Topic
Multi-nation intelligence and law enforcement advisories warning critical infrastructure operators about specific threat actors.
NCSC, FBI and AIVD say two Iranian spyware families report to per-victim Telegram bots and exfiltrate through Vultr, Storj and Backblaze B2. Networks already allow those services, so detection has to rely on host behaviour such as new Defender exclusions.
Reality
Australia's ASD ACSC wrote the guidance with CISA, the NSA, Canada's CCCS and the British and New Zealand cyber centres, pairing the 17 most common Active Directory compromise techniques with mitigations.
Reality
Joint advisory AA26-231A describes threat actors feeding internet-scan results into AI tools that emit working python-snap7 clients against Siemens S7 controllers. Siemens says the weakness is configuration, not a new vulnerability.
Reality
Five US agencies told PLC owners that scanners are finding exposed Siemens S7 controllers. ZoomEye puts that surface at 173 assets by product fingerprint, or 161,764 by open port.
Reality
CISA's advisory describes a mechanism, not a vulnerability: commercial scanners find the exposed PLC, and the agencies say AI tooling closes the distance from found to controlled.
Reality
The NSA, FBI and CISA say the six pulled capabilities out of Claude, GPT, Gemini and Grok variants through proxy accounts since late 2024, and they want providers watching subscription-to-usage ratios and query throughput.
Reality
The bureau and the EPA describe intruders changing IP addresses and switching passwords on internet-facing controllers, and the remedy they list is network design and credentials rather than firmware anyone can ship.
Reality
CISA, the NSA and the FBI want US model providers to catch industrial-scale distillation hiding inside traffic that looks like a busy enterprise customer, then quietly degrade the answers, which makes false positives a product decision.
Reality
The joint NSA, CISA and FBI advisory names six China-based companies and describes billions of tokens taken through paid APIs, cloud resellers and proxy transfer stations, which turns billing telemetry into a detection surface.
Reality
Citrix shipped fixes on 19 August 2026 for a memory overflow and an authentication bypass in NetScaler ADC and Gateway, but each one needs particular features turned on, so the inventory has to come before the change window.
Reality
Aikido rebuilt the Australian gym-booking flaws in a lab. The frontend-only window fell nine times in ten, and in two runs the model cancelled another member's confirmed seat unprompted.
Reality
Nine agencies across four countries refreshed the #StopRansomware Akira advisory on Nov. 13 with indicators current to November 2025 and a three-item action list.
Reality
A UK sentencing is the week's single security item measured in results rather than warnings, and the arithmetic is unflattering: 730 days of custody against 117 identified victims.
Reality