According to the advisory, the threat actors are conducting reconnaissance and building attack capability against internet-exposed Siemens installations using scripts generated by AI tools that are disguised to look like legitimate monitoring software. The attackers rely on internet scanning services to identify controllers running outdated software or otherwise inadequately protected, then use the AI-generated tooling to develop working exploits against them. The advisory specifically calls out a particular access vector already observed in exploitation attempts: SSH sessions running over cellular modems attached to operational technology equipment, providing remote connectivity that bypasses more conventional network perimeter controls entirely.

While the advisory centers on water treatment plants, power facilities, chemical plants, and manufacturing sites, the underlying pattern is not specific to any one industry. Programmable logic controllers of the type described in the advisory are foundational to a huge range of industrial and critical infrastructure environments, including the operational technology that keeps airports running. Baggage handling systems, HVAC and environmental controls, fuel farm management, elevators and people-movers, and various building automation systems across large airports commonly rely on PLCs from major industrial vendors, sometimes including exactly the kind of Siemens equipment named in this advisory.

That overlap matters because aviation’s cybersecurity conversation has, for good reason, spent considerable energy on aircraft systems, passenger data, and airline IT infrastructure. Airport ground-side operational technology has historically received comparatively less attention, despite being just as capable of causing serious disruption if compromised. A PLC controlling baggage handling or environmental systems at a major hub does not need to touch an aircraft’s avionics to create a significant operational and safety headache if it is taken offline or manipulated.

The advisory’s top mitigations are straightforward in principle: inventory all Siemens S7 series controllers across an organization’s environment, apply available security patches, and ensure PLCs are not directly accessible from the public internet. Where remote access is genuinely necessary for monitoring purposes, the agencies specify that connectivity should route through properly configured VPNs with multi-factor authentication, not direct port forwarding and not unmanaged cellular modem connections. Simple as this sounds, it requires organizations to actually know what OT equipment they have deployed and how it is connected, which is a nontrivial undertaking in large, decades-old airport infrastructure built up in layers over many years.

The AI dimension of this advisory deserves separate attention from the OT dimension. Government agencies have been publicly warning for some time that AI tools are lowering the barrier to entry for less sophisticated attackers to conduct reconnaissance and build working exploits. This advisory is a concrete, field-observed example of that warning materializing rather than a projection about future risk. For organizations across aviation and other critical infrastructure sectors, the message is that the gap between disclosure of a vulnerability and its exploitation in the wild is compressing, and that OT inventory and exposure management can no longer be treated as a lower priority than IT-side cybersecurity work.

Source: CISA / TechTimes - Feds Confirm AI Is Writing Exploits for Siemens PLCs Used in Water and Energy
https://www.techtimes.com/articles/325080/20260820/feds-confirm-ai-writing-exploits-siemens-plcs-used-water-energy.htm

According to the council, the campaign combined several attack techniques at once. These reportedly included attempts to breach digital networks directly, efforts to compromise user accounts and operational data, and targeted phishing campaigns designed to use employees as an entry point into otherwise well-defended environments. That mix is a familiar pattern in modern critical-infrastructure attacks: rather than relying on a single vulnerability, adversaries probe several avenues simultaneously and look for whichever one gives up first.

This marks the third major critical-infrastructure campaign against the UAE disclosed publicly in 2026. In July, the council said it had also detected and blocked a sophisticated intrusion effort against financial-sector organizations. Threat intelligence analysts covering the region have noted that Middle Eastern academic institutions alone accounted for a meaningful share of global targeting of the education sector over the past year, and that groups with suspected ties to Iran have been actively working to gain footholds inside universities and other research-linked organizations in the region.

For aviation specifically, the inclusion of the sector alongside energy and education is a signal worth paying attention to. Airports, airlines, and their supporting infrastructure sit inside the same category of high-value, high-disruption targets that motivate this kind of coordinated activity. An attacker does not need to compromise a cockpit system to cause real damage; disrupting ticketing platforms, staff account access, scheduling tools, or operational data can be enough to create cascading delays and reputational harm, all without ever touching flight-critical avionics.

Security analysts following the disclosure pointed to a broader shift in how organizations need to think about this kind of threat. Rather than focusing purely on detecting an attack once it is underway, several noted that organizations are increasingly expected to understand who their likely adversaries are and how those adversaries typically operate, so that defenses can be built around specific tactics rather than generic hygiene. Artificial intelligence was also flagged as a factor reshaping the threat landscape, with researchers noting that AI tools are lowering the barrier for attackers to conduct reconnaissance, craft convincing phishing content, and automate parts of an intrusion that previously required more manual effort.

What stands out about the UAE’s response is the emphasis on proactive containment rather than after-the-fact recovery. The council described specialized teams identifying malicious activity, tracing its origin and indicators of compromise, and applying technical countermeasures to neutralize the threat while blocking further infiltration attempts. That kind of layered, intelligence-driven response reflects a maturing national cybersecurity posture, one that treats aviation and other critical sectors as part of an integrated defense picture rather than isolated silos each responsible for their own protection.

For aviation stakeholders elsewhere, the incident is a useful data point regardless of geography. Coordinated, multi-vector campaigns against national critical infrastructure are not isolated to any one region, and aviation organizations are consistently named as priority targets alongside energy and finance. Aviation now sits squarely inside national critical-infrastructure threat models alongside those sectors, and resilience increasingly depends on rapid detection and containment rather than the assumption that an attack can be prevented entirely.

Source: AGBI (Arabian Gulf Business Insight) - UAE thwarts cyberattacks on aviation, energy and education
https://www.agbi.com/cybersecurity/2026/08/uae-thwarts-cyberattacks-on-aviation-energy-and-education/

Until now, the EU’s mandatory occurrence reporting list was built primarily around traditional crewed aviation events. The update adds specific categories tied to drone operations and the broader U-space framework, the EU’s system for managing low-altitude uncrewed traffic. Under the new rules, operators must report incidents such as a UAS operation that exceeds the operational volume authorized under its permit or the privileges of a Light UAS operator certificate, as well as cases of inadequate operational planning, including failures in contingency procedures, operational volume management, or tactical mitigation performance requirements, that endangered another aircraft or person. The regulation also formally brings Part-IS occurrences, meaning information security incidents falling under EASA’s existing information security management framework, into the mandatory reporting structure, while removing certain aviation security occurrences from the list entirely.

The update reflects the EU’s ongoing effort to keep its occurrence reporting architecture aligned with how the aviation ecosystem has actually changed. When the original 2015 regulation was written, uncrewed aircraft operations at meaningful scale and the U-space concept were not yet significant features of European airspace. Both have since expanded considerably, and the regulatory reporting structure had not kept pace with categories specific to that growth. By explicitly naming UAS and U-space occurrence types, the Commission is signaling that incidents involving drones are expected to be captured with the same rigor as incidents involving crewed aircraft, rather than treated as a separate, lower-priority reporting stream.

The inclusion of Part-IS occurrences in this same update is notable because it formally links information security incidents to the same mandatory reporting infrastructure used for safety occurrences more broadly. Part-IS, the EU’s information security management framework for aviation organizations, has been phasing in compliance deadlines across different categories of operators since 2025. Folding Part-IS occurrences into the general occurrence reporting regulation means organizations already building information security management systems under Part-IS now have a clearer regulatory expectation that qualifying cyber and information security events flow into the same reporting channel used for safety data, rather than sitting in a separate or informal process.

For aviation organizations operating in or into the EU, the practical implication is that occurrence reporting programs, and the systems and training that support them, need to be reviewed to ensure they capture the newly specified UAS, U-space, and Part-IS categories. Organizations that already have mature safety reporting cultures will likely find this a matter of expanding existing intake criteria rather than building new infrastructure from scratch, but those still maturing their Part-IS compliance may find this an added prompt to formalize how information security events get identified, classified, and escalated internally.

Takeaway: By folding drone operations, U-space occurrences, and information security incidents into the same mandatory reporting framework used for traditional safety events, EU regulators are treating these as core aviation safety concerns rather than niche or emerging issues, a signal that aviation organizations should expect this kind of integration to continue as digital and uncrewed systems become a larger share of the airspace.

Source: Unmanned Airspace - European Union updates incident mandatory reporting mechanism, extending drones and U-space coverage

https://www.unmannedairspace.info/news-first/european-union-updates-incident-mandatory-reporting-mechanism-extending-drones-and-u-space-coverage/

The report also concluded that the Transportation Security Administration has not maintained an up-to-date cybersecurity strategy for aviation. GAO found that TSA continues to rely on a roadmap developed in 2018 that is no longer aligned with the Department of Homeland Security’s current cybersecurity strategy. The agency had also not clearly assigned responsibility for implementing cybersecurity objectives or fully defined its oversight role for airport and airline cybersecurity programs.

Cybersecurity Dive notes that these findings come as cyber threats continue to grow across the aviation sector, with increasing reliance on interconnected digital systems throughout airports, airlines, and air traffic management. The report emphasizes that strengthening governance and modernizing cybersecurity programs are becoming increasingly important as operational technology and information technology environments continue to converge.

GAO issued several recommendations, including updating TSA’s cybersecurity roadmap, clearly assigning implementation responsibilities, improving FAA cybersecurity reporting, advancing zero trust planning, and strengthening oversight of cybersecurity strategy execution. The report underscores that effective governance and sustained implementation are essential to improving cyber resilience across the aviation ecosystem.

Source: Cybersecurity Dive. Aviation cybersecurity oversight gaps leave FAA, TSA exposed, GAO says

https://www.cybersecuritydive.com/news/aviation-cybersecurity-faa-tsa-gao-report/825416/

The audit also identified significant weaknesses in the Transportation Security Administration’s cybersecurity planning. TSA continues to rely on a Cybersecurity Roadmap dating from 2018, which the GAO found was not aligned with the Department of Homeland Security’s current strategy. The agency had also not clearly assigned responsibility for implementing its cybersecurity goals or fully defined its role in overseeing airport and airline cybersecurity programs.

These oversight gaps matter as aircraft and aviation infrastructure become increasingly connected to air traffic control facilities, weather services, navigation systems, satellites, and other external networks. The article notes that reported aviation-sector vulnerabilities have included poor software patching, internet-accessible operational technology, unsupported operating systems, insecure remote services, weak network segmentation, and default credentials.

The GAO issued five recommendations, including updating TSA’s Cybersecurity Roadmap, assigning clear responsibilities, aligning the plan with DHS strategy, improving FAA cybersecurity spending reporting, strengthening its zero-trust transition plan, and establishing better monitoring of its revised cybersecurity strategy. The findings reinforce the need for clearly defined accountability, measurable implementation, and coordinated oversight across the aviation ecosystem.

Source: Biometric Update. Federal Audit Finds Major Gaps in US Aviation Cybersecurity Oversight

https://www.biometricupdate.com/202607/federal-audit-finds-major-gaps-in-us-aviation-cybersecurity-oversight

While the public discussion has largely focused on the political aspects of the event, the incident also serves as a reminder that airport security measures exist to reduce operational risk. Unattended vehicles in restricted areas can create unnecessary security concerns, disrupt airport operations, and require immediate action from airport personnel responsible for maintaining a safe operating environment. International airports rely on standardized procedures to ensure that security decisions remain consistent and are applied without exception.

As airports continue to modernize, physical security and cybersecurity are becoming increasingly interconnected. Surveillance systems, access control platforms, digital monitoring, and operational technologies all contribute to maintaining situational awareness across airport infrastructure. Effective security depends not only on technology, but also on the consistent enforcement of established procedures and the ability to rapidly identify and respond to potential risks.

For the aviation industry, the broader takeaway extends beyond this individual incident. Maintaining operational resilience requires a layered security approach where physical security, cyber resilience, and standardized operational procedures work together. Consistent enforcement helps strengthen trust in airport operations while supporting the safe and secure movement of passengers, personnel, and aircraft.

Source: Streamline Feed. Aviation Minister Keyamo Issues 7-Day Ultimatum to Peter Obi Over Airport Security Breach

https://streamlinefeed.co.ke/news/aviation-minister-keyamo-issues-7-day-ultimatum-to-peter-obi-over-airport-security-breach

The latest update expands previous guidance by adding standardized pilot and air traffic control phraseology, incorporating Electronic Flight Bag (EFB) considerations, strengthening operational and training recommendations, and encouraging air traffic services to ensure sufficient capacity during interference events. The revisions build on findings from the joint EASA-EUROCONTROL task force established to address the growing impact of GNSS disruption across Europe.

EASA notes that jamming and spoofing incidents have increased significantly since 2022, particularly around conflict zones and other sensitive regions, including parts of the Mediterranean, Black Sea, Baltic Sea, Middle East, and Arctic. These events can degrade aircraft navigation and surveillance systems, creating operational challenges that require crews to rely on alternative navigation methods and enhanced situational awareness.

For the aviation industry, the updated guidance reflects a broader shift toward building resilience against electronic interference. As GNSS disruptions become more frequent and sophisticated, organizations will need to combine operational procedures, crew training, threat intelligence, and technology to maintain safe operations in increasingly contested environments. Strengthening preparedness today will be essential for supporting both operational continuity and regulatory readiness in the years ahead.

Source: Runway Girl Network. EASA Updates Aircraft GNSS Jamming and Spoofing Guidance
https://runwaygirlnetwork.com/2026/07/easa-updates-aircraft-gnss-jamming-and-spoofing-guidance/

As digital technologies become more deeply integrated into aviation, policymakers identified cybersecurity, artificial intelligence, drones, and smaller airports as areas requiring updated regulations. The discussion highlighted that future rules should provide clarity and predictability for the industry without creating unnecessary operational burdens, allowing organizations to adopt new technologies while maintaining safety and compliance.

The meeting also reinforced the importance of developing aviation expertise alongside regulatory modernization. Expanding technical knowledge within aviation authorities, strengthening collaboration with universities, and attracting the next generation of aviation professionals were identified as essential for implementing new European requirements and supporting the long-term resilience of the sector.

For the aviation industry, the conversation reflects a broader shift taking place across Europe. Cybersecurity is increasingly being considered alongside safety, artificial intelligence, and emerging technologies as part of the regulatory landscape. As regulations continue to evolve, organizations that proactively strengthen cyber resilience and prepare for future compliance requirements will be better positioned to adapt to the next generation of aviation operations.

Source: Fakti News. Georgi Peev: Flight Safety Is a Top Priority, and Rules Must Support the Development of Aviation

https://fakti.bg/en/bulgaria/1065962-georgi-peev-flight-safety-is-a-top-priority-and-rules-must-support-the-development-of-aviation

A recent audit conducted by the U.S. Department of Transportation’s Office of Inspector General identified significant cybersecurity gaps within systems supporting the Federal Aviation Administration’s National Airspace System (NAS).

According to the audit, the FAA has not fully implemented required cybersecurity protections across 45 high-impact systems whose compromise could have severe operational consequences. The findings raise important questions about cybersecurity governance, risk management, and resilience within critical aviation infrastructure.

Key Audit Findings

The audit found that the FAA has made progress in implementing cybersecurity controls but important gaps remain.

Among the findings:

• 45 high-impact systems were reviewed

• 1,836 required security controls had not been fully implemented

• 15 systems were still operating under outdated NIST security standards

• Vulnerability tracking and documentation processes were incomplete

These systems support critical functions across the National Airspace System, including communications, surveillance, navigation, weather services, and air traffic management.

Why This Matters

Air traffic control systems form the backbone of modern aviation operations.

While the audit did not identify a specific cyber incident, it highlighted weaknesses that could increase exposure to future cyber threats if left unresolved. Cybersecurity deficiencies within critical infrastructure can affect operational continuity, situational awareness, and the ability to respond effectively to emerging threats.

As aviation systems become increasingly digital and interconnected, cybersecurity governance is becoming as important as traditional operational safety controls.

The Regulatory Perspective

The FAA audit reflects a broader trend across the aviation sector. Regulators worldwide are placing greater emphasis on cybersecurity risk management, asset visibility, vulnerability management, and organizational accountability.

Frameworks such as EASA Part-IS require organizations to identify cyber risks, implement appropriate controls, and demonstrate continuous oversight of security-related processes.

The findings from the FAA audit serve as a reminder that cybersecurity compliance is not a one-time exercise. It requires ongoing monitoring, documentation, remediation, and executive-level attention.

CYVIATION Perspective

The audit demonstrates that even highly regulated aviation environments continue to face cybersecurity implementation challenges.

Cybersecurity is no longer solely an information technology function. It is an operational requirement that directly supports safety, resilience, and regulatory compliance.

Organizations should continuously evaluate whether security controls are fully implemented, vulnerabilities are properly tracked, and critical systems maintain visibility across the operational environment.

As regulators continue to strengthen cybersecurity expectations, proactive governance and continuous risk management will become increasingly important across the aviation ecosystem.