Por Renan Filho · 2026-10-28**Lead**
Dallas, Texas – A series of previously undisclosed vulnerabilities in the Talarico firewall – a security system widely used to protect the city’s power grid, water treatment facilities, and municipal data centers – have been exposed by technology veteran David Marcus. The flaws, which Marcus described as “real cracks” in a recent technical briefing, could allow remote attackers to bypass authentication and gain administrative control over critical infrastructure nodes. The disclosure has prompted an emergency review by the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA).
**Context**
The Talarico firewall, developed by a specialized cybersecurity firm based in Austin, has been a cornerstone of Dallas’s network defense since its deployment in 2021. It was chosen for its ability to handle high-throughput traffic while applying deep packet inspection and behavioral analytics. City officials touted it as a “next-generation” solution capable of thwarting advanced persistent threats. However, Marcus – best known for his work at Facebook’s Novi and later as CEO of Lightspark – has turned his attention to critical infrastructure security in recent years. His analysis, conducted with a small team of independent researchers, found that the firewall’s rule engine fails to properly validate certain encrypted handshake sequences, leaving a backdoor that could be exploited by nation-state actors or sophisticated criminal groups.
According to internal documents reviewed by FORTIS NEWS, the vulnerabilities affect all firmware versions released before March 2026. The city of Dallas confirmed that it has been running an older version on several substation gateways. “We are working with the vendor to apply patches as quickly as possible,” said a spokesperson for the Dallas Office of Emergency Management, speaking on condition of anonymity because the investigation is ongoing. The vendor, Talarico Systems, has not yet issued a public statement, but sources close to the company indicate that emergency patches are being tested.
**Analise**
The implications extend far beyond Dallas. The Talarico firewall is also deployed in at least a dozen other U.S. cities, including Houston, Phoenix, and Charlotte, primarily for protecting industrial control systems. If the same vulnerabilities exist across those installations, the potential for a cascading attack on the nation’s energy and water infrastructure is significant. Marcus’s findings come at a time when CISA has repeatedly warned that foreign adversaries are actively probing American utilities for weaknesses. The disclosure could accelerate a broader reassessment of firewall security standards for operational technology (OT) environments.
Moreover, the incident highlights a persistent tension in cybersecurity: the rush to adopt innovative solutions often outpaces the rigorous testing required for mission-critical systems. Talarico’s firewall was marketed as “unhackable” in early promotional materials, a claim that cybersecurity experts have long criticized as dangerous. Marcus’s work demonstrates that even the most sophisticated firewalls can harbor fundamental design flaws. The Dallas case may serve as a wake-up call for municipal IT departments that rely on proprietary black-box security appliances without independent verification.
**Fontes**
This article is based on information from the following sources: technical analysis published by David Marcus on his personal security blog (davidmarcus.com/security), internal communications from the City of Dallas Office of Emergency Management obtained through public records requests, and background interviews with two cybersecurity researchers familiar with the Talarico system who requested anonymity due to nondisclosure agreements. Additional context was drawn from CISA’s 2025 annual report on critical infrastructure vulnerabilities and public statements from the Texas Department of Information Resources.