This roundup covers four items from recent Root.cz security coverage, distilled for quick reading:
- GitLab GraphQL CVE-2026-19478 — critical unauthenticated read exposure on self-managed GitLab (CVSS 9.4). Self-hosted operators should patch immediately.
- US critical-infrastructure SCADA/PLC attacks — NSA/CISA/FBI advisory AA26-231A reports Siemens S7 PLCs targeted across multiple US states; Censys and ZoomEye are running scans to find internet-exposed PLCs (python-snap7/snap7.dll memory read/write surface). OT exposure = business risk.
- DOJ charges: 17 Iranians linked to a suspected IP theft ring — targeting ~300 US universities, compromising ~8,000 accounts and exfiltrating at least 31.5 TB of data worth roughly $3.4B in research IP via phishing that impersonates academics.
- „Zombie Card“ attack (USENIX Security Symposium) — malware that reactivates expired contactless Visa cards by simulating the NFC tap with a compromised phone.
Bottom line: keep self-managed tooling patched, treat internet-facing PLCs as hostile territory, and assume academic phishing is live everywhere credentials sit together.