Critical ICS Flaws, Active AI Exploits, Espionage, and Cloud Moves
Coverage: 26 Mar 2026 (UTC)
< view all daily briefs >Critical advisories dominated the day. CISA detailed a CVSS 10 flaw in WAGO industrial managed switches that allows unauthenticated attackers to escape restricted CLI controls and fully compromise devices, while a separate CISA notice warned of a CVSS 10 remote code execution issue in PTC Windchill and FlexPLM pending vendor patches. In parallel, active exploitation surged against the Langflow AI workflow framework, with weaponization observed within a day of disclosure, according to BleepingComputer.
Advisories and active exploitation
CVE-2026-3587 in WAGO managed switches enables a hidden CLI function that defeats restricted shells, leading to complete device takeover. The advisory enumerates affected firmware across multiple models and directs operators to vendor-fixed firmware (for example V1.2.1.S1, V1.2.3.S1, V1.2.8.S1). Where immediate updates are not possible, guidance includes deactivating SSH and Telnet to limit remote CLI access, minimizing network exposure of control equipment, isolating control networks, and using secure remote access with impact analysis. For PTC Windchill and FlexPLM (CVE-2026-4681), unsafe deserialization exposes unauthenticated RCE across 11.x–13.x lines. A patch is in development; interim steps focus on documented workarounds and web server configuration updates. Both advisories emphasize protecting any internet-accessible deployments and extending precautions to file and replica servers.
On the AI tooling front, the Langflow vulnerability (CVE-2026-33017) allows remote code execution via unsandboxed flow execution and can be triggered with a crafted HTTP request. Exploitation ramped quickly—automated scans, Python-based exploits, and key file harvesting appeared within roughly a day of disclosure—underscoring how rapidly popular development tools are targeted. Mitigations include upgrading to version 1.9.0 or later, restricting or disabling vulnerable endpoints, avoiding internet exposure, monitoring outbound traffic, and rotating secrets after suspected compromise. This follows prior critical issues in Langflow and highlights the need for prompt patching of widely adopted AI frameworks.
A honeypot study reported by Infosecurity Magazine observed rapid weaponization of Oracle WebLogic CVE-2026-21962 (CVSS 10.0): the first exploitation attempt arrived the same day public exploit code appeared. Probes leveraged common scanning stacks and also targeted older, still-prevalent WebLogic flaws. Recommended steps include accelerated patching, restricting console access, disabling unnecessary services, WAF filtering, and close log monitoring. Why it matters: public proofs-of-concept now transition to broad scanning in hours, compressing defenders’ response windows.
Cloud platforms expand capacity and controls
AWS extended its high-memory portfolio to Europe (Milan) with U7i instances offering 8–12 TiB DDR5 and up to 896 vCPUs, targeting in-memory databases such as SAP HANA with 100 Gbps EBS and network bandwidth and ENA Express. In parallel, AWS expanded R8gd availability, pairing local NVMe SSDs with Graviton4 for higher compute and I/O performance on transactional databases and I/O-intensive analytics. Customers are encouraged to validate sizing, bandwidth weighting, storage profiles, and Arm compatibility to balance cost and performance; Nitro-based isolation remains a core security underpinning.
New database-layer efficiency arrives with the Advanced JDBC Wrapper’s automatic query caching backed by Valkey, as announced by AWS. The feature integrates with Hibernate and Spring Data to offload frequent reads to ElastiCache for Valkey, reducing database load and latency. For compliance-focused workloads, AWS also enabled FIPS-compliant mode for Amazon ECS Managed Instances on Graviton and GPU-accelerated compute in GovCloud (US), defaulting to FIPS endpoints and validated cryptographic modules to simplify regulated deployments.
Google Cloud and Red Hat introduced migration and operations updates for OpenShift on Google Cloud, including a guided cluster-creation experience, broader integrations for storage, observability, identity, and certificate services, and the GA of OpenShift Virtualization on OpenShift Dedicated. The additions aim to preserve OpenShift-native architectures while easing selective adoption of managed services, with configuration validation to surface misconfigurations and modernization opportunities.
Espionage campaigns refine persistence
Unit 42 documented multiple concurrent intrusion clusters inside a Southeast Asian government network, combining removable-media worms, backdoors, in-memory loaders, keyloggers, and cloud-capable exfiltration. Tooling overlaps and TTP similarities align with prior regional reporting, though definitive attribution remains limited by shared tools. Indicators include specific hashes, IPs, and domains defenders can block and hunt. The report underscores the value of layered detections—malware analysis, URL and DNS filtering, and behavioral controls—paired with incident response to remove footholds and close exfiltration channels.
The Hacker News highlighted Red Menshen’s continued use of BPFDoor, a kernel-resident backdoor that activates only on crafted trigger packets, leaving no exposed listening ports. The campaign exploits a range of internet-facing appliances and adds evasion such as embedding triggers in HTTPS traffic and using ICMP channels, with variants supporting SCTP to blend into telecom protocols. Monitoring kernel-level BPF activity, SCTP handling, and anomalous in-environment process behavior is key to detecting these low-noise implants.
Criminal ecosystems and exploit toolchains
The UK sanctioned the Xinbi marketplace alleged to support scam networks and illicit crypto flows, aiming to isolate it from legitimate exchanges, per BleepingComputer. Separately, Russian authorities arrested a suspected administrator of the LeakBase cybercrime forum following a multinational takedown in which the platform’s domain and data were seized, according to BleepingComputer. These actions target both the supply of stolen data and the infrastructure that enables large-scale fraud.
BleepingComputer reported Kaspersky’s analysis of the Coruna iOS exploit framework as a maintained successor to the Operation Triangulation toolkit, bundling five exploit chains across 23 vulnerabilities and supporting recent Apple silicon. In parallel, The Hacker News covered a WebRTC-based skimmer abusing a newly disclosed PolyShell flaw in Magento Open Source and Adobe Commerce to bypass CSP and exfiltrate payment data over DTLS-encrypted channels. Timely patching and integrity monitoring remain the most effective defenses against these evolving toolchains.