grep -rl "ics" ./articles
Forescout gave Claude a terminal, Ghidra and a live industrial controller, and it adapted a pre-auth RCE from one WAGO model to another. It also bricked the device. The lab's own conclusion is that a human would have done it quicker and cheaper today — which makes the finding a statement about a slope, not a capability.
The NSA, CISA, FBI, Department of Energy and EPA issued a joint advisory on Siemens S7 controllers. The exploitation scripts are Python built on snap7, they masquerade as legitimate OT monitoring tools, and they give read and write access to PLC memory and ladder logic. The assessed purpose is not disruption yet — it is being ready for it.
CERT Polska's report on a December 2025 intrusion at a Polish CHP plant describes what it calls the first real-world use of a private APN as an attack path. The controller they landed on still had its default admin password.