On August 19, 2026, the Cybersecurity and Infrastructure Security Agency, the National Security Agency, the FBI, the Department of Energy, and the Environmental Protection Agency jointly published Advisory AA26-231A: Defending Against an Active Threat to Siemens S7 Series PLCs. The Federal Transit Administration flagged it to transportation stakeholders this week. The underlying threat predates the advisory by long enough that the advisory itself uses the phrase “active threat” in the title.
Here is what the agencies found, and what it means.
What a PLC Is and Why It Matters
Programmable logic controllers are the hardware layer of critical infrastructure; that is, the physical devices that open valves, control motors, regulate pressure, and manage electrical loads in water treatment plants, power grids, transit systems, and manufacturing facilities. Siemens S7 series PLCs are among the most widely deployed in the world. They communicate over a protocol called S7comm on TCP port 102, and they are often directly internet-accessible, either by design or by administrative oversight.
The S7 series has been a documented target before. Iranian-affiliated actors were documented exploiting internet-exposed PLCs across U.S. critical infrastructure as recently as April 2026, per a separate advisory (AA26-097A). The August advisory describes a distinct and ongoing campaign, but it lands in that context.
The Threat: AI-Generated Scripts Disguised as Monitoring Tools
The joint advisory describes threat actors conducting reconnaissance and capability development against internet-exposed Siemens S7 PLCs using AI-generated Python scripts, specifically tooling built on the python-snap7 and snap7 libraries, which are legitimate open-source tools for interfacing with S7 devices. The scripts are being disguised as standard OT monitoring software, making them harder to distinguish from normal network traffic without behavioral analysis.
The attack workflow documented in the advisory has three stages. First, actors use internet scanning services (Censys and ZoomEye are specifically named) to identify internet-exposed S7 PLCs. Second, AI-assisted scripting tools enumerate the devices: reading PLC memory, accessing configuration data, and interacting with ladder logic. Third, actors conduct capability development, or building out exploitation capacity against identified targets, whether or not a destructive action has yet been taken.
The advisory notes no confirmed destructive incidents tied to this specific campaign. It does not claim access logs exist for the full period of the observed activity. What the agencies are documenting is pre-operational: actors learning the terrain, building the tools, and positioning for an operation that may not yet have happened.
The advisory explicitly warns that the risk is not confined to Siemens equipment. Any internet-exposed OT device running on S7comm or similar industrial protocols is part of the attack surface. Transit agencies, utilities, water systems, and manufacturing operators are all named as relevant sectors.
The Gold Eagle Clearinghouse: A Platform Built for This Moment
Two weeks before the PLC advisory, on July 14, 2026, the White House announced the launch of Gold Eagle, a joint CISA and Department of the Treasury initiative operating under Executive Order 14409, signed June 2, 2026, Promoting Advanced Artificial Intelligence Innovation and Security.
Gold Eagle is a software capability layered on top of CISA’s existing Vulnerability Information and Coordinated Environment (VINCE) platform. The problem it addresses is structural: AI tools are dramatically accelerating the pace at which vulnerabilities are discovered and weaponized, and existing coordination infrastructure wasn’t built for that volume. Gold Eagle is designed to let organizations report, validate, and track AI-related vulnerabilities at scale — deduplicate submissions, route reports to the right vendors, and give CISA the throughput to actually process what comes in.
The FTA’s advisory to transportation stakeholders notes that industry partners can reach CISA directly at clearinghouse@cisa.dhs.gov to participate.
The timing is notable. Gold Eagle launches in mid-July. Three weeks later, a five-agency joint advisory goes out warning that AI-generated scripts are actively probing industrial control systems. The government is simultaneously acknowledging that AI has lowered the barrier to sophisticated OT attacks and standing up infrastructure to handle what that means for vulnerability coordination going forward.
Three New ICS Advisories
Alongside the FTA bulletin, CISA released three new Industrial Control Systems advisories covering current vulnerabilities:
- ICSA-26-230-01: CISA Malcolm. Six vulnerabilities in CISA’s own Malcolm network traffic analysis platform, an open-source OT monitoring tool, including critical upload and remote code execution flaws and access-control bypasses. Malcolm is widely used by organizations securing OT environments, which makes its own vulnerability surface a pointed irony.
- ICSA-26-230-02: Siemens Simcenter Nastran. Vulnerabilities in Siemens’ engineering simulation software.
- ICSA-26-232-01: Johnson Controls Simplex Incident Manager. CVE-2026-27875, a cleartext credential storage flaw in Johnson Controls’ Simplex Incident Manager, a life-safety and incident management platform used in facilities management. Credentials stored in cleartext means that anyone with access to the file system or a memory dump can read them without any decryption step.
What Transit and OT Operators Should Do
The FTA’s guidance to transportation stakeholders, distilled:
- Audit all internet-exposed PLCs and OT devices, not just Siemens equipment.
- Review the joint advisory AA26-231A and apply recommended mitigations, including blocking TCP/102 from untrusted networks and restricting S7comm access to engineering workstations.
- Patch or mitigate the three ICS advisories above if affected software is in your environment.
- Review CISA Malcolm configurations if Malcolm is part of your OT monitoring stack.
- Direct stakeholder questions to Dot-Sector-Cyber@dot.gov.
The advisory is available on the CISA website. The Gold Eagle Clearinghouse is operational.
Bureaucracy Times 