Understand
the threat.
We put current incidents, vulnerabilities and regulation into context for operators of industrial and IT systems. Industry news always links to the original source.
CRA reporting: what manufacturers must do since 11 September
The Cyber Resilience Act only fully applies from December 2027. Its reporting duties are already in force, including for products sold long ago. An overview for machine builders and device makers.
Read more
Fridges as a target: what the Danfoss incident teaches about legacy devices
Hundreds of supermarkets, spoiled goods and a vendor pointing to outdated firmware. The attack of 12 October shows a problem hidden in almost every plant.
Ahold Delhaize takes its network offline after cyberattack
The Dutch retail group detected a security incident and disconnected systems as a precaution. In the US, websites and apps of chains such as Stop & Shop, Hannaford and Food Lion went down. The company says it has seen no evidence so far that personal data was taken.
Source: this week in securityAttack on refrigeration systems hits European supermarkets
On the night of 11 to 12 October, attackers manipulated refrigeration controllers in hundreds of stores, mainly in France. Defrost cycles ran non-stop and goods spoiled. CERT-FR names compromised Danfoss AK-SM and AK-SC units whose management interface was reachable from the internet.
Source: SecurityWeek
PLCs on the internet: five immediate steps after the 2026 attacks
Since April, US agencies have been warning about targeted attacks on internet-reachable controllers. What is behind it and what you can implement within a week.
FortiBleed: why firewall credentials put the whole plant at risk
Over 86,000 compromised FortiGate devices without a new vulnerability. The campaign shows how much depends on a single password.
FBI warns: FortiBleed campaign affects over 86,000 FortiGate devices
The FBI and US Secret Service warn of ongoing attacks on FortiGate firewalls. SOCRadar counts 86,644 compromised devices in 194 countries. Attackers use credential stuffing and password spraying with credentials from earlier leaks. Fortinet considers the data to be largely an aggregation of past incidents.
Source: HackreadEuropol takes down KillSec ransomware infrastructure
Investigators seized the leak site and five core servers. Europol links the group to around 1,000 suspected attacks and has identified an allegedly teenage administrator.
Source: NetworkTigers / SecurityWeekCitrix NetScaler: two zero-days actively exploited
Citrix confirms exploitation of CVE-2026-88771 and CVE-2026-88772 in NetScaler ADC and Gateway. The flaws can allow unauthenticated code execution, often on exactly the systems that handle remote access.
Source: NetworkTigers / watchTowrCyber Resilience Act: reporting duty for manufacturers has started
Since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents. Reports go through ENISA’s CRA-SRP platform; in Germany the coordinating CSIRT is CERT-Bund at the BSI.
Source: BSINIS2: grace period for BSI registration has ended
The regular registration deadline ended on 6 March 2026; the BSI granted a grace period until 31 July. Late registration is still possible and strongly advised, as failing to register is a separate administrative offence.
Source: SECJURUS agencies warn of attacks on internet-exposed PLCs
FBI, CISA, NSA, EPA, DOE and US Cyber Command report attacks on internet-reachable controllers, mainly from Rockwell Automation. The actors altered project files and HMI displays. The activity resembles earlier campaigns by an IRGC-linked group.
Source: SecurityWeekIndustry news items are summaries of public reports. Figures and attributions come from the linked sources and may change as new information emerges.