Today’s stories all involve AI sitting on the attacker’s side of the equation in one form or another — writing exploit code, riding along inside an ML platform, or hiding in a build pipeline that increasingly ships AI-assisted tooling by default. Here’s what’s new since yesterday’s digest.
OT watch: Five federal agencies warn of AI-generated exploit scripts hitting internet-exposed Siemens S7 PLCs
The NSA, CISA, FBI, Department of Energy, and EPA issued a joint advisory (AA26-231A) on August 19 warning that threat actors are actively targeting internet-exposed Siemens S7 Series programmable logic controllers — covering every generation from the S7-200 up through the S7-1500 F-series safety controllers. Attackers are combining open-source industrial automation libraries (snap7/python-snap7) with AI coding assistants to build custom tools that masquerade as legitimate OT monitoring software, giving them read/write access to PLC memory, configuration data, and ladder logic over the S7comm protocol. Targets are found using internet-scanning services like Censys and ZoomEye to spot exposed controllers running outdated firmware or default credentials. The activity has been observed across at least a dozen U.S. states and is most concentrated in Water and Wastewater, Energy, Critical Manufacturing, Chemical, and Food and Agriculture, with a July incident disrupting more than 30 community water systems in Minnesota. The advisory’s headline recommendation is blunt: take internet-exposed S7 PLCs offline. CISA advisory AA26-231A · BleepingComputer
If you operate or monitor OT/ICS environments — even indirectly, through a customer or vendor network — this is worth an active check rather than a filed-away advisory: confirm no S7 PLCs are directly internet-reachable, and if any log source touches an OT network segment, review it for scanning traffic on S7comm (port 102) or unexpected connections from monitoring-tool-shaped clients you didn’t provision yourself.
Supply chain watch: An actively exploited SSRF flaw in MLflow lets attackers steal cloud credentials with no authentication
CISA added CVE-2026-64849 (CVSS 9.3), an unauthenticated server-side request forgery flaw in the open-source MLflow machine-learning platform, to its Known Exploited Vulnerabilities catalog on August 19, giving federal agencies until September 2 to patch. The bug — a webhook redirect-validation bypass in versions before 3.15.0 — lets an attacker force a vulnerable MLflow server to make requests to internal services, including cloud metadata endpoints, which can hand over temporary cloud credentials. Researchers at watchTowr observed mass scanning for exposed MLflow instances within hours of the CVE being assigned, and confirmed incidents describe attackers using stolen credentials to enumerate cloud resources, deploy cryptominers, and create new IAM users for persistence. Fix: upgrade to MLflow 3.15.0 or later. BleepingComputer · SecurityWeek
MLflow servers tend to sit inside data-science environments that don’t get the same network scrutiny as production infrastructure, which is exactly why they’re an attractive path to a cloud metadata endpoint. If your organization runs MLflow anywhere, confirming the version and checking for outbound requests to 169.254.169.254 or similar metadata addresses from that host is a quick, high-value check.
Software supply chain watch: A compromised maintainer account poisoned three popular Rust crates with build-time malware
An attacker compromised the maintainer account behind the widely used arrayref Rust crate and, within a 23-minute window on August 20, also published malicious versions of internment and append-only-vec from the same account. The three poisoned releases — arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 — added a dependency on a typosquatted package called proc-macro1 (mimicking the legitimate proc-macro2), whose build script downloaded and executed a remote payload during compilation. Because the malware runs at build time, simply compiling a project pulling in any of the three crates was enough to trigger infection, no runtime usage required. arrayref alone has more than 245 million lifetime downloads. The Rust Security Response Team pulled all three releases within roughly two hours and says it currently believes the maintainer’s account or machine was compromised rather than the maintainer acting maliciously. Rust Security Response Team · BleepingComputer
Build-time payloads keep proving to be the softest part of the software supply chain, since they execute with a developer’s local privileges and bypass every runtime protection aimed at the shipped application. If your build pipeline resolves Rust dependencies, check whether arrayref 0.3.10, internment 0.8.7, or append-only-vec 0.1.9 (or the proc-macro1 package at all) ever showed up in a lockfile or CI build log around August 20, and treat any matching build host as potentially compromised.
Final thought
Three different points in the pipeline today — industrial control systems, an ML ops platform, and a language’s package registry — but the same underlying pattern: attackers reaching for whatever surface has the least monitoring relative to its blast radius. None of today’s stories require a sophisticated zero-day; they require an exposed PLC nobody took offline, an MLflow server nobody network-isolated, or a build log nobody was watching. If you want help figuring out what your own logging actually covers across infrastructure like this, see our how-to guides or book a discovery call.