THE CRUNCH
An autonomous AI agent called Cipher found four previously unknown vulnerabilities in EPICS, a decades-old open source toolkit used to control particle accelerators, fusion experiments and other major scientific facilities. The most serious is a critical integer overflow flaw, rated 9.8 under CVSS v3.1, that could let attackers write outside the bounds of heap memory and potentially execute code remotely. Cipher investigated the unfamiliar system and validated all four exploits in three hours and 49 minutes, with no human intervention during the initial investigation, according to Causal Security co-founder Shubham Raj.
The other three flaws, all rated high severity, include improper message-length validation (8.2) that can crash the controller process, insufficient bounds checking (7.5) allowing out-of-bounds memory reads, and a type confusion bug (7.5) that can cause denial of service and expose adjacent memory contents. All four affect EPICS Base, and the US Cybersecurity and Infrastructure Security Agency (CISA) warned in a Tuesday advisory that exploitation could allow denial-of-service conditions, memory corruption, information disclosure or potentially arbitrary code execution.
EPICS, originally developed by Los Alamos and Argonne national laboratories, connects operators to physical equipment in around 90 major scientific, university and industrial projects, including Argonne's Advanced Photon Source and ITER's fusion reactor control system. Raj noted that exploitation requires reaching the vulnerable services on a facility's control network, which becomes possible if networks are poorly segmented, but does not require deep operational technology expertise. It is not the agent's first industrial find: earlier this year Cipher reportedly uncovered critical attack paths in power-grid systems used across North America and Europe, prompting an October 8 CISA advisory.
Organizations should update to EPICS Base version 7.0.11, which includes the fixes.