Jim Reavis

Good morning! Here is this week's ICS Advisory, Other CERT, and Vendor vulnerability advisories weekly summary for 23 - 27 February 2026. This past week, CISA released 12 new CISA ICS Advisories for the following vendors: Copeland, InSAT, CloudCharge, EV Energy, Chargemap, SWITCH EV, Mobility46, EV2GO, Gardyn, Johnson Controls, Inc. Pelco, Inc. and Schneider Electric. One update was released this past week for Honeywell Schneider Electric, Mitsubishi Electric, Hitachi Energy, ICONICS and Mitsubishi Electric. Based on the new CISA advisory, #Energy, #TransportationSystems, #Commercial #Facilities, #Healthcare and #PublicHealth, #Defense #Industrial Base, #Food and #Agriculture, Critical #Manufacturing, #Government #Facilities, #Financial #Services, #InformationTechnology, #Water and #WastewaterSystem are the potentially affected critical infrastructure (CI) sectors. The ICS Advisory Project identified 16 new ICS Advisories for Festo, ARC Informatique, Moxa, Phoenix Contact, ABB, Bosch Rexroth, Hitachi Energy, Ubiquiti Networks, Trumpf, PDUexperts, Socomec and one update for Hitachi Energy. View the summary details of other CERT & Vendor product advisories identified last week (23 - 27 February 2026) at: https://lnkd.in/efKiMsxs This past week, CISA added 3 new Known Exploited Vulnerability (KEV) Catalog. None added this week correlated to a CISA ICS Advisory. ICS Advisory Project identified one CVE: CVE-2020-11023 – JQuery Cross-Site Scripting (XSS) Vulnerability listed in the Festo advisory for CODESYS vulnerabilities in Festo Automation Suite [VDE-2025-108]. This week, ICS Advisory Project, powered by Industrial Data Works LLC, in collaboration with EmberOT, released our 2024–2025 ICS/OT Vulnerability Intelligence Report. Check it out at: https://lnkd.in/ehG4DNPs Thank you all at EmberOT for your amazing support in getting this report out this year. Acknowledgement: Thank you Mikael Vingaard at the ICSRange for sharing with ICS[AP] the new ICS Advisory for PDUexperts. Visit the ICS[AP] CISA KEV Catalog Dashboards: https://lnkd.in/emzXBbBw View previous ICS Advisory Project weekly summaries: https://lnkd.in/eQKxhAEi To view the updated ICS Advisory Project Dashboards, visit: icsadvisoryproject.com Sign up to receive ICS[AP] Weekly Summary Slides & Other CERT and Vendor Advisory Summaries via email every Monday https://lnkd.in/eUwQrrj4 I appreciate everyone's comments & support. Have a great week!  #CISA #ot #ics #otsecurity #icssecurity  #cybersecurity #cybersecurityawareness #industrialautomation #buildingautomation #oilandgas #maritime #vulnerabilitymanagement Disclaimer: The views expressed in my LinkedIn posts and profiles are my own, not those of my employers or LinkedIn.

29

I spend a lot of time with manufacturers and product teams who aren’t questioning whether they must comply with the Cyber Resilience Act (CRA) they’re stuck on the how. The CRA is clear on the obligations, but in practice the hard part is interpretation: software distributed online, products that depend on cloud back-ends, continuous updates, open-source components, product families, legacy models… This is exactly what the European Commission is trying to address now. The Commission is preparing a Communication (a guidance document) to explain how the CRA should be applied in real situations and to support a consistent approach across the EU. It’s not a new Regulation and it’s not “binding law” in itself but it matters because it clarifies how key provisions are expected to be understood and implemented in practice. https://lnkd.in/etm43Utx What I like in this draft is that it turns the CRA into practical “rules of the road”, especially on: • Software scope & “placing on the market” (including iterative releases) • What counts as the “product” when hardware depends on apps/drivers/software delivered separately • Open-source (FOSS): when it’s out of scope vs when it becomes a commercial activity, and the steward concept • Updates vs “substantial modifications”: focus on risk/attack surface/intended purpose, not release size • Support period: 5 years is a minimum, and how this works with versioned software/upgrade paths • Cloud / remote processing: what’s part of the product vs general IT infrastructure • Risk assessment & due diligence: manufacturers keep responsibility, including for third-party components The draft is open for feedback for a limited period, and comments are expected in a structured template (so they can consolidate input). If you build products that will fall under CRA, this is a very good moment to stress-test your assumptions and flag the parts that are unclear, unrealistic, or could lead to unintended consequences. I’m sharing the draft guidance here because, from what I see, the companies that will move fastest are the ones that turn these interpretations into concrete internal rules: scope mapping, update governance, support period policy, OSS governance, and evidence-ready documentation.

32

I’ve been thinking about exposure management less as a tooling problem and more as a systems problem. When discovery grows faster than mobilization capacity, exposure doesn’t just increase — it compounds. That accumulation is exposure debt.

16

2 Comments

🚨 BREAKING: PSA Security Network and The Access Control Collective release State of Security Integrators 2026 Report Built on PSA’s Financial Metrics Survey with input from 116 integrators, this report offers a level of industry clarity you won’t find anywhere else. The data shows an industry that is strong and growing, but not yet durable. More than 90% expect revenue growth. Margins remain healthy. Demand continues across education, healthcare, and critical infrastructure. At the same time, most revenue is still project-based, recurring revenue averages below 10%, and talent constraints continue to limit scale. The opportunity is clear. The next era will reward firms that shift from installation to outcomes, build recurring models, and invest in people and platforms. This is how integrators move from busy to durable. The data is eye-opening and encouraging. Thank you to PSA and its members for the opportunity to partner on this important report. Thank you Matt Barnette and Candice Aragon. Read the full State of Security Integrators 2026 report - available in my Featured section.

54

10 Comments

CISA just released the blueprint for securely integrating AI into your physical operations. If you are looking to leverage AI to drive efficiency in your Operational Technology (OT) environments, this new joint guidance from CISA and international partners is a mandatory read. It moves beyond high-level theory and offers a practical framework for balancing the benefits of AI with the critical need for safety and reliability. Integrating AI into OT isn't just a software upgrade. It introduces unique risks to physical systems that standard IT security practices might miss. This guide breaks down exactly how to navigate those challenges without stalling innovation. Here are the core principles you need to adopt: Understand the Risk: Start by educating your personnel. Your team needs to understand not just how the AI works, but the specific security and safety implications of the AI lifecycle. Assess Before You Deploy: Evaluate the business case and the data security risks immediately. Don't let the promise of efficiency blind you to long-term integration debts. Lockdown Governance: Implement a governance framework that includes continuous testing. AI models drift, and your security protocols need to evolve with them. Embed Safety: Maintain human oversight and transparency. Ensure your incident response plans are updated to handle AI-specific anomalies. You can read the full breakdown and access the guidance here: https://lnkd.in/ef7VXFDf

8

Audits and forensics aren’t witch-hunts to “name the hacker.” They’re how you stop the next breach. A good audit/forensic review will: Expose misconfigurations and control gaps Surface broken processes (people • tech • vendors) Produce a clear timeline to improve response Provide evidence for insurance claims and regulators Demonstrate senior management intent and due diligence One breach costs more—in money, trust, and time—than doing the work properly up front. At Tylers, we turn incidents into hardening plans: fixes, owners, deadlines. Not blame—better security. #CyberSecurity #DigitalTrust #Forensics #Audit #IncidentResponse #Tylers

17

2 Comments

Thanks to Ray Panta sharing below, National Institute of Standards and Technology (NIST) Special Publication is always a good reference for Cybersecurity practitioner in CyberSecurity related area. NIST SP as a whole is free, public accessible and by created by expert for everyone. What more else one can ask for such a good deal ? 😅 💻 Cyber risk means the chance of something going wrong in digital systems 🌐 – like hackers stealing data 🕵️‍♂️, systems going offline 🚫, or software getting hacked 🐞 🔐 It includes risks to privacy 🧾, finances 💸, business operations 🏢, and even national security 🛡️ 📘 NIST SP 800-30 is a guide 📖 from the US National Institute of Standards and Technology (NIST) 🇺🇸 that helps organisations figure out and manage their cyber risks ⚠️ 🧮 It teaches how to do risk assessments 🧠 – like identifying threats 👀, figuring out how likely they are 🎯, and what damage they could cause 💥 🧩 It's a key part of the NIST Cybersecurity Framework, used worldwide 🌍 to build safer digital systems 🏛️ NIST Special Publications are official guides 📚 that offer best practices, standards, and strategies for improving cybersecurity 👋 Robin Yong #MemeLord #LobinKor 🏆 #Favikon #CyberSecurity & #LinkedIn #Malaysia 💻 #5G, #ArtificialIntelligence, #IT, #CyberSecurity, #ForeignAffairs & #Geopolitics 🤝 https://v.gd/Robin ✨ #AI-augmented content, do fact check if in doubt ℹ️ #MemeLord not liable for the info shared.

19

1 Comment