[siemens]

October 27, 2026

• CISA added CVE-2026-109618 and CVE-2026-109619 to KEV on October 26, moving PHP2Shell from scanning and attempt data to an official exploited designation, with a federal remediation deadline attached (@DailyDarkWeb). SecurityWeek reports attackers launched 35 shells from two IP addresses against honeypots on October 24 (SecurityWeek), and Delft Threat Intelligence Lab's public dashboard counted ~54,974 requests from 608 source IPs across 70 countries since October 21, of which 171 IPs delivered code or droppers (@DailyDarkWeb). Siemens, Schneider Electric and ABB have confirmed affected products (SecurityWeek) (earlier coverage). · Vulnerabilities & Exploits

in Brotli's Blast Radius Widens as PHP2Shell Lands on KEV

August 20, 2026

• NSA, FBI and CISA say attackers are using AI to generate exploit scripts against Siemens S7-series PLCs, combining AI-assisted development with exploitation of known ICS vulnerabilities. Agencies stress this is "not a theoretical risk," and the framing matters for defenders: the interesting claim isn't novel capability but collapsed time-and-skill cost for attacking industrial controllers in energy, water, and manufacturing (The Record, BleepingComputer, The Register). · Critical Infrastructure & AI-Assisted Offense

in Feds Say AI-Written Exploit Code Is Already Hitting Siemens PLCs