Daily OT & IoT Security Briefing — June 30, 2026
Today’s roundup covers the top operational technology, industrial control systems, and IoT security developments from June 30, 2026. Items include new vendor guidance on ransomware risks, multiple critical ICS advisories, disclosures affecting data center infrastructure, and product launches aimed at improving OT visibility and response. These stories underscore the continuing convergence of cyber and physical risk across industrial environments.
Ransomware Exploiting Factory VPNs Prompts OT Remote-Access Reassessment
Secomea warns that ransomware groups increasingly exploit always-on factory VPN access, shared credentials, and weak oversight to gain footholds in manufacturing environments. The vendor urges organizations to adopt just-in-time vendor access, approval-based workflows, least-privilege permissions, and robust audit trails to limit exposure and enable rapid isolation of affected assets. The advisory follows a rise in public extortion incidents targeting manufacturers and industrial suppliers. Secomea also notes its recognition as a Representative Vendor in Gartner’s 2026 CPS Secure Remote Access category as part of its recommendations.
Source: PR Newswire
CISA Issues Multiple Critical ICS Advisories, Adds Ubiquiti CVEs to KEV
The U.S. Cybersecurity and Infrastructure Security Agency released a fresh batch of ICS advisories for products from vendors including Schneider Electric, Yokogawa, Delta Electronics, Daktronics, and Horner Automation. OT operators should review the vendor-supplied mitigations and prioritize fixes and compensating controls where updates are available. CISA also added three Ubiquiti UniFi OS vulnerabilities — CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 — to its Known Exploited Vulnerabilities catalog, signaling active exploitation risk. Organizations with UniFi deployments should treat these as high priority for patching and monitoring.
Source: CIMetrics
Claroty Discloses Critical HVAC and UPS Flaws Threatening Data Centers
Claroty researchers disclosed multiple vulnerabilities in widely deployed HVAC and UPS systems used in data centers that could allow remote attackers to disrupt cooling and power infrastructure. The findings emphasize that building management and power systems are now integral parts of the attack surface for critical facilities, not just mechanical subsystems. Successful exploitation could cause service degradation, hardware damage, or safety risks, making timely mitigations essential. Facility operators should coordinate cybersecurity and facilities teams to apply vendor fixes and harden access controls.
Source: CIMetrics
Dragos Launches EmberAI: OT-Native AI Security Platform
Dragos unveiled EmberAI, an OT-native artificial intelligence platform built on the Dragos Intelligence Fabric and informed by a decade of OT defensive operations. The company positions EmberAI as providing analysts with OT-specific models and datasets to accelerate threat identification, incident investigation, and response in industrial environments. Dragos claims the platform leverages the world’s largest OT cybersecurity dataset to reduce false positives and prioritize meaningful alerts. The release highlights broader industry momentum toward applying AI to OT detection and response workflows.
Source: Enterprise Times
TXOne Introduces Virtual Portable Inspector for Agentless OT Inspection
TXOne Networks announced the Virtual Portable Inspector (vPI), a software-based extension to its Element inspection portfolio that enables agentless OT inspection where physical or USB-based inspection is impractical. vPI requires no installation, system reboot, or configuration changes, allowing inspection across geographically dispersed sites and assets without accessible HMIs. The vendor reports real-world deployments have cut inspection cycle times by roughly 50% in high-throughput OT environments. The tool is positioned to help teams scale visibility while minimizing operational disruption.
Source: TXOne Networks
