarms compared with older thermal systems that could only flag a change in the scene without saying what caused it.

    FAQ

    Can thermal cameras replace smoke detectors? No. Thermal cameras are generally deployed as a complement to, not a replacement for, code-required smoke and heat detection systems, particularly useful for large or open areas where point detectors are impractical or too slow.

    Do thermal cameras work in daylight? Yes. Thermal imaging is based on heat rather than visible light, so it functions in bright daylight, complete darkness and through smoke or light fog alike, unlike visible-light cameras.

    Are thermal cameras accurate for measuring exact temperatures? Radiometric thermal cameras can provide calibrated temperature readings suitable for industrial monitoring, but accuracy depends on calibration, distance and environmental conditions, and screening-grade thermal cameras are generally not precise enough for medical-grade temperature measurement.