We’re Tracking the Future of Security

Tag: critical infrastructure

  • Researchers Find 543,699 Live Credentials in Public GitHub Data

    Researchers Find 543,699 Live Credentials in Public GitHub Data

    Truffle Security reports that 543,699 credentials discovered in public GitHub data still authenticated when tested. The finding comes from the company’s analysis of The Stack v3, a dataset containing 224.6 million public repositories and 58.47 billion files, and points to a long-lived operational problem rather than only recent accidental disclosure.

    Scale and age of the exposure

    The researchers identified 1,103,438 exposed credential candidates and tested them on July 27 and 28, 2026. They said 543,699 remained live. The median exposure age was 784 days, while the oldest valid credential dated to 2009. These figures are research findings reported by Truffle Security and should be understood within the methodology described in its primary report.

    The study also found 199,843 live credentials exposed after GitHub enabled default push protection in February 2024. According to the report, 51.8 percent of live credentials used formats that default push protection did not block. For teams managing broader cyber-physical security risks, the result illustrates how software supply-chain weaknesses can create access paths into operational environments.

    Control implications for security teams

    The research indicates that preventive scanning alone does not close the exposure window. Organizations need detection across repositories and development workflows, but they also need a reliable process to revoke and replace discovered secrets. Historical repositories and older commits deserve attention because a credential’s age does not establish that it has expired. Asset owners should treat a confirmed live credential as an incident requiring containment, scope assessment, rotation, and a review of associated access rather than merely removing the visible string from a repository.

    Sources and further reading

  • CISA Flags Exploited FortiMail Zero-Day Requiring Urgent Mitigation

    CISA Flags Exploited FortiMail Zero-Day Requiring Urgent Mitigation

    CISA has added CVE-2026-104286, a critical FortiMail vulnerability, to its Known Exploited Vulnerabilities catalog. The October 1 action gives covered organizations an October 4 due date and calls for forensic triage alongside mitigation, reflecting confirmed exploitation rather than a theoretical risk.

    Affected FortiMail releases and exposure

    Fortinet assigns the flaw a CVSS score of 9.8 and describes it as an unauthenticated path-traversal and null-byte handling issue. According to its advisory, an attacker can use HTTP or HTTPS to write arbitrary files. The affected ranges are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9.

    Fixed builds were listed as upcoming when the advisory was issued. This creates an immediate operational decision for teams responsible for internet-facing mail infrastructure and the wider cyber-physical security environment: reduce reachable attack surface while also checking systems for evidence of compromise.

    Immediate defensive priorities

    Fortinet’s stated workaround is to disable IBE or restrict management access to a trusted private network. Administrators should follow the vendor’s current guidance, preserve relevant evidence from mail and management interfaces before making changes, and conduct the forensic triage requested by CISA. Because fixed builds had not yet been listed in the supplied advisory facts, teams should verify the latest vendor notice before making assumptions about patch availability. The watchTowr analysis offers additional technical context, but remediation decisions should remain anchored to current Fortinet and CISA instructions.

    Sources and further reading

  • Johnson Controls Fixes Two EasyIO Neo Controller Security Flaws

    Johnson Controls Fixes Two EasyIO Neo Controller Security Flaws

    Johnson Controls has released updates for EasyIO Neo controllers after two security issues were documented in separate coordinated advisories. The vulnerabilities concern exposure of sensitive information and transmission of credentials or session information without adequate encryption.

    What the two advisories cover

    CVE-2026-64892 involves information that can be obtained through physical debugging interfaces. CISA gives it a maximum CVSS v3 base score of 3.5. CVE-2026-64893 addresses cleartext transmission of credentials and session data and carries a maximum CVSS v3 base score of 5.4.

    The affected devices are used in building-control environments, where controller credentials can provide a path into operational functions. CISA says it is not aware of public exploitation targeting either issue. Johnson Controls lists the related product advisories JCI-PSA-2026-20 and JCI-PSA-2026-30 on its security-advisory portal.

    Updates and compensating controls

    The vendor identifies EC version 3.3b64 and CW version 3.3b26 as fixed releases. For the network issue, operators should use HTTPS and disable HTTP where their deployment allows it. Physical access to debugging interfaces should also be restricted, with controller locations monitored as part of the site’s security plan.

    Before updating controllers, building operators should document current logic and configuration, confirm a rollback path and schedule functional testing. Network teams should check that management traffic stays on trusted segments. SectechMedia’s industrial safety and monitoring coverage includes further guidance for operational technology estates.

    Sources

  • ABB PCM600 Flaws Could Enable Privilege Escalation and File Overwrite

    ABB PCM600 Flaws Could Enable Privilege Escalation and File Overwrite

    ABB has addressed two vulnerabilities in PCM600, its protection and control engineering tool. CISA says the flaws could let a local attacker elevate privileges or cause project-archive files to be written outside the intended extraction directory.

    Two different local attack paths

    CVE-2026-15952 concerns permissions around a scheduler component running as LocalSystem. Under the conditions described by the advisory, a local user could exploit that arrangement to gain higher privileges. CVE-2026-15953 is a path-traversal issue in project archive handling that could place files beyond the selected extraction folder.

    CISA lists PCM600 versions through 2.14 as affected and gives the vulnerabilities a maximum CVSS v3 base score of 6.4. The agency says it is not aware of public exploitation. ABB has published product security advisories and provides workaround guidance for affected deployments.

    Why engineering workstations need special care

    PCM600 is used in energy-sector protection and control engineering. An engineering workstation can therefore hold trusted project files and privileged access to operational assets even when it is not directly exposed to the internet. Organizations should apply ABB’s guidance, limit local administrator rights and treat imported project archives as untrusted until validated.

    Before remediation, teams should back up projects and confirm recovery procedures. Afterward, review scheduled tasks, extraction directories and endpoint telemetry for unexpected files or privilege changes. SectechMedia’s energy-security coverage examines the wider operational context for protecting utility and industrial environments.

    Sources

  • CISA Details Critical Authentication Flaws in Monta EV Charging Platform

    CISA Details Critical Authentication Flaws in Monta EV Charging Platform

    CISA has disclosed four vulnerabilities affecting Monta’s electric-vehicle charging platform. The agency says the issues could allow unauthorized administrative actions or denial-of-service activity, making identity controls and session handling a priority for charging operators.

    Where the weaknesses appear

    The advisory identifies missing authentication and rate-limiting controls, weaknesses involving sessions, and the use of publicly accessible identifiers. CISA assigns the group a maximum CVSS v3 base score of 9.4 and lists monta.app as affected across all versions at the time of publication.

    The practical risk extends beyond a conventional web account. EV charging platforms coordinate users, chargers and operational services, so unauthorized administrative access can affect a distributed physical service. CISA says it is not aware of public exploitation targeting these vulnerabilities.

    Mitigation and operational checks

    Monta is working toward authenticated connections and says its platform supports OCPP 1.6 Security Profile 2. The company also applies throttling and rate limits. Operators should confirm which controls are active in their own tenant and charger estate instead of assuming that a supported feature is already enabled everywhere.

    Security teams should review privileged accounts, revoke stale sessions, monitor failed authentication patterns and segment charger-management services from unrelated business systems. Any configuration change should be tested against charger availability and field-support procedures. Related developments in connected transport can be followed through SectechMedia’s vehicle and transportation security coverage.

    Sources

  • CISA Warns Armatura One Flaws Could Expose Physical Access-Control Systems

    CISA Warns Armatura One Flaws Could Expose Physical Access-Control Systems

    The US Cybersecurity and Infrastructure Security Agency has published an advisory covering several vulnerabilities in Armatura One, a platform used to administer physical access-control systems. CISA says successful exploitation could expose database information, enable code execution or allow an attacker to take control of access-control functions.

    Affected versions and security impact

    The advisory covers Armatura One versions earlier than 4.7.2 and the US edition earlier than 4.6.1. The reported issues include embedded ActiveMQ vulnerability CVE-2023-46604 as well as four newly assigned CVEs affecting the platform. CISA lists a maximum CVSS v3 base score of 9.8.

    The agency notes that CVE-2023-46604 appears in its Known Exploited Vulnerabilities catalog because it has been used against other products. CISA says it is not aware of public exploitation specifically targeting Armatura One. That distinction matters: operators should treat the exposure seriously without assuming that every installation has already been compromised.

    What access-control operators should do

    Armatura recommends upgrading to version 4.7.2, or 4.6.1_USA for the US edition. Owners should first inventory management servers, restrict administrative interfaces to trusted networks and preserve configuration backups before changing production systems.

    Because the platform can influence doors and credentials, remediation should be coordinated with physical-security teams, not handled as an isolated IT patch. Administrators should also review service accounts, database access and logs for unexpected changes. SectechMedia’s access-control and identity coverage provides additional context for securing controller and credential-management environments.

    Sources

  • Network Segmentation Verification for Physical Security Systems

    Network Segmentation Verification for Physical Security Systems

    Network diagrams often show physical security systems in carefully separated zones, but a diagram does not prove that the controls work. Firewall drift, temporary maintenance rules, dual-homed servers and unmanaged switches can reconnect networks that were intended to remain isolated. Segmentation verification tests the deployed paths rather than trusting the design document.

    Define zones and permitted flows

    Start with functional zones such as field devices, controllers, recording, management, operator clients, integration services and remote support. For each pair of zones, document the exact allowed source, destination, protocol and business purpose. Everything else should be denied by default where the architecture permits.

    Include dependencies that are easy to overlook: DNS, NTP, certificate enrollment, directory services, software repositories, email relays and monitoring. An incomplete allowlist can push teams toward broad emergency rules that later become permanent.

    Verify from representative endpoints

    Testing should originate from actual device classes or safe equivalents. A scan from the IT network cannot prove what an embedded camera or controller can reach. Confirm intended connections, then attempt prohibited paths in a controlled manner. Review both the client result and the firewall or switch log so silent drops and routing failures can be distinguished.

    NIST’s operational-technology security guidance recommends segmentation and controlled communication paths as central risk-reduction measures. Physical security networks share many of the same constraints: long-lived devices, vendor protocols, availability requirements and limited endpoint protection.

    Test management and vendor access separately

    Administrative paths deserve stricter validation than ordinary event traffic. Confirm that device management is limited to approved jump hosts, named users and monitored sessions. Test whether vendor VPN access can reach only the contracted systems and whether access is disabled outside approved windows.

    Check for alternate paths through Wi-Fi, cellular modems, secondary network interfaces and service laptops. A controller isolated on the primary interface may still expose a management service through an overlooked channel. SectechMedia’s article on access-control cybersecurity hardening covers related device and credential controls.

    Include failure and recovery states

    Segmentation may change during failover. Test redundant firewalls, backup links, disaster-recovery sites and temporary routing used during maintenance. Confirm that a failed security appliance does not default to an unrestricted path and that restored configurations preserve the approved policy.

    Record packet captures or log evidence for critical tests. A simple pass/fail worksheet is insufficient when a rule later changes or an incident team needs to understand historical reachability.

    Manage exceptions as expiring risks

    Every exception should identify the owner, reason, compensating controls and expiry date. Re-test after firmware upgrades, VMS migrations, controller replacements and network redesigns. Track unexpected reachable paths, stale rules and assets outside their assigned zone. The result should be a living verification program that detects architectural drift before an attacker or outage exposes it.

    Reference sources

  • CISA Warns Malformed Radio Message Can Disrupt Baicells Nova 430H Service

    CISA Warns Malformed Radio Message Can Disrupt Baicells Nova 430H Service

    CISA has issued an industrial control systems advisory for a vulnerability affecting the Baicells Nova 430H eNodeB. The agency says an unauthenticated device within radio range can send a malformed uplink message during connection setup and trigger temporary loss of signaling for the affected cell.

    Invalid signaling can affect availability

    The issue is tracked as CVE-2026-96274 and affects the Nova 430H model pBS3101SH at the versions identified by CISA. According to the advisory, the eNodeB does not adequately validate an invalid NAS payload before forwarding it to the core network. The resulting condition can shut down the signaling association until connectivity is re-established. CISA rates the issue High and says no public exploitation specifically targeting it has been reported.

    Reduce exposure and plan around service risk

    CISA states that no fix was planned at publication time and advises affected users to contact the vendor. Operators should inventory deployed versions, restrict management exposure, monitor signaling interruptions and evaluate compensating controls with the network provider. Because exploitation requires radio proximity rather than ordinary remote internet access, physical coverage and access around sites also belong in the risk review. SectechMedia’s guide to network redundancy for IP security systems explains why recovery paths and tested failover are important when communications infrastructure can be disrupted.

    Sources

  • FBI and CISA Warn Critical Infrastructure Operators About ICS Integrator Access

    FBI and CISA Warn Critical Infrastructure Operators About ICS Integrator Access

    The FBI and the Cybersecurity and Infrastructure Security Agency issued guidance on September 23 about cybersecurity risks created when third-party industrial control system integrators receive access to critical-infrastructure environments. The agencies urged operators to treat integrator connections as governed, monitored access paths rather than permanent trusted links.

    A provider breach exposed customer information

    According to the guidance summarized by Security Today, a 2025 breach of a US industrial automation provider affected an organization serving power and transportation customers. Foreign actors searched the provider network for customer and supervisory control and data acquisition material, then placed hundreds of items into compressed archives.

    The episode illustrates how a compromise at one engineering or support company can create visibility into multiple operators. Drawings, device information and customer SCADA data can help attackers understand industrial environments even when they have not yet reached an operational network.

    Access should be limited and observable

    The agencies recommended limiting each integrator to the access required for its work, recording remote sessions and documenting supplied technology. Contracts should define cybersecurity obligations, while operators should maintain offline copies of software needed to run equipment and prepare for a provider becoming unavailable.

    Organizations should also review dormant accounts, shared credentials, remote-access gateways and support pathways after projects end. These controls align supplier governance with technical segmentation and operational resilience. The warning is especially relevant to SectechMedia readers responsible for Industrial Safety & Monitoring, where maintenance access can cross the boundary between business systems and essential processes.

    Sources

  • CISA Election Security Plan Highlights Patching and Voter-Database Risks

    CISA Election Security Plan Highlights Patching and Voter-Database Risks

    The Cybersecurity and Infrastructure Security Agency has published its 2026 election security plan, outlining operational risks and federal support priorities for state and local election organizations. The plan treats elections as a distributed critical-infrastructure environment in which technology, physical processes and public communications must remain resilient together.

    Patching and voter databases remain central concerns

    CISA notes that election offices can face practical barriers to patching systems during active election periods, when changes may disrupt testing or certified configurations. The plan also emphasizes risks to voter-registration databases, including unauthorized access, service disruption and manipulation attempts. Recommended support includes vulnerability information, incident coordination, exercises and resources tailored to election administrators.

    The document also addresses physical security, continuity planning and the need to communicate quickly when technical incidents or false claims could undermine confidence. Responsibility remains shared among local, state and federal organizations rather than concentrated in one platform.

    Controls need evidence before election day

    Election authorities should maintain tested offline recovery, privileged-access review, logging and clear change windows. Tabletop exercises should connect cyber teams with physical-security, communications and legal functions. SectechMedia tracks this combined risk in its cyber-physical security coverage.

    Sources