📋 ADVISORIES
WaterISAC flags exposed OT, PLCs and integrators as water sector threats mount
WaterISAC says internet-exposed OT and PLCs remain the water sector's biggest weaknesses as cyberattacks mounted this summer, and announced a threat-sharing partnership with Cyware.- Applies to U.S. water and wastewater utilities, especially the smallest systems served via WaterISAC's partnership with the National Rural Water Association covering 20,000 utilities.
- Most vulnerable: internet-exposed operational technology and aging programmable logic controllers, which were the main point of entry in this summer's attacks and were designed before cyber threats existed.
- Other attack paths: unmanaged connections through outside integrators and phishing of employees; smaller utilities struggle with basics like password changes and MFA.
- Threats come from Iran — reportedly behind this summer's water facility attacks per CISA, though President Trump has disputed that — as well as China and Russia.
- WaterISAC is partnering with Cyware's threat intelligence platform to speed up threat sharing and enable cross-sector sharing with other ISACs.
📄 Source for OpenSSL Patches High-Severity DTLS Flaw (CVE-2026-84782) That Leaks Heap Memory — openssl-library.org
📄 Source for Pentagon DMDC breach exposed personal data of over three million people for nine months — abcnews.com
🔓 CVEs & KEV
CVE-2026-77185 — Apache Software Foundation Apache MINA SSHD — CVSS 9.1 — Apache MINA SSHD: Asynchronous authentication can bypass signature verificati...
CVE-2026-94053 — Apache Software Foundation Apache MINA SSHD — CVSS 9.1 — Apache MINA SSHD: LDAP injection in sshd-ldapAuthentication bypass via LDAP i...
CVE-2026-94052 — Apache Software Foundation Apache MINA SSHD — CVSS 9.1 — Apache MINA SSHD: LDAP password authentication ineffectiveA missing check in ...
CVE-2026-93994 — Apache Software Foundation Apache MINA SSHD — CVSS 8.1 — Apache MINA SSHD: Repeated-publickey policy bypass on serverApache MINA SSHD ...
CVE-2026-94002 — Apache Software Foundation Apache MINA SSHD — CVSS 7.5 — Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP repli...
CVE-2026-93995 — Apache Software Foundation Apache MINA SSHD — CVSS 6.5 — Apache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write fi...
CVE-2026-93996 — Apache Software Foundation Apache MINA SSHD — CVSS 6.5 — Apache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line readUn...
CVE-2026-94029 — Apache Software Foundation Apache MINA SSHD — CVSS 6.5 — Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-han...