Federal agencies warn of active AI-assisted targeting of Siemens S7 PLCsCareCloud breach scope rises to 3.76 million peopleCISA adds MLflow SSRF flaw to exploited-vulnerability catalogueMirage2FA telemetry reframes Microsoft 365 MFA as a session-containment…

Security.io • Thursday 20 August 2026 • 06:00 EDT · Executive decision brief

Federal agencies warn of active AI-assisted targeting of Siemens S7 PLCs

Five U.S. agencies say unidentified actors are using AI-assisted scripts and open-source automation libraries against Internet-exposed or poorly protected Siemens S7 controllers.

Security.io Intelligence Desk · Thursday, 20 August 2026

Executive consequence

Security leaders should require a site-by-site answer covering every Siemens S7 controller, its network paths, firmware, remote-access dependencies and continuity consequence.

Decision today

Inventory every Siemens S7 controller and record model, firmware, network path, owner and external-access state.

Read the full decision briefPrimary reporting: CISA Joint Cybersecurity Advisory AA26-231A · NSA press release on active PLC threats · The Record reporting on AI-generated PLC tooling

Executive priorities

What deserves attention before the rest of the news cycle.

Read First

The Siemens S7 warning ranks first because it joins active targeting, opaque third-party access and potential physical-process consequences. Security leaders need an exposure answer and a safe-isolation decision today, not another generic request to improve OT security.

Act Now

Order an immediate reconciliation of Internet-exposed and remotely accessible Siemens S7 controllers. In parallel, identify self-hosted MLflow deployments below version 3.15.0 and treat patch status and compromise status as separate workstreams.

Emerging Risk

AI-assisted exploit development is compressing the time and specialist knowledge required to turn public OT information into usable tooling. The governance consequence is not to speculate about autonomy, but to assume exposed legacy interfaces can be operationalised faster than existing maintenance,

Decision intelligence, not a headline feed.Every edition ranks what security leaders should read first, assign today and monitor next.

Six-minute executive briefing

Security.io Daily Headlines

Five equally weighted stories: what happened and the leadership decision each creates.

Read today’s headlines

Today’s decision ledger

What changed · Why it matters · What to do

Data Protection

CareCloud breach scope rises to 3.76 million people

Why it matters

The March intrusion is not new; the material change is the August federal count of 3,756,469 affected people.

Do today

Reconcile every CareCloud service and affected patient population with clinical, privacy and procurement owners.

Read the briefing →

Vulnerability Management

CISA adds MLflow SSRF flaw to exploited-vulnerability catalogue

Why it matters

Organisations running self-hosted MLflow versions before 3.15.0 should patch immediately and review for compromise.

Do today

Locate self-hosted MLflow tracking servers and verify version, exposure, authentication and webhook use.

Read the briefing →

Ransomware

Federal Medusa update raises critical-infrastructure victim count above 500

Why it matters

The Medusa operation is old, but the federal evidence base has materially changed: more than 500 victims were recorded as of April 2026, compared with more than 300 as of February 2025.

Do today

Map all Internet-facing edge systems to owners, patch status, authentication and recovery dependencies.

Read the briefing →

Identity

Mirage2FA telemetry reframes Microsoft 365 MFA as a session-containment problem

Why it matters

ANY.RUN’s August analysis expands Mirage2FA from a known phishing technique into a measured identity campaign spanning thousands of organisational domains.

Do today

Hunt for .htm, XHTML and SVG attachments that launch browser-based Microsoft 365 sign-in flows.

Read the briefing →

Signal desk

Evidence that changes prioritisation

Security.io decision score

Siemens S7 active threat: executive decision profile

Scores are Security.io editorial judgements, not source metrics. Exposure reflects deployment breadth and reachability uncertainty; Urgency reflects active targeting; Business Consequence reflects possible safety and process disruption. Source: Security.io editorial scoring, informed by the NSA-led joint advisory: Exposure, Urgency and Business Consequence are independently assessed on a 0–100 scale..

Back page

Daily comic · Circuit Chuckles

A brief pause after the intelligence

Offline Backup

Rusty interprets an untested offline backup as successful because it cannot restore while unplugged.

Thursday, 20 August 2026Open comic page →

In a four-panel black-and-white newspaper comic, Glitch confirms that the emergency backup is offline while Rusty proudly points to an unplugged tape drive and then treats the failure to restore from it as proof that it was tested.