Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
U.S. agencies warn of active AI-powered attacks targeting internet-exposed Siemens S7 Series PLCs in critical infrastructure, with threat actors using AI-generated scripts and scanning services like Censys and ZoomEye CVE-2026-19478, a critical code injection flaw in GitLab (CVSS 9.4), is under active exploitation allowing unauthenticated modification or deletion of public projects 14 trojanized npm packages were discovered delivering RedC2 4.0, an AI-powered cross-platform backdoor marketed as
Analysis
TL;DR
- U.S. agencies warn of active AI-powered attacks targeting internet-exposed Siemens S7 Series PLCs in critical infrastructure, with threat actors using AI-generated scripts and scanning services like Censys and ZoomEye
- CVE-2026-19478, a critical code injection flaw in GitLab (CVSS 9.4), is under active exploitation allowing unauthenticated modification or deletion of public projects
- 14 trojanized npm packages were discovered delivering RedC2 4.0, an AI-powered cross-platform backdoor marketed as a C2 framework built for evasion
- Researchers demonstrated a "Zombie Card" attack that bypasses cryptographic checks to enable contactless payments with physically expired Visa cards via smartphone relay
- A remote Spectre side-channel attack against Cloudflare Workers can leak JWTs at 12 bits per second, a 360x improvement over 2021 demonstrations
Why It Matters
This week's threats illustrate how AI is lowering the barrier to sophisticated attacks across both OT and IT environments, making exploit development faster and more accessible to threat actors. The convergence of supply chain compromises (npm packages, MSP hijacking), actively exploited zero-days, and hardware-level side-channel attacks demonstrates that defense-in-depth is no longer optional—each layer must be independently secured.
Technical Details
- Siemens PLC Exploitation Chain: Threat actors use Censys/ZoomEye for reconnaissance, deploy AI-generated scripts disguised as monitoring tools, and leverage read access to map target environments in preparation for write operations that could disrupt industrial processes
- CVE-2026-19478 (GitLab): A CVSS 9.4 unauthenticated code injection vulnerability requiring no user interaction or special configuration, enabling modification or deletion of publicly accessible GitLab projects
- RedC2 4.0 Distribution: 14 npm packages disguised as calendar and streak utilities serve as droppers for an AI-powered implant offering surveillance, credential theft, payload loading, and mass-operation capabilities across Windows, macOS, and Linux
- Zombie Card Attack: Exploits the Consumer Device Cardholder Verification Method (CDCVM) flag via a smartphone relay setup to alter the expiration date presented to PoS terminals without breaking underlying card cryptography
- Cloudflare Workers Spectre Attack: Uses amplification techniques combined with a remote timing server to achieve 120 bits/hour JWT leakage from co-located Workers in shared production environments
Industry Insight
- Organizations running Siemens S7 Series PLCs on the internet or with insufficient network segmentation should treat this as an immediate remediation priority, not a theoretical risk—air-gapping and network segmentation are critical
- The rapid exploitation of GitLab's CVE-2026-19478 underscores the need for automated vulnerability scanning and timely patching pipelines, especially for publicly accessible repositories
- Supply chain security must extend beyond code repositories to include MSP relationships, captive Wi-Fi infrastructure, and npm dependency audits, as attackers are increasingly targeting these trust boundaries
Disclaimer: The above content is generated by AI and is for reference only.