UNIVERSITY of British Columbia researchers detailed ICS-Sniper, a proof-of-concept attack targeting OT environments reliant on cloud-hosted SCADA. By controlling a router on the network path, an adversary could study VPN-encrypted packet timing and sequence to predict critical command and data exchanges, dropping payload-carrying packets within those windows.
Tests on emulated SWaT water treatment systems delayed water pumping by around 15 minutes and extended a valve closure by over nine minutes in separate scenarios, illustrating the potential for disruption in industrial facilities.
Other notable items include an unauthenticated remote code execution in the XWorm RAT’s C2 panel (versions up to 7.4) with a PoC exploit published by Mootoo; a Chrome full-chain exploit earning a $250,000 bounty from Google after being assembled in six days, leveraging three fixed flaws; and CVE-2026-105740 in Langflow, with Previdian reporting more than 1,800 exploitation attempts from 28 IP addresses across 16 countries before the CVE was published.
The round-up also notes Bank of America’s deployment of 1,000 patching contractors to address frontier AI model–exposed flaws, and other stories including a Burger King Japan data exposure affecting about 11 million members. Where claims are stated, they are attributed to the sources, and exploitation is described as confirmed or ongoing as reported.