Manufacturing Industry Intelligence

Manufacturing organizations face growing cybersecurity risks as operational technology converges with IT networks. Ransomware attacks on production systems, intellectual property theft, and supply chain compromises can halt operations and cause significant financial damage. defend.network tracks threats to manufacturing environments including ICS vulnerabilities and industry-specific attack campaigns.

Microsoft Copilot, MLflow, and Windows Task Host under attack; ransomware exploitation confirmed

Microsoft Copilot Personal one-click data exfiltration flaws disclosed. MLflow and FUXA critical vulnerabilities exploited for cloud credential theft. Windows Task Host now actively exploited by ransomware gangs.

Browser-assembled malware, GitLab RCE exploit public, PTC manufacturing under attack

SourTrade malvertising fragments Windows executables for in-browser assembly; GitLab RCE PoC published; Cl0p affiliates exploit unauthenticated PTC manufacturing flaws for data extortion.

Fastjson RCE under attack, no patch; GitLab exploit public; PTC manufacturing targeted

Fastjson 1.x (Java JSON library) actively exploited with no vendor patch; GitLab RCE exploit published; Cl0p affiliates targeting internet-exposed PTC Windchill/FlexPLM for data extortion.

Iran PLC attacks; Marimo RCE exploited in 10h; GlassWorm IDE infection

Critical threats span Iranian PLC targeting, Russian token harvesting, Marimo RCE exploitation within 10 hours, and GlassWorm IDE infections. Immediate patching and detection deployment required.

Vulnerability Report – Week 1 of November 2026

Two maximum-severity vulnerabilities (CVSS 10.0) are under active exploitation: CVE-2026-58115 affecting Siemens SIMATIC IoT2050 Advanced devices and CVE-2026-81648 in the CryptoPayment Gateway WordPr

Vulnerability Report – Week 4 of October 2026

This week's primary focus is CVE-2026-111357 affecting Ivanti Connect Secure, which CISA confirms is under active exploitation and has been added to the Known Exploited Vulnerabilities catalog with a

Vulnerability Report – Week 4 of September 2026

This week's threat landscape is dominated by active exploitation of Microsoft SharePoint vulnerabilities by the China-linked Warlock ransomware group targeting critical infrastructure, government, and

Vulnerability Report – Week 4 of August 2026

This week saw three confirmed critical vulnerabilities with active exploitation: CVE-2023-49105 (ownCloud) was added to CISA's Known Exploited Vulnerabilities catalog after targeting a nuclear researc

Vulnerability Report – Week 3 of August 2026

This week saw multiple CVEs added to CISA's Known Exploited Vulnerabilities catalog with confirmed active exploitation, including CVE-2026-73570, CVE-2026-72529, CVE-2026-64849, and CVE-2026-33824. Ad

Vulnerability Report – Week 2 of August 2026

Three critical vulnerabilities require immediate attention this week. CVE-2026-55040 (Microsoft SharePoint) and CVE-2026-59310 (VMware vCenter) are confirmed under active exploitation following PoC re

Vulnerability Report – Week 1 of August 2026

CVE-2026-8037 in Progress Kemp LoadMaster represents a critical command injection flaw with 792+ reported exploit attempts. Organizations should prioritize patching known exploited vulnerabilities and

Vulnerability Report – Week 4 of July 2026

This week's verified vulnerability landscape is dominated by a critical Adobe Campaign Classic flaw (CVSS 10.0) requiring immediate patching. Chrome and Rails patches addressed hundreds of flaws in ag

Vulnerability Report – Week 3 of July 2026

This week's verified CVE coverage is limited to one explicitly identified vulnerability: but lacked explicit CVE identifiers in the provided summaries. Additional threats include GitLab authenticated

Vulnerability Report – Week 2 of July 2026

Multiple operational technology products from Rockwell Automation and related vendors were disclosed by CISA with privilege escalation and code execution impacts, though CVE IDs were not fully specifi

Vulnerability Report – Week 5 of June 2026

This week's verified CVE activity is light, with only two explicitly identified vulnerabilities in the source material. The most urgent priority is CVE-2026-45659, which CISA reports as actively explo

Vulnerability Report – Week 4 of June 2026

This week features three verified CVEs with explicit IDs across kernel, development tools, and enterprise systems. CVE-2026-46331 (Linux pedit) poses immediate risk to local systems with a public expl

Vulnerability Report – Week 3 of June 2026

This week's verifiable vulnerability landscape is limited to two explicitly identified CVEs. and should be treated as actively exploited. CVE-2026-4020 affecting the Gravity SMTP WordPress plugin is b

Vulnerability Report – Week 3 of May 2026

This week presents an exceptionally high-risk threat landscape with multiple critical vulnerabilities under active exploitation across infrastructure, enterprise, and open-source ecosystems. Immediate

Vulnerability Report – Week 2 of May 2026

This week marks a significant surge in actively exploited vulnerabilities, with three critical flaws requiring immediate patching across IT infrastructure and OT systems. The Ollama out-of-bounds read

Vulnerability Report – Week 1 of May 2026

This week presents an exceptionally high-risk threat landscape dominated by active exploitation campaigns and critical infrastructure vulnerabilities. Federal agencies face an immediate Sunday deadlin

Vulnerability Report – Week 4 of April 2026

This week presents elevated risk from actively exploited vulnerabilities across network infrastructure, IoT devices, and enterprise software. Immediate patching is required for Cisco Firepower/ASA dev

Vulnerability Report – Week 3 of April 2026

This week presents elevated risk across OT/ICS sectors with multiple critical RCE vulnerabilities in industrial control systems and emerging threats to cloud infrastructure. Active exploitation of Mic

Vulnerability Report – Week 2 of April 2026

This week presents an elevated threat landscape dominated by actively exploited critical vulnerabilities in both IT and OT environments. Iranian-affiliated threat actors are actively targeting US crit

Vulnerability Report – Week 1 of April 2026

This week presents elevated risk with five critical vulnerabilities actively exploited in the wild, including FortiClient EMS and video conferencing systems requiring immediate patching. Organizations

Vulnerability Report – Week 5 of March 2026

This week reflects sustained critical threats across OT/ICS and enterprise systems with multiple actively exploited vulnerabilities. F5 BIG-IP APM (CVE-2025-53521) and Citrix NetScaler (CVE-2026-3055)

Vulnerability Report – Week 3 of March 2026

This week demands immediate attention. Two actively exploited vulnerabilities (VMware ESXi and FortiOS) require emergency patching. Organizations using Windows Server should prioritize the kernel priv