#critical-infrastructure

2 articles

Attackers walked from a wind farm to a heat plant's turbine over a private cellular network

2026-08-12Security

CERT Polska's report on a December 2025 intrusion at a Polish CHP plant describes what it calls the first real-world use of a private APN as an attack path. The controller they landed on still had its default admin password.

Thirty water systems were disrupted without exploiting a single vulnerability

2026-08-10Security

Attackers changed passwords and IP addresses on controllers that were already reachable from the internet, locking operators out and triggering boil-water notices. Forescout then found 4,407 exposed Rockwell PLCs worldwide — most of them on mobile carrier networks.