←All topics

critical-infrastructure

5 pieces of writing

ics8 min read

CVE-2025-10492: a Java deserialisation flaw in Jasper Report gives attackers remote code execution on Hitachi Energy Ellipse

CVE-2025-10492, a CVSS 9.8 Java deserialisation flaw in the Jasper Report component of Hitachi Energy Ellipse, enables unauthenticated RCE on critical manufacturing systems. No patch exists for the community edition of the underlying library.

ics6 min read

Anritsu's spectrum monitors have no authentication and the vendor has no plans to add it

f57 min read

CVE-2025-53521 lands in CISA's KEV catalog: F5 BIG-IP RCE under active exploitation

security9 min read

Sandworm hit thirty Polish energy sites in a single night

Russia's Sandworm hit Poland's power grid on the coldest night of the year, deploying a new wiper across thirty facilities including renewable plants and a major heat-and-power station. The attack failed to cause blackouts - but it damaged equipment beyond repair and proved that distributed energy is now a target.

security10 min read

ASIO named Salt Typhoon and Volt Typhoon out loud. Beijing called it a false narrative.