Today’s threat landscape is dominated by a dual assault on operational technology and enterprise communications. Iranian-affiliated advanced persistent threat (APT) actors are actively exploiting internet-facing programmable logic controllers (PLCs) across U.S. critical infrastructure, while a critical Cisco flaw with available proof-of-concept (PoC) exploit code demands immediate patching. These threats, combined with a sophisticated npm supply chain attack and credential-harvesting campaigns, create a multi-vector risk environment requiring decisive action.

Critical Infrastructure in the Crosshairs

A coordinated campaign by Iran-affiliated APT actors is targeting internet-exposed Rockwell Automation/Allen-Bradley PLCs, including ControlLogix and CompactLogix models. These devices are foundational to industrial control systems (ICS) in sectors like energy, manufacturing, and water treatment. The actors exploit weak authentication and exposed services to gain initial access, potentially enabling sabotage, espionage, or disruptive ransomware deployment. The advisory underscores the severe consequence of such attacks: direct manipulation of physical processes. Organizations must immediately audit for internet-facing PLCs, remove them from direct internet access, or place them behind properly configured industrial firewalls like the Cisco ISA-3000 or Palo Alto Networks NGFW with OT security subscriptions.

Patch Now: Critical Cisco Flaw with PoC in the Wild

Cisco has issued an urgent warning for a critical-severity privilege escalation vulnerability in its Unified Communications Manager (Unified CM). The flaw allows unauthenticated attackers to gain root privileges on affected systems. The availability of public proof-of-concept exploit code significantly raises the risk of widespread exploitation. This is not a theoretical threat; it is an active, weaponized vulnerability targeting a core enterprise communications platform. The recommended action is unambiguous: immediately patch all Cisco Unified CM instances to the versions specified in Cisco’s security advisory. If patching cannot be performed instantly, implement strict network access control lists (ACLs) to restrict administrative access (SSH, HTTPS) to trusted management networks only.

Supply Chain Sabotage and Credential Theft

The software supply chain remains a high-value target. A large-scale npm attack compromised over 90 versions of official @redhat-cloud-services packages, silently infecting CI/CD pipelines and developer workstations. The malicious code, dubbed “Miasma,” acts as a credential-stealing worm, harvesting GitHub tokens, cloud API keys, and SSH keys before repackaging and republishing tainted libraries. Concurrently, a five-month-long intrusion into a major stock exchange executive’s Outlook mailbox demonstrates the persistence of credential-focused espionage. Attackers used Dropbox and OneDrive to exfiltrate data in small batches, blending malicious traffic with legitimate cloud activity.

Defenses must be layered. For the npm attack, immediately audit CI/CD systems for the compromised @redhat-cloud-services packages, revoke and rotate all exposed credentials, and enforce package allowlisting. For cloud email compromise, enable Microsoft 365 Defender alerts for ‘Suspicious Email Forwarding’ and enforce Conditional Access policies with multi-factor authentication (MFA) number matching for all privileged accounts.

Web Services and Endpoint Vulnerabilities Demand Attention

Several other high-priority vulnerabilities require targeted mitigation. A path traversal flaw in Navtor’s NavBox (CVE-2026-2753) allows unauthenticated remote attackers to read arbitrary files via a poorly sanitized HTTP service. Apply vendor patches immediately or deploy a web application firewall (WAF) to block requests containing absolute path sequences. Furthermore, widespread misconfigurations of WebSocket endpoints, particularly in Open Charge Point Protocol (OCPP) implementations for electric vehicle charging stations (CVE-2026-26051), allow station impersonation and data manipulation. Implement TLS client certificate authentication and network segmentation for these critical OT-adjacent systems.

Organizations must prioritize actions based on immediate exploitability and potential impact. The Iranian PLC campaign and the weaponized Cisco flaw represent clear and present dangers to national infrastructure and enterprise integrity. Simultaneously, the software supply chain and credential theft campaigns erode trust and create long-term persistence risks for attackers. A reactive posture is insufficient; proactive hardening, segmentation, and credential management are non-negotiable components of a modern defense strategy.