Energy Industry Intelligence

Energy sector cybersecurity is a matter of national security, with power grids, pipelines, and utility systems representing critical infrastructure targets for nation-state actors. Industrial control systems and operational technology in energy environments face specialized threats. defend.network tracks threats to the energy sector including ICS/SCADA vulnerabilities, nation-state targeting, and regulatory developments.

OpenSSH Alpine bypass, refrigeration attacks, critical Linux exploits disclosed

OpenSSH flaw allows password-bypasses on Alpine Linux; FBI/CISA warn of active refrigeration system attacks; OpenAI demonstrates 948 Linux kernel privilege escalation exploits.

Flax Typhoon infrastructure seized; Cisco NX-OS RCE patches released

FBI-led international coalition seized Flax Typhoon's MicroScan and FishHub hacking tools. Cisco patched critical NX-OS RCE flaws. Android devices ship with Midnight Mimosa firmware malware enabling proxy abuse.

Critical RCEs in GitLab, Dell CSM, SharePoint; Warlock ransomware escalates

GitLab patches critical AI Gateway RCE; Dell CSM flaws grant unauthenticated root access on Kubernetes; Warlock ransomware expands SharePoint exploitation across critical infrastructure in multiple countries.

Cisco SEG SQL injection joins KEV; Acronis Linux flaw exploited; banking malware targets browsers

Cisco Secure Email Gateway SQL injection added to CISA KEV; Acronis cPanel plugin flaw exploited; Brazilian banking malware KREMLIN targets Chrome and Edge for session theft.

Microsoft Copilot, MLflow, and Windows Task Host under attack; ransomware exploitation confirmed

Microsoft Copilot Personal one-click data exfiltration flaws disclosed. MLflow and FUXA critical vulnerabilities exploited for cloud credential theft. Windows Task Host now actively exploited by ransomware gangs.

Kimsuky's AI warfare, StormEncryptor ransomware, water infrastructure targeted by Iran

Kimsuky deploys offline AI for phishing and malware automation; StormEncryptor emerges from Medusa affiliate; Iran-linked actors target 12+ U.S. water systems via exposed PLCs.

Critical zero-days in Rails, Ruflo, VMware; Laundry Bear exploits Exchange OWA

Ruby on Rails, Ruflo AI agent framework, and VMware ESX disclosed with maximum-severity RCE flaws; Russian Laundry Bear group actively exploits Exchange OWA zero-day; coordinated attack hits 30+ Minnesota water systems.

Critical Exploits: npm Supply Chain, WordPress Plugin, SolarWinds, IIS Attacks

IronWorm and Miasma worms actively distributed via 50+ poisoned npm packages; WordPress Everest Forms Pro (CVE-2026-3300) exploited for RCE on 4,000 sites; SolarWinds Serv-U flaw weaponized for DoS; 900+ US fuel tank gauges exposed and under attack.

Google Gemini prompt injection, Microsoft 365 token theft, Redis RCE patched

Google Gemini voice assistant hijackable via poisoned notifications; Microsoft 365 Android apps leak tokens; Redis RCE (CVE-2026-23479) patched; critical fuel tank systems under active attack.

BitLocker zero-day PoCs public; Exchange APT; Foxconn breached

Critical BitLocker zero-days with public PoCs, Microsoft Exchange APT exploitation, Canvas ransomware attack on education sector, and Foxconn manufacturing compromise create immediate operational risks across multiple industries.

Docker & npm supply-chain hits; Lotus Wiper on Venezuelan energy

Critical supply chain attacks via malicious Docker images and npm worms, state-sponsored credential theft campaigns targeting Microsoft Office, and destructive Lotus Wiper malware deployed against Venezuelan energy infrastructure require immediate response across all organizations.

Iran PLC attacks; Marimo RCE exploited in 10h; GlassWorm IDE infection

Critical threats span Iranian PLC targeting, Russian token harvesting, Marimo RCE exploitation within 10 hours, and GlassWorm IDE infections. Immediate patching and detection deployment required.

Vulnerability Report – Week 4 of October 2026

This week's primary focus is CVE-2026-111357 affecting Ivanti Connect Secure, which CISA confirms is under active exploitation and has been added to the Known Exploited Vulnerabilities catalog with a

Vulnerability Report – Week 1 of October 2026

This week's verified CVE coverage is limited to a single explicitly identified vulnerability affecting Grid Protection Alliance openPDC and openHistorian. CISA advisories reference multiple OT product

Vulnerability Report – Week 4 of September 2026

This week's threat landscape is dominated by active exploitation of Microsoft SharePoint vulnerabilities by the China-linked Warlock ransomware group targeting critical infrastructure, government, and

Vulnerability Report – Week 4 of July 2026

This week's verified vulnerability landscape is dominated by a critical Adobe Campaign Classic flaw (CVSS 10.0) requiring immediate patching. Chrome and Rails patches addressed hundreds of flaws in ag

Vulnerability Report – Week 5 of June 2026

This week's verified CVE activity is light, with only two explicitly identified vulnerabilities in the source material. The most urgent priority is CVE-2026-45659, which CISA reports as actively explo

Vulnerability Report – Week 4 of June 2026

This week features three verified CVEs with explicit IDs across kernel, development tools, and enterprise systems. CVE-2026-46331 (Linux pedit) poses immediate risk to local systems with a public expl

Vulnerability Report – Week 22 of May 2026

This week's verified threat landscape is dominated by three actively exploited vulnerabilities affecting web platforms and infrastructure. CVE-2026-48172 in LiteSpeed cPanel Plugin poses immediate ris

Vulnerability Report – Week 3 of May 2026

This week presents an exceptionally high-risk threat landscape with multiple critical vulnerabilities under active exploitation across infrastructure, enterprise, and open-source ecosystems. Immediate

Vulnerability Report – Week 2 of May 2026

This week marks a significant surge in actively exploited vulnerabilities, with three critical flaws requiring immediate patching across IT infrastructure and OT systems. The Ollama out-of-bounds read

Vulnerability Report – Week 1 of May 2026

This week presents an exceptionally high-risk threat landscape dominated by active exploitation campaigns and critical infrastructure vulnerabilities. Federal agencies face an immediate Sunday deadlin

Vulnerability Report – Week 4 of April 2026

This week presents elevated risk from actively exploited vulnerabilities across network infrastructure, IoT devices, and enterprise software. Immediate patching is required for Cisco Firepower/ASA dev

Vulnerability Report – Week 3 of April 2026

This week presents elevated risk across OT/ICS sectors with multiple critical RCE vulnerabilities in industrial control systems and emerging threats to cloud infrastructure. Active exploitation of Mic

Vulnerability Report – Week 2 of April 2026

This week presents an elevated threat landscape dominated by actively exploited critical vulnerabilities in both IT and OT environments. Iranian-affiliated threat actors are actively targeting US crit

Vulnerability Report – Week 1 of April 2026

This week presents elevated risk with five critical vulnerabilities actively exploited in the wild, including FortiClient EMS and video conferencing systems requiring immediate patching. Organizations

Vulnerability Report – Week 5 of March 2026

This week reflects sustained critical threats across OT/ICS and enterprise systems with multiple actively exploited vulnerabilities. F5 BIG-IP APM (CVE-2025-53521) and Citrix NetScaler (CVE-2026-3055)