CISA: Hackers Hit 100+ Water Utility Controllers Across 12 US States Using Default Passwords

·1 views

CISA reported in July 2026 that malicious actors targeted over 100 internet-exposed programmable logic controllers at water and wastewater facilities across at least 12 US states. Attackers used unsophisticated methods — scanning for exposed devices, logging in with default or weak credentials, changing admin passwords, and altering IP addresses to lock out legitimate operators. The intrusions caused loss of remote monitoring capability, with some utilities forced to resort to manual valve operation and pressure readings; physical consequences included localised flooding and pressure loss. The vulnerabilities stem from legacy PLCs lacking encryption or authentication, combined with undocumented cellular modems attached directly to controllers for convenient remote access. CISA recommends eliminating direct internet exposure, enforcing strong credentials, segmenting networks, maintaining offline configuration backups, and auditing all undocumented remote connections.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Proposes 50/10 Work-Rest Cycles to Replace Pomodoro for Deep Coding

A software developer argues that the popular Pomodoro technique's 25-minute work blocks are too short for deep coding, as engineers need more time to load complex mental models into working memory. He advocates for a '50/10 Protocol' — 50 minutes of uninterrupted coding followed by a 10-minute structural break — which he claims better supports reaching a flow state. The approach, which he calls 'Silent Runtime,' also emphasizes a distraction-free environment, including closed tabs, Do Not Disturb mode, and no phone nearby. An additional element of the protocol involves listening to ambient techno music at 80 BPM, which the author says conditions the brain over time to enter focus mode on cue. He has built a three-hour session around three consecutive 50/10 cycles and shares the full protocol through his YouTube channel.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

When AI Does Everything: The Risk of Humanity Forgetting How to Think

A growing concern among technologists is not that AI will rebel or malfunction, but that it may work so well humans gradually lose the ability to understand or rebuild the systems they rely on. The essay draws a parallel to ancient Egyptian hieroglyphs, where the written knowledge survived intact but the human tradition needed to interpret it vanished. Modern technological progress has always relied on layered abstraction, with each generation building on prior knowledge without mastering every underlying detail. The critical difference with AI is that it may begin absorbing entire layers of human expertise, leaving no people inside those layers to teach or transfer that knowledge. This raises the prospect of a civilization that remains technically functional as long as its AI systems operate, but lacks the human understanding needed to recover if those systems ever fail.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Semantic Versioning Explained: What MAJOR, MINOR, and PATCH Numbers Mean

Semantic Versioning, or SemVer, is a widely adopted convention that formats software version numbers as MAJOR.MINOR.PATCH, with each position carrying a distinct meaning. The MAJOR number increments for breaking changes, MINOR for backward-compatible new features, and PATCH for backward-compatible bug fixes. This structure lets developers instantly gauge the risk of applying an update without reading full release notes. A common implementation pitfall involves comparing version strings lexicographically, which causes "1.10.0" to incorrectly rank lower than "1.9.0". The correct approach is to split each version string on dots, convert segments to integers, and compare the resulting numeric tuples.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How WebRTC Handles Real-Time Media at Scale: Signaling, NAT and Architecture

WebRTC is an open browser standard that enables peer-to-peer audio, video, and data exchange without plugins, using three core JavaScript APIs: RTCPeerConnection, MediaStream, and RTCDataChannel. The specification deliberately omits signaling — the mechanism by which peers discover and describe themselves to each other — leaving developers to implement it typically via WebSockets or HTTP long polling using SDP-formatted messages. Once peers exchange descriptions, ICE (Interactive Connectivity Establishment) handles NAT traversal by gathering reachable network addresses through STUN and TURN servers and testing them until a working path is found. For multi-party calls, architects must choose between a peer-to-peer mesh, a Selective Forwarding Unit (SFU), or a Multipoint Conferencing Unit (MCU), each offering different tradeoffs in bandwidth, processing load, and scalability. The article explores how signaling servers can be built to operate under load and examines browser support, security, and reliability considerations for production WebRTC deployments.

0 comments Read more at DEV Community