✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Food Production
Breach intelligence, attack campaigns, and threat reports targeting the Food Production sector.
Explore Other Sectors
Food Production Threat Reports
CISA Issues Warning on Cyberattacks Targeting Fuel Tank Monitoring Systems
In June 2026, the Cybersecurity and Infrastructure Security Agency (CISA), along with the FBI, NSA, and Department of Energy, issued a warning about cyberattacks targeting internet-exposed automatic tank gauge (ATG) systems used to monitor fuel and liquid storage tanks across critical infrastructure sectors. Attackers exploited vulnerabilities such as authentication bypasses, hardcoded credentials, and command-execution flaws to gain unauthorized access, allowing them to alter network settings, tank volumes, and pump controls. This manipulation could disable alerts and hinder operators from accurately monitoring tank levels, increasing the risk of leaks or equipment failures. This incident underscores the growing threat to operational technology (OT) systems within critical infrastructure. The exploitation of ATG systems highlights the need for enhanced cybersecurity measures, including restricting internet exposure, implementing strong authentication protocols, and applying timely security updates to prevent unauthorized access and potential operational disruptions.
1 month ago
Kill Chain
Urgent Advisory: Securing Automatic Tank Gauge Systems Against Cyber Threats
In April 2026, the Cybersecurity and Infrastructure Security Agency (CISA), along with multiple federal partners, issued an urgent advisory regarding active cyberattacks targeting Automatic Tank Gauge (ATG) systems across the United States. These systems, integral to monitoring fuel storage tanks in sectors such as Energy, Chemical, Food and Agriculture, and Transportation, were found to be vulnerable due to internet exposure and weak authentication mechanisms. Threat actors exploited these weaknesses to gain unauthorized access, potentially allowing them to manipulate tank levels, disable alarms, and disrupt operations. While no physical damage was reported, the incidents underscored significant cybersecurity gaps in critical infrastructure. ([infoodandfuel.org](https://www.infoodandfuel.org/news/cybersecurity-alert-automatic-tank-gauge-systems-targeted?utm_source=openai)) This advisory highlights the escalating threat landscape for operational technology (OT) systems, emphasizing the need for immediate action to secure ATG systems. The incidents serve as a stark reminder of the vulnerabilities present in internet-exposed OT devices and the potential for malicious actors to exploit these weaknesses to disrupt essential services.
1 month ago
Kill Chain
Critical Vulnerability in ABB CoreSense Products: CVE-2025-3465
In October 2025, ABB disclosed a path traversal vulnerability (CVE-2025-3465) in its CoreSense™ HM and CoreSense™ M10 products, affecting versions up to 2.3.1 and 1.4.1.12, respectively. This flaw allows unauthenticated users to access restricted directories, potentially leading to complete system compromise and exposure of sensitive information. ABB has released updates to address this issue and recommends that customers apply them promptly. This incident underscores the critical importance of timely vulnerability management in industrial control systems. As cyber threats targeting critical infrastructure continue to evolve, organizations must remain vigilant and proactive in applying security patches to mitigate potential risks.
2 months ago
Kill Chain
Critical Vulnerability in Siemens gWAP: CVE-2026-40175
In May 2026, Siemens disclosed a critical vulnerability (CVE-2026-40175) in its gPROMS Web Applications Publisher (gWAP), stemming from the integration of a vulnerable version of the Axios HTTP client library. This flaw allows attackers to exploit prototype pollution in third-party dependencies, potentially leading to remote code execution or full cloud environment compromise. Siemens has released version 3.1.1 to address this issue and strongly recommends users update immediately. This incident underscores the risks associated with third-party software components in supply chains. Organizations must remain vigilant, ensuring all integrated libraries are up-to-date and secure to prevent similar vulnerabilities from being exploited.
2 months ago
Kill Chain
Yokogawa CENTUM VP Hardcoded Password Vulnerability Exposes Industrial Systems
In March 2026, a hardcoded password vulnerability (CVE-2025-7741) was identified in Yokogawa's CENTUM VP distributed control system. This flaw allows attackers with access to the Human Interface Station (HIS) to log in using the 'PROG' user account, potentially modifying system permissions. Affected versions include CENTUM VP R5.01.00 to R5.04.20, R6.01.00 to R6.12.00, and R7.01.00. Exploitation requires prior access to the HIS screen controls, limiting the immediate risk but highlighting significant security concerns in industrial control systems. ([cvedetails.com](https://www.cvedetails.com/cve/CVE-2025-7741/?utm_source=openai)) This incident underscores the critical need for robust authentication mechanisms in industrial environments. The reliance on hardcoded credentials poses substantial risks, especially when combined with potential insider threats or physical access breaches. Organizations must prioritize updating authentication protocols and implementing comprehensive security measures to mitigate such vulnerabilities.
3 months ago
Kill Chain
Critical Vulnerabilities in Schneider Electric's Plant iT/Brewmaxx Systems: Immediate Action Required
In March 2026, Schneider Electric disclosed multiple critical vulnerabilities in its Plant iT/Brewmaxx systems, stemming from the integration of Redis, an open-source in-memory database. These vulnerabilities, identified as CVE-2025-49844, CVE-2025-46817, CVE-2025-46818, and CVE-2025-46819, involve issues such as use-after-free errors and integer overflows within Redis's Lua scripting engine. Exploitation of these flaws could allow authenticated users to execute arbitrary code, leading to potential remote code execution and privilege escalation. The affected versions include Plant iT/Brewmaxx 9.60 and above. Schneider Electric has released patches and provided mitigation steps to address these vulnerabilities. ([se.com](https://www.se.com/in/en/download/document/SEVD-2026-013-01/?utm_source=openai)) The disclosure underscores the critical importance of securing third-party components within industrial control systems. As cyber threats targeting critical infrastructure continue to evolve, organizations must remain vigilant, ensuring timely updates and adherence to cybersecurity best practices to mitigate potential risks.
4 months ago
Kill Chain
Johnson Controls 2026 Unauthenticated Remote Code Execution Vulnerabilities
In February 2026, multiple critical vulnerabilities were identified in Johnson Controls' Frick Controls Quantum HD systems, versions 10.22 and prior. These vulnerabilities include unauthenticated remote code execution, code injection, and plaintext storage of passwords, potentially allowing attackers to execute arbitrary code, access sensitive information, and compromise system integrity. The affected systems are widely deployed in critical infrastructure sectors, including food and agriculture, posing significant security risks. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-21659?utm_source=openai)) The discovery of these vulnerabilities underscores the ongoing challenges in securing industrial control systems (ICS) against sophisticated cyber threats. Organizations utilizing these systems must prioritize timely updates and adhere to recommended security practices to mitigate potential exploitation and safeguard critical operations.
4 months ago
Kill Chain
Critical Vulnerabilities in Yokogawa CENTUM VP Vnet/IP Interface Package
In February 2026, multiple vulnerabilities were identified in Yokogawa Electric Corporation's Vnet/IP Interface Package, affecting CENTUM VP R6 and R7 systems. These vulnerabilities, including CVE-2025-1924, CVE-2025-48019, CVE-2025-48020, CVE-2025-48021, CVE-2025-48022, and CVE-2025-48023, could allow attackers on adjacent networks to send maliciously crafted packets, leading to denial-of-service conditions or arbitrary code execution. The affected versions are Vnet/IP Interface Package R1.07.00 and earlier. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-48020?utm_source=openai)) The discovery of these vulnerabilities underscores the critical need for robust security measures in industrial control systems. As cyber threats targeting critical infrastructure continue to evolve, organizations must prioritize timely patching, network segmentation, and continuous monitoring to mitigate potential risks.
4 months ago
Kill Chain
Critical Security Flaws Discovered in Gardyn Home Kit: What You Need to Know
In February 2026, multiple critical vulnerabilities were identified in the Gardyn Home Kit, an AI-powered indoor gardening system. These flaws included insecure credential exchange (CVE-2025-29628), weak default SSH credentials (CVE-2025-29629), command injection vulnerabilities (CVE-2025-29631), and API credential leakage (CVE-2025-1242). Exploitation could have allowed unauthenticated users to remotely control devices, access user information, and pivot to other devices within the Gardyn cloud environment. Gardyn promptly addressed these issues by releasing firmware updates and advising users to ensure their devices were connected to the internet to receive automatic updates. ([mygardyn.com](https://mygardyn.com/blog/security-update/?utm_source=openai)) This incident underscores the growing security challenges in IoT devices, particularly those integrated into personal living spaces. The vulnerabilities highlight the importance of robust security practices in the development and maintenance of smart home technologies to prevent unauthorized access and potential data breaches.
5 months ago
Kill Chain
Critical Vulnerability in Welker OdorEyes EcoSystem Pulse Bypass System (CVE-2026-24790)
In February 2026, a critical vulnerability (CVE-2026-24790) was identified in Welker's OdorEyes EcoSystem Pulse Bypass System with XL4 Controller, widely used in gas odorization processes. This flaw allows remote attackers to manipulate the device's programmable logic controller (PLC) without authentication, potentially leading to over- or under-odorization events. Such incidents can compromise safety, regulatory compliance, and operational integrity. The vendor has not responded to coordinated disclosure attempts, leaving systems exposed to potential exploitation. ([windowsforum.com](https://windowsforum.com/threads/cve-2026-24790-unauthenticated-control-flaw-in-welker-odoreyes-xl4.402623/?utm_source=openai)) This vulnerability underscores the pressing need for robust security measures in industrial control systems, especially those integral to critical infrastructure sectors like energy and chemical processing. The lack of authentication safeguards in such devices highlights a broader issue of security gaps in industrial equipment, necessitating immediate attention and remediation efforts to prevent potential disruptions and safety hazards.
5 months ago
Kill Chain
Critical Privilege Escalation Vulnerability Discovered in Iconics Suite
In early 2024, a security assessment revealed a vulnerability in the Iconics Suite, a SCADA system used across various industries. Tracked as CVE-2025-0921, this flaw allows local authenticated attackers to exploit privileged file system operations, potentially leading to a denial-of-service (DoS) condition by corrupting critical system binaries. The vulnerability affects all versions of GENESIS64, MC Works64, and GENESIS version 11.00. Mitsubishi Electric has released advisories detailing measures to address the issue. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/?utm_source=openai)) This incident underscores the critical importance of securing SCADA systems, especially given their role in industrial operations. The discovery of CVE-2025-0921 highlights the need for continuous security assessments and prompt application of vendor-released patches to mitigate potential threats.
5 months ago
Kill Chain
Schneider Electric Foxboro DCS: Intel Side-Channel Flaw Threatens Critical Infrastructure (2026)
In late 2025 and early 2026, Schneider Electric disclosed a side-channel vulnerability (CVE-2018-12130) impacting its EcoStruxure Foxboro DCS product line, widely used in critical infrastructure globally. The issue, originating from Intel processor flaws, could allow authenticated local attackers to extract sensitive data via side-channel methods, potentially leading to unauthorized disclosure or manipulation of system functions. The exploit primarily affects specific Foxboro DCS servers and workstations running on vulnerable Intel CPUs. Schneider Electric issued upgrades and remediation guidance while urging organizations to implement defense-in-depth strategies to mitigate risk. This incident highlights ongoing industry concerns over hardware-level vulnerabilities affecting operational technology in high-stakes sectors such as energy and manufacturing. As threat actors increasingly target supply chain and embedded flaws, organizations are under mounting pressure from regulators and customers to update aging infrastructure, strengthen segmentation, and accelerate threat detection capabilities.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports