Energy OT Supply Chain Risk, COLDCARD Wallet Losses, and Critical PyAthena and FreeRDP Flaws Lead Today’s Cybersecurity Threats

Top Stories

Energy sector warned to harden OT against supply chain risk

GlobalData is warning energy companies to strengthen operational technology security as supply chain exposure grows, according to Industrial Cyber coverage. For defenders, this is less about headline novelty and more about recurring failure modes: unmanaged vendor access, weak segmentation, inherited software risk, and poor asset visibility across ICS environments.

So what?
If you run power, utilities, oil and gas, or adjacent industrial environments, supply chain compromise remains one of the fastest ways to bridge IT and OT. Third-party remote access paths, engineering workstations, update channels, and unmanaged appliances should be treated as likely intrusion paths.

What to do next - Revalidate vendor remote access paths, including VPN, jump hosts, and maintenance accounts. - Require MFA and session recording for third-party OT support. - Map software bills of materials where available for critical OT dependencies. - Review segmentation between business IT, plant operations, historian systems, and safety systems. - Hunt for stale accounts and remote tools on engineering endpoints.

Passaic County shows that refusing ransom still carries major costs

NorthJersey reports that Passaic County did not pay a ransom, but the cyberattack still imposed significant financial impact. This is a useful reminder for public sector and SMB leaders: no-ransom decisions reduce attacker monetization, but they do not eliminate recovery, legal, overtime, forensics, and service restoration costs.

So what?
Boards and executives still too often frame ransomware response as a pay-or-don’t-pay choice. The more realistic equation is downtime cost, recovery maturity, cyber insurance friction, evidence preservation, public communications, and identity rebuild effort.

What to do next - Quantify business impact from identity outages, payroll delays, and records access disruption. - Test recovery assumptions for tier-0 systems, not just file servers. - Pre-stage alternate communications and manual workarounds. - Ensure log retention covers the pre-encryption intrusion window.

AI-powered cybercrime remains a defender awareness gap

NPR highlights how AI is changing the fraud and cybercrime landscape. The immediate enterprise risk is not “AGI hacking.” It is scaled social engineering, synthetic voice and video impersonation, faster phishing content generation, and more convincing pretexting against help desks, finance, and privileged users.

What to do next - Require out-of-band verification for payment changes and credential resets. - Update phishing training to include AI-generated lures and deepfake voice scenarios. - Add call center controls for identity proofing. - Log and review unusual password reset patterns tied to VIP users.

OpenAI’s teased Astra model matters indirectly to security teams

BleepingComputer reports OpenAI has teased a model called Astra after internal work reportedly solved long-standing math problems. This is not a security incident, but it matters because stronger long-context reasoning can improve both defender workflows and attacker automation.

Security impact - Better automated triage and analysis is plausible. - So is improved phishing personalization, reconnaissance summarization, and malware debugging assistance. - Security teams should expect faster commoditization of AI-assisted offensive tradecraft.

COLDCARD wallet RNG flaw linked to major Bitcoin thefts

BleepingComputer reports a flaw in COLDCARD hardware wallet firmware likely contributed to roughly $88.6 million in Bitcoin theft, tied to weak random number generation during seed generation.

So what?
This is a sharp reminder that hardware security branding does not guarantee secure entropy. Any wallet, HSM-like device, or embedded security product that mishandles randomness can fail catastrophically.

What to do next - Identify whether your organization, treasury function, or executives used affected wallet generation workflows. - Review vendor guidance and firmware remediation steps. - Consider rotating assets generated under suspect entropy conditions. - Expand supplier review to include cryptographic implementation quality, not just tamper-resistance claims.

DNA evidence systems reportedly exposed to security risk

The Wall Street Journal reports a security flaw that reportedly put decades of DNA evidence at risk of hacking. Even without full technical details, the case underscores a recurring problem in public sector and lab environments: long-lived, high-sensitivity systems often lag modern security controls.

Defender takeaway - Treat forensic, lab, and evidence systems as high-value regulated assets. - Review segmentation, access controls, tamper logging, and offline backup posture. - Validate that vendor support lifecycles match the legal retention horizon of the data.

Critical Vulnerabilities

CVE-2026-65321: PyAthena SQL injection in parameter formatting

• Severity: CVSS 9.8
• Affected: PyAthena prior to 3.35.4
• Issue: Improper quote escaping in DefaultParameterFormatter.format() can enable SQL injection in DELETE and CTAS flows.
• Impact: Data exfiltration, destructive statements, and attacker-controlled CTAS behavior.
• References: GitHub advisory (GHSA-xwj5-g6cv-4r5c), patch commit (commit), project repo (repo)

Why it matters
This is especially dangerous in analytics platforms, data engineering jobs, internal admin tooling, and notebook environments that build Athena queries from user-controlled input.

Technical Notes

Check installed version:

python -c "import pyathena; print(pyathena.__version__)"

Upgrade:

pip install --upgrade "PyAthena>=3.35.4"

Look for risky patterns in code:

grep -R "DefaultParameterFormatter\|execute(.*DELETE\|execute(.*CTAS" -n .

Basic review target in Python:

cursor.execute(
    "DELETE FROM my_table WHERE user_name = %(name)s",
    {"name": user_input}
)

If untrusted input can reach vulnerable formatting paths, review immediately.

CVE-2026-68579: FreeRDP heap overflow via clipboard file contents

• Severity: CVSS 9.6
• Affected: FreeRDP before 3.30.0
• Issue: A malicious or compromised RDP server can trigger a heap-based buffer overflow during clipboard file content handling.
• Impact: Out-of-bounds write into a paste consumer’s heap buffer when a user pastes server-offered clipboard file contents.
• References: GitHub advisory (GHSA-m37j-jcr2-8gcc), patch commit (commit)

Why it matters
This is a client-side risk that becomes relevant when users connect to untrusted, external, or compromised RDP servers. Managed service providers, admins, and support teams are obvious exposure groups.

Technical Notes

Check FreeRDP version:

xfreerdp /version

Mitigation options until patched:

# Example: avoid clipboard redirection where operationally possible
xfreerdp /v:server.example /u:user /clipboard:no

Inventory systems with FreeRDP installed:

dpkg -l | grep freerdp || rpm -qa | grep freerdp

Look for suspicious crash artifacts and RDP usage around clipboard events in endpoint logs.

CVE-2026-67356: ArcadeDB privilege escalation via JavaScript triggers

• Severity: CVSS 8.8
• Affected: ArcadeDB before 26.7.3
• Issue: JavaScript trigger contexts expose the real LocalDatabase object with excessive host access.
• Impact: Users with UPDATE_SCHEMA can create triggers that escalate privileges and create admin users.
• References: Advisory (GHSA-38pf-6hp2-pxww)

Why it matters
This is a classic “trusted scripting in the database” problem. If you delegate schema permissions to developers or tenants, review immediately.

Technical Notes

Upgrade target:

# Validate deployed version by checking startup logs or package metadata
docker exec -it arcadedb cat /arcadedb/lib/version.txt 2>/dev/null

Hunt for suspicious trigger creation or user creation events in DB audit logs. Review any JavaScript triggers created by non-admins.

CVE-2026-18588 and CVE-2026-18589: Wavlink WL-NU516U1 remote buffer overflows

• Severity: CVSS 9.8
• Affected: Wavlink WL-NU516U1 708c073-mt7628
• Issues:
• CVE-2026-18588: stack-based buffer overflow tied to CONTENT_LENGTH handling in nas.cgi
• CVE-2026-18589: stack-based buffer overflow in change_password via User1Passwd
• Impact: Remote exploitation is possible; one advisory notes public exploit availability.
• References: Firmware link (firmware), research write-up (report), VulDB entries (CVE-2026-18588, CVE-2026-18589)

Why it matters
SMB and branch-office networking gear often stays unmonitored. If these devices are internet-exposed or reachable from guest or untrusted segments, patching should be prioritized.

Technical Notes

Review exposed admin interfaces:

nmap -Pn -p 80,443,8080,8443 <target-range>

If the device is present, confirm firmware and apply vendor-provided update promptly. Restrict administrative access to trusted management networks only.

What Defenders Should Do Today

1. Prioritize patching by exposure, not just CVSS

Start with: - Internet-exposed Wavlink devices - FreeRDP clients used to access external or semi-trusted environments - PyAthena installations in shared analytics or web-backed workflows - ArcadeDB instances where schema privileges are delegated

A simple prioritization matrix:

Priority 1: Internet-facing + known exploitation path + high privileges
Priority 2: Internal admin/client tools touching untrusted systems
Priority 3: Segmented assets with strong compensating controls

2. Recheck OT and third-party remote access

For energy and industrial environments: - Disable dormant vendor accounts - Enforce MFA on all remote pathways - Require jump hosts with central logging - Limit remote sessions by schedule and plant/site scope - Verify backups for OT-relevant Windows and Linux hosts, not just PLC logic repositories

3. Prepare for AI-assisted social engineering

Update security operations and user awareness for: - Deepfake voice impersonation of executives - AI-generated voicemail and callback fraud - Improved phishing grammar and business context - Faster multi-channel attacks spanning email, SMS, and phone

Example verification policy language:

No password reset, MFA reset, bank detail change, or urgent payment request
is approved from a single communication channel alone.
A second trusted channel is mandatory.

4. Measure ransomware readiness in dollars and downtime

Passaic County’s experience is a good prompt to calculate: - Recovery labor costs - Forensics and legal spend - Lost productivity - Public service impact - Identity rebuild duration - Backup restore time for core systems

If leadership only sees ransom as the variable cost, they are missing the larger operational risk.

5. Review cryptographic trust assumptions in embedded products

The COLDCARD case is a reminder to ask vendors: - How is entropy generated and validated? - Is there independent review of cryptographic implementation? - Are key generation routines reproducibly tested? - What telemetry or indicators exist for flawed seed creation?

Detection and Triage Shortlist

Log and telemetry checks

Focus on: - PyAthena-backed apps: spikes in unexpected DELETE, CTAS, or unusual query text - RDP clients: crashes or anomalies after clipboard interactions - ArcadeDB: trigger creation and unexpected admin account creation - Network appliances: configuration changes, password changes, or access from unusual IPs - Help desks and IAM platforms: abnormal reset requests targeting privileged users

Example hunt ideas

Search Python services for vulnerable dependency:

pip freeze | grep -i pyathena

Identify systems running FreeRDP:

find / -type f \( -name "xfreerdp" -o -name "wfreerdp*" \) 2>/dev/null

Review suspicious account creation patterns:

grep -Ei "create user|add user|new admin|privilege" /var/log/* 2>/dev/null

Final Take

Today’s threat picture is a mix of familiar and important realities: OT supply chain exposure is still a top systemic risk, ransomware costs remain severe even without payment, AI is accelerating social engineering, and several newly disclosed vulnerabilities affect real-world admin and data workflows.

The practical response is straightforward: - patch exposed and high-risk systems first, - tighten third-party access, - harden identity verification against AI-enhanced fraud, - and validate recovery assumptions before the next incident forces the issue.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.