Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More

Siemens S7 Series

The U.S. government's most pointed advisory this week puts a target on industrial controllers that have quietly run America's water, energy, and manufacturing backbone for years. According to the agencies cited by The Hacker News, threat actors are using AI to generate exploit scripts aimed at internet-exposed Siemens S7 Series PLCs, with attackers first turning to legitimate scanning services like Censys and ZoomEye to enumerate poorly segmented devices. The pattern matches a familiar playbook: reconnaissance, validation, capability development, then "write operations" capable of disruption. The advisory's framing — "this is not a theoretical risk, it is an active threat" — is unusually blunt for a federal bulletin, suggesting intelligence-grade confidence in observed activity rather than hypothetical concern. The most consequential detail is what is not in the advisory: no attribution. That silence leaves defenders racing to harden exposed controllers without knowing which adversary to model, and it underscores how AI is collapsing the cost of entry for industrial exploitation that previously required niche expertise.

CVE-2026-19478

The GitLab flaw disclosed this week is the kind of vulnerability that resets everyone's patch SLA. According to watchTowr, CVE-2026-19478 carries a CVSS of 9.4 and was under active exploitation within days of public disclosure — a turnaround that compresses the typical defenders' window from weeks into hours. The bug is a code-injection issue exploitable by unauthenticated attackers who can modify or delete publicly accessible projects and rewrite their data without credentials, user interaction, or unusual configuration. That combination — unauthenticated, no user interaction, no exotic precondition — is the worst-case profile for a code-hosting platform because it converts every public repo into a potential target. For organizations that mirror production code to public GitLab instances, the impact extends well beyond data integrity into supply-chain compromise, since tampered repositories can flow downstream into CI pipelines and customer deployments.

UNC6293

The suspected Russian espionage clusters tracked by Google as UNC6293, UNC7005, and UNC5976 represent a quieter but persistent threat layer beneath the week's louder vulnerability news. According to Google, these clusters run adaptive phishing campaigns against individuals in academia, aerospace and defense, governments, and think tanks across Europe and the United States, leveraging legitimate authentication workflows rather than exotic exploits to compromise personal accounts across multiple platforms. The UNC7005 cluster, also attributed to CaptiveCrunch, has been linked by Lumen Black Lotus Labs to a supply-chain compromise of three Managed Service Providers used to hijack captive Wi-Fi portals in hotels, conference centers, and airports — a reminder that the softest target is often the trusted network the victim joins voluntarily. The MSP angle is the most strategically worrying piece: a single compromise of a managed service provider can fan out into credentials from thousands of travelers who never knowingly interacted with the adversary.