The Matthew Chapman Podcast

Why Exposed PLCs And AI Memory Poisoning Matter

Share episode

Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.

0:00 | 5:31

Here is your briefing for Thursday, August 6, 2026. Over 4,400 Rockwell PLCs Exposed Online, 22 Found in Water Attack Cities Forescout scanned the internet and found more than four thousand four hundred exposed Rockwell Automation programmable logic controllers worldwide, including twenty-two in cities already hit by recent cyberattacks on US water utilities. Nineteen of those sat on the same mobile carrier network. The company could not confirm any had been compromised, but the exposure alone is the story. Attackers in the water incidents did not need zero-days. They changed IP addresses and set passwords on controllers that were already reachable from the internet, knocking operators blind and sometimes seizing control. The FBI and EPA have tracked incidents across at least seven states since July twenty-seventh. No one has explained how the attackers located or initially accessed the targets. That's the headline from Forescout, and honestly, the numbers are worse than they look. These are not theoretical exposures. They are live devices in critical infrastructure that defenders have known about for years. If basic reachability is still this widespread, the patch-and-pray model is failing in the places it matters most. AI Recommendation Poisoning: How "Ask AI" Buttons Silently Alter LLM Memory A new class of prompt injection is spreading across commercial websites with no malware, no credentials, and no zero-day required. Sites are embedding hidden payloads inside "Ask AI" buttons on marketing and competitor comparison pages. When a logged-in user of ChatGPT, Claude, Gemini, or Grok clicks one, the pre-formed query executes immediately with no confirmation. The dangerous versions instruct the model to permanently save the vendor's domain as a "trusted source," quietly biasing every future answer in that vendor's favor. Microsoft Security catalogued the behavior as AI Recommendation Poisoning back in February, identifying thirty-one companies across fourteen industries already deploying it. That's the headline from the researchers who found it, and the mechanism is elegant in its simplicity. It turns a feature users expect to be helpful into a persistent memory poison. Once the model treats the attacker-controlled domain as authoritative, the bias sticks across sessions. The attack surface just expanded from the prompt to the entire conversation history. AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model Security flaws in agent infrastructure from Amazon Web Services, Google, and Vercel let untrusted or forged instructions reach an agent's tools with no check that a model turn had authorized them. In several attack paths the model never ran at all, so system prompts, content filters, and guardrails never got a chance to intervene. The affected products include Amazon Bedrock AgentCore's InvokeHarness API, Google's Agent Development Kit for Python, and Vercel AI SDK harness packages. AWS has fixed the managed service. Google addressed the issues in ADK 2.5.0. Vercel patched the relevant packages in versions 1.0.29 and 1.0.28. That's the headline from the security teams that disclosed it, and the implication is uncomfortable. Agent frameworks are being built on the assumption that the model is the gatekeeper. When that assumption breaks, the entire tool-calling layer becomes a direct execution path for attackers. The fixes are out, but the architectural lesson is clear: authorization must happen before the tool call, not after the model thinks about it. Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells VulnCheck researchers disclosed a factory-shipped backdoor present in at least twenty Chinese router models from Zbtlink. The implant appears in every firmware image the company has released over more than two years. It beacons to Chinese command-and-control infrastructure as often as every thirty-five seconds and masquerades as a legitimate Linux kernel thread while running with root privileges. The tool, called rctl, has been on GitHub since twenty-fifteen and never updated. It implements a simple remote control interface that starts automatically on boot. The backdoors have been codenamed ENDLESSDOORS. That's the headline from VulnCheck, and the supply chain angle is the real problem. These are not compromised updates or third-party malware. They are intentional implants baked into the firmware at the factory. Anyone buying these routers for home or small business use has been shipping a persistent root shell to Chinese infrastructure for years. Ransom Cartel Creator Gets 16 Years in Prison for Operating Ransomware-as-a-Service A federal judge in Alexandria, Virginia sentenced Maksim Silnikau to sixteen years in prison on August fifth for creating and running Ransom Cartel, the ransomware-as-a-service operation he stood up in twenty-twenty-one. Between twenty-twenty-one and twenty-twenty-three the group attacked at least eighteen companies across multiple states and countries. Silnikau built the infrastructure, bought initial access, ran the affiliate panel, and pushed payments through cryptocurrency mixers. He did not carry out most intrusions himself. He built the business around them and let affiliates do the work while taking a cut. The sentence is sixteen years, longer than the thirteen years and seven months handed to another RaaS operator earlier this year. That's the headline from the Department of Justice, and the message is straightforward. Building and operating a ransomware franchise at scale now carries real prison time, not just fines or asset seizures. Whether that deters the next operator is another question, but the precedent is set. Five stories, one through-line: the fundamentals are still broken. Critical infrastructure devices remain exposed in the thousands. New AI attack patterns are being deployed in production before most teams have heard the term. Agent frameworks assume model-level authorization that does not always happen. IoT vendors are still shipping root shells. And even successful law enforcement actions against RaaS crews come after years of damage. The attack surface keeps expanding while the basics of reachability, supply chain integrity, and authorization remain unsolved. That gap is not theoretical anymore. That’s the briefing. Stay sharp, patch your systems, and we’ll see you tomorrow.

Support the show

Today’s Cyber Briefing Setup

SPEAKER_00

Here's your briefing for Thursday, august sixth, twenty twenty six. Over four

Exposed PLCs Hit Water Utilities

SPEAKER_00

thousand four hundred Rockwell PLCs exposed online, twenty two found in water attack cities, Four Scouts scanned the internet and found more than four thousand four hundred exposed Rockwell automation programmable logic controllers worldwide, including twenty-two in cities already hit by recent cyber attacks on U.S. water utilities. Nineteen of those sat on the same mobile carrier network. The company could not confirm any had been compromised, but the exposure alone is the story. Attackers in the water incidents did not need zero days. They changed IP addresses and set passwords on controllers that were already reachable from the internet, knocking operators blind and sometimes seizing control. The FBI and EPA have tracked incidents across at least seven states since july twenty seventh. No one has explained how the attackers located or initially accessed the targets. That's the headline from Forescout. And honestly, the numbers are worse than they look. These are not theoretical exposures. They are live devices and critical infrastructure that defenders have known about for years. If basic reachability is still this widespread, the patch and prey model is failing in the places it matters most.

Ask AI Buttons Poison LLM Memory

SPEAKER_00

AI recommendation poisoning. How Ask AI buttons silently alter LLM memory. A new class of prompt injection is spreading across commercial websites with no malware, no credentials, and no zero day required. Sites are embedding hidden payloads inside Ask AI buttons on marketing and competitor comparison pages when a logged in user of ChatGPT, Claude, Gemini, or Grok clicks one, the preformed query executes immediately with no confirmation. The dangerous versions instruct the model to permanently save the vendor's domain as a trusted source, quietly biasing every future answer in that vendor's favor. Microsoft Security cataloged the behavior as AI recommendation poisoning back in February, identifying thirty-one companies across fourteen industries already deploying it. That's the headline from the researchers who found it, and the mechanism is elegant in its simplicity. It turns a feature users expect to be helpful into a persistent memory poison. Once the model treats the attacker controlled domain as authoritative, the bias sticks across sessions. The attack surface just expanded from the prompt to the entire conversation history.

Agent Tools Triggered Without Models

SPEAKER_00

AWS, Google and Vercell agent flaws let attackers trigger tools without running the model. Security flaws in agent infrastructure from Amazon Web Services, Google and Vercel let untrusted or forged instructions reach an agent's tools with no check that a model turn had authorized them. In several attack paths, the model never ran at all, so system prompts, content filters, and guardrails never got a chance to intervene. The affected products include Amazon Bedrock Agent Cores, Invoke Harness, API, Google's agent development kit for Python, and Vercel AI SDK Harness Packages. AWS has fixed the managed service. Google addressed the issues in ADK 2.5 voids, Vercel patched the relevant packages in versions 1.0.29 and 1.0.28. That's the headline from the security teams that disclosed it, and the implication is uncomfortable. Agent frameworks are being built on the assumption that the model is the gatekeeper. When that assumption breaks, the entire tool calling layer becomes a direct execution path for attackers. The fixes are out, but the architectural lesson is clear. Authorization must happen before the tool call, not after the model thinks about it.

Router Backdoor Ships With Root Shell

SPEAKER_00

Chinese made ZBT Link, router ship with backdoor, that opens unauthenticated root shells. Volncheck researchers disclosed a factory ship backdoor present in at least twenty Chinese router models from ZBT Link. The implant appears in every firmware image the company has released over more than two years. It beacons to Chinese command and control infrastructure as often as every 35 seconds and masquerades as a legitimate Linux kernel thread while running with root privileges. The tool called RSTTL has been on GitHub since 2015 and never updated. It implements a simple remote control interface that starts automatically on boot. The back doors have been codenamed Endless Doors. That's the headline from Volnchek and the supply chain angle is the real problem. These are not compromised updates or third-party malware. They are intentional implants baked into the firmware at the factory. Anyone buying these routers for home or small business use has been shipping a persistent root shell to Chinese infrastructure for

Ransomware Franchise Lands 16 Years

SPEAKER_00

years. Ransom Cartel Creator gets 16 years in prison for operating ransomware as a service. A federal judge in Alexandria, Virginia sentenced Maxim Silnikau to 16 years in prison on August 5th for creating and running Ransom Cartel. The ransomware as a service operation, he stood up in 2021. Between 2021 and 2023, the group attacked at least 18 companies across multiple states and countries. Silnikau built the infrastructure, bought initial access, ran the affiliate panel, and pushed payments through cryptocurrency mixers. He did not carry out most intrusions himself. He built the business around them and let affiliates do the work while taking a cut. The sentence is sixteen years longer than the thirteen years and seven months handed to another RAS operator earlier this year. That's the headline from the Department of Justice, and the message is straightforward. Building and operating a ransomware franchise at scale now carries real prison time. Not just fines or asset seizures. Whether that deters the next operator is another question, but the precedent

One Through Line And Closing

SPEAKER_00

is set. Five stories, one through line. The fundamentals are still broken. Critical infrastructure devices remain exposed in the thousands. New AI attack patterns are being deployed in production before most teams have heard the term. Agent frameworks assume model level authorization that does not always happen. IoT vendors are still shipping root shells, and even successful law enforcement actions against RAS crews come after years of damage. The attack surface keeps expanding while the basics of reachability, supply chain integrity, and authorization remain unsolved. That gap is not theoretical anymore. That's the briefing. Stay sharp, patch your systems, and we'll see you tomorrow.