←All topics

ics

4 pieces of writing

ics8 min read

CVE-2025-10492: a Java deserialisation flaw in Jasper Report gives attackers remote code execution on Hitachi Energy Ellipse

CVE-2025-10492, a CVSS 9.8 Java deserialisation flaw in the Jasper Report component of Hitachi Energy Ellipse, enables unauthenticated RCE on critical manufacturing systems. No patch exists for the community edition of the underlying library.

siemens6 min read

Two CVEs in Siemens SICAM 8 firmware expose three product families to unauthenticated denial of service

ics6 min read

Anritsu's spectrum monitors have no authentication and the vendor has no plans to add it

security9 min read

Sandworm hit thirty Polish energy sites in a single night

Russia's Sandworm hit Poland's power grid on the coldest night of the year, deploying a new wiper across thirty facilities including renewable plants and a major heat-and-power station. The attack failed to cause blackouts - but it damaged equipment beyond repair and proved that distributed energy is now a target.