https://otasec.com/OT & ICS security news, filtered for asset ownersenhttps://waterfall-security.com/ot-insights-center/ot-cybersecurity-insights-center/php2shell-ai-exploits-long-known-vulnerabilities/otasec-item-5a4cabe3306eSun, 25 Oct 2026 08:46:39 +0000Waterfall Security commentary by Andrew Ginter explains how frontier AI turned long-known PHP vulnerabilities in PHP2Shell into real attacks, and what OT defenders should do about it.https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.htmlotasec-item-f059789b2437Fri, 23 Oct 2026 13:50:56 +0000Researchers report a large campaign that breached exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls and VPNs, gaining access to numerous organizations worldwide.https://therecord.media/uk-undersea-cables-sabotage-new-sentencing-guidelinesotasec-item-b49db17578fdFri, 23 Oct 2026 13:26:00 +0000The UK government proposes raising the maximum prison term for deliberate undersea cable damage to 14 years, updating the Submarine Telegraph Act 1885.https://www.helpnetsecurity.com/2026/10/23/uk-undersea-cable-sabotage-sentences/otasec-item-2d39a164901fFri, 23 Oct 2026 12:37:41 +0000A UK White Paper proposes 14-year jail terms for damaging subsea cables and unlimited fines for ship owners whose vessels cause damage.https://industrialcyber.co/industrial-cyber-attacks/forescout-warns-internet-exposed-refrigeration-controls-could-enable-attacks-on-food-supply-chains-and-hospitals/otasec-item-f84daddd7842Fri, 23 Oct 2026 12:16:14 +0000Forescout Vedere Labs found 12,976 internet-exposed service observations tied to refrigeration control systems, which could enable attacks on food supply chains and hospitals.https://industrialcyber.co/transport/us-coast-guard-releases-nvic-02-26-to-guide-maritime-operators-on-cybersecurity-plans-it-and-ot-risk-assessments/otasec-item-87dc1f0f1435Fri, 23 Oct 2026 12:15:21 +0000The US Coast Guard released NVIC 02-26 to help maritime operators meet cybersecurity plan requirements and assess IT and OT risks.https://industrialcyber.co/news/indurex-secures-e7-million-to-unify-engineering-intelligence-ot-security-and-process-safety/otasec-item-b46fab14e4ffFri, 23 Oct 2026 12:13:11 +0000Indurex raised 7 million euros to develop AI-based engineering intelligence, OT security and process safety for cyber-physical systems.https://industrialcyber.co/news/ninetenths-joins-isasecure-to-support-industrial-cybersecurity-across-energy-water-and-manufacturing/otasec-item-298f2eafd7bcFri, 23 Oct 2026 12:12:47 +0000NineTenths has joined ISASecure, an industrial cybersecurity certification program.https://thehackernews.com/2026/10/russian-linked-hackers-used-new-mesh.htmlotasec-item-80697809b26eFri, 23 Oct 2026 11:11:23 +0000ESET reports Sandworm and UAC-0099 used spear-phishing and a new mesh network backdoor in a destructive wiper attack on a Ukrainian logistics company.https://cert-portal.siemens.com/productcert/html/ssa-566512.htmlotasec-item-74c7d2bd7064Fri, 23 Oct 2026 00:00:00 +0000Siemens advisory SSA-566512 lists RUGGEDCOM APE1808 devices affected by PHP2Shell vulnerabilities in Palo Alto Networks PAN-OS, and points to upstream workarounds.https://cert-portal.siemens.com/productcert/html/ssa-566435.htmlotasec-item-f98b9df9f7d5Fri, 23 Oct 2026 00:00:00 +0000Siemens published advisory SSA-566435 on the impact of the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 on its software products.https://www.security.nl/posting/958571/Amazon%3A+eerste+PHP2Shell-aanvallen+op+17+oktober+waargenomen?channel=rssotasec-item-ef3df745dd44Thu, 22 Oct 2026 11:39:20 +0000Amazon reports the first PHP2Shell attacks were observed on October 17, four days before the vulnerability became publicly known.https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/otasec-item-85df4dcbb77bThu, 22 Oct 2026 10:22:56 +0000Palo Alto Networks confirms all PAN-OS and Panorama versions are affected by PHP2Shell, with no fixed releases yet, while Fortinet and Cisco investigate their products.https://industrialcyber.co/threats-attacks/safepay-ransomware-compromised-600-critical-organizations-worldwide-urge-patching-and-network-defenses/otasec-item-d67e517a4587Thu, 22 Oct 2026 09:03:54 +0000CISA, FBI and partners warn that SafePay ransomware has compromised around 600 critical organizations worldwide and urge patching and network defenses.https://industrialcyber.co/news/black-kite-debuts-quantum-readiness-controls-to-assess-post-quantum-security-across-vendor-ecosystems/otasec-item-c96acbde9ddfThu, 22 Oct 2026 09:03:23 +0000Black Kite released Quantum Readiness, a new product for assessing post-quantum security across vendor ecosystems.https://industrialcyber.co/news/corsha-launches-folio-to-automate-ot-network-mapping-and-industrial-system-documentation/otasec-item-bcf713776055Thu, 22 Oct 2026 09:02:51 +0000Corsha launched Folio, a new module for automating OT network mapping and industrial system documentation.https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01otasec-item-c4ae99f0aab0Thu, 22 Oct 2026 06:00:00 +0000CISA published advisory ICSA-26-295-01 on Kiloview E3 NDI Encoder vulnerabilities that could allow an attacker to fully compromise the device.https://therecord.media/utilities-cybersecurity-initiative-accentureotasec-item-548b69cacce8Wed, 21 Oct 2026 19:45:00 +0000A privately funded $10 million initiative will support up to 500 under-resourced utilities in strengthening their cybersecurity.https://www.forescout.com/research-labs/pqc-in-healthcare-from-data-risk-to-migration-readiness/otasec-item-bf08861d2cbdWed, 21 Oct 2026 18:05:10 +0000Forescout's Vedere Labs examines healthcare security threats, including insecure specialized medical devices and challenges of PQC migration.https://industrialcyber.co/news/accenture-dragos-and-sans-institute-launch-10-million-initiative-to-strengthen-cybersecurity-at-us-utilities/otasec-item-61a6d968b344Wed, 21 Oct 2026 15:54:18 +0000Accenture, Dragos and SANS Institute launch a 10 million dollar initiative to strengthen cyber defenses at under-resourced US utilities.https://therecord.media/ukraine-hackers-russia-grain-sandwormotasec-item-2ee4d03f1beaWed, 21 Oct 2026 14:45:00 +0000Researchers said Russian state-linked Sandworm worked with another threat actor to carry out a destructive attack wiping data at a Ukrainian grain logistics company last year.https://claroty.com/blog/industrial-automation-cybersecurity-for-retail-operations?hss_channel=tw-743739751044288513otasec-item-47ecb227d945Wed, 21 Oct 2026 13:23:59 +0000A Claroty blog argues industrial automation cybersecurity matters for retail operations, citing cyberattacks on French supermarket chains.https://industrialcyber.co/reports/gao-outlines-2027-2032-agenda-for-congressional-oversight-of-federal-cyber-defenses-critical-infrastructure-ai-risks/otasec-item-df4df760d25dWed, 21 Oct 2026 12:48:18 +0000The US GAO outlined a 2027-2032 agenda for congressional oversight of federal cyber defenses, critical infrastructure protection and AI risks.https://industrialcyber.co/risk-management/singapores-csa-and-google-identify-safeguards-and-access-controls-to-address-autonomous-ai-agent-risks/otasec-item-6761372c16a0Wed, 21 Oct 2026 12:39:22 +0000Singapore's CSA and Google convened policymakers and infrastructure leaders to discuss safeguards for autonomous AI agent risks.https://industrialcyber.co/reports/resilience-reports-energy-and-utilities-sector-faces-rising-cyber-exposure-from-ransomware-vulnerable-ot-systems/otasec-item-2ccc2db42542Wed, 21 Oct 2026 12:36:42 +0000Resilience's analysis of energy and utilities cyber insurance claims highlights ransomware and vulnerable OT systems as rising exposures.https://www.helpnetsecurity.com/2026/10/21/ransomware-groups-exploit-palo-alto-globalprotect-cve-2026-0257/otasec-item-941972dab7f2Wed, 21 Oct 2026 11:13:39 +0000Ransomware groups are exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect patched in May, to breach organizations including in healthcare, government and energy.https://www.security.nl/posting/958398/FBI%3A+zeker+zeshonderd+vitale+organisaties+slachtoffer+SafePay-ransomware?channel=rssotasec-item-2ee20e4e3678Wed, 21 Oct 2026 10:14:00 +0000The FBI reports at least 600 organizations in vital sectors across several continents have fallen victim to SafePay ransomware.https://www.bleepingcomputer.com/news/security/cisa-and-fbi-safepay-ransomware-has-hit-over-600-critical-infrastructure-organizations/otasec-item-cb3cb0addfd4Wed, 21 Oct 2026 08:36:24 +0000CISA says the SafePay ransomware gang has breached over 600 critical infrastructure organisations worldwide since 2024.https://industrialcyber.co/news/nozomi-networks-sel-integrate-ot-sdn-visibility-with-ai-powered-cybersecurity-for-critical-infrastructure/otasec-item-4bf9b570dc67Wed, 21 Oct 2026 07:44:22 +0000Nozomi Networks and SEL announced an expansion integrating OT SDN visibility with AI-powered cybersecurity.https://industrialcyber.co/news/dispel-tenable-integrate-ot-asset-intelligence-with-zero-trust-remote-access-controls-to-boost-industrial-cybersecurity/otasec-item-b2505b02737eWed, 21 Oct 2026 07:41:12 +0000Dispel announced an integration with Tenable OT Exposure combining asset intelligence with zero-trust remote access.https://thehackernews.com/2026/10/cisa-orders-federal-agencies-to-patch.htmlotasec-item-f6fe2f9557b7Wed, 21 Oct 2026 07:26:49 +0000CISA added four vulnerabilities, including Siemens flaws, to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch them.https://thehackernews.com/2026/10/hackers-hid-vasilek-backdoor-in-vmware.htmlotasec-item-bd60f0eb51aaWed, 21 Oct 2026 06:05:15 +0000The Belarus-aligned group Partisan Zmiy spent nearly two years in a Russian healthcare network, hiding the Vasilek backdoor in VMware Tools.https://therecord.media/fbi-says-safepay-ransomware-gang-among-most-active-600-victimsotasec-item-a92bc795de6cTue, 20 Oct 2026 20:27:00 +0000The FBI and UK and German cyber agencies say the SafePay ransomware gang targets businesses and critical infrastructure via password guessing, vulnerability exploitation and phishing.https://www.dragos.com/resources/press-release/community-cyber-resilience-foundation-launchotasec-item-db97361e633fTue, 20 Oct 2026 20:07:03 +0000Accenture, Dragos and SANS Institute launch a foundation providing about $10 million in free cyber defense technology and training to up to 500 under-resourced US utilities.https://therecord.media/eu-cyber-law-wont-force-fixes-for-fridges-in-french-attackotasec-item-4cce5b0679d6Tue, 20 Oct 2026 14:55:00 +0000The EU Cyber Resilience Act only requires fixes and free updates during manufacturer-defined support periods, which may not cover fridge controllers hit in a French attack.https://industrialcyber.co/features/upstream-oil-and-gas-securing-operations-across-distance-remoteness-and-harsh-environments/otasec-item-6a247ada56f4Tue, 20 Oct 2026 14:23:31 +0000The article discusses securing upstream oil and gas operations such as wellheads, gathering systems and offshore platforms across remote and harsh environments.https://industrialcyber.co/cisa/cisa-nsa-nist-urge-safeguards-continuous-monitoring-incident-reporting-for-autonomous-super-intelligence-systems/otasec-item-720fecb59bd9Tue, 20 Oct 2026 13:46:00 +0000CISA, NSA, NIST and NCSC urge safeguards, continuous monitoring and incident reporting for autonomous superintelligence AI systems.https://industrialcyber.co/ai/booz-allen-warns-frontier-ai-models-can-exploit-ot-pathways-manipulate-controllers-and-move-robotic-equipment/otasec-item-e7aac3739b67Tue, 20 Oct 2026 12:55:48 +0000Booz Allen reported that frontier AI models achieved all eight objectives in controlled tests, including exploiting OT pathways, manipulating controllers and moving robotic equipment.https://industrialcyber.co/news/tactien-group-launches-cast-platform-for-independent-counter-drone-system-testing-at-critical-infrastructure-sites/otasec-item-4859b4567c7cTue, 20 Oct 2026 12:50:05 +0000The Tactien Group launched CAST, a platform for independent testing of counter-drone systems at critical infrastructure sites.https://industrialcyber.co/isa-iec-62443/isa-iec-standards-require-integrated-safety-and-cybersecurity-for-industrial-control-systems-ot-knights-barreto-jijon-says/otasec-item-6394a78cd8eeTue, 20 Oct 2026 12:49:39 +0000A post on ISASecure argues that asset owners need to integrate functional safety and cybersecurity for industrial control systems under ISA/IEC standards.https://industrialcyber.co/news/advantech-and-dekra-target-industrial-cybersecurity-gaps-as-eu-cyber-resilience-act-implementation-advances/otasec-item-eee1e09256d5Tue, 20 Oct 2026 12:46:07 +0000Advantech and DEKRA are addressing industrial cybersecurity compliance gaps as the EU Cyber Resilience Act enters its implementation phase.https://www.helpnetsecurity.com/2026/10/20/exploitation-siemens-software-center-vulnerability-cve-2026-110936/otasec-item-c55a060410a4Tue, 20 Oct 2026 12:23:08 +0000Siemens confirmed active exploitation of CVE-2026-110936, a DLL side-loading flaw in Siemens Software Center, fixed in version 4.0.9.8, used in a ClickFix malware campaign.https://certvde.com/en/advisories/VDE-2026-090/otasec-item-d8e0edbb10f6Tue, 20 Oct 2026 11:43:35 +0000Festo AX OS versions 25.0.1.46 and 25.9.2.4, based on PLCnext and used in CEPE, are affected by multiple OpenSSL vulnerabilities, CVE-2025-15467 and CVE-2025-69419.https://thehackernews.com/2026/10/russian-apt28-breaches-nato-naval.htmlotasec-item-41525c1156aeTue, 20 Oct 2026 11:06:25 +0000Symantec attributed attacks on two NATO member states, including a naval shipbuilder, to APT28 using the HOOKEDGE backdoor and a new reflective loader.https://certvde.com/en/advisories/VDE-2026-100/otasec-item-4a1a64de03ecTue, 20 Oct 2026 11:00:00 +0000Multiple vulnerabilities in the piControl kernel module of IndustrialPI before version 2.8.0-1 can cause kernel memory corruption and denial of service.https://certvde.com/en/advisories/VDE-2026-101/otasec-item-cba9b30ee73dTue, 20 Oct 2026 11:00:00 +0000PiCtory before 2.17.0 has a CSRF flaw enabling session takeover, and RevPiPyLoad before 0.11.1 lets attackers access or delete arbitrary files via XML-RPC.https://certvde.com/en/advisories/VDE-2026-112/otasec-item-3380f6216ebdTue, 20 Oct 2026 10:00:00 +0000CVE-2026-10109 affects IBM Db2 12.1.2 delivered with METTLER TOLEDO STARe v20.00, related to improper handling of the pre-authentication DRDA handshake.https://www.security.nl/posting/958251/Beveiligingslek+in+Siemens+Software+Center+gebruikt+bij+ClickFix-aanvallen?channel=rssotasec-item-8b08d21799a4Tue, 20 Oct 2026 08:21:31 +0000Siemens reports that a vulnerability in Siemens Software Center was used in ClickFix attacks.https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.htmlotasec-item-4fd8d5a31fd8Tue, 20 Oct 2026 07:11:45 +0000Siemens fixed high-severity DLL sideloading flaw CVE-2026-110936 in Siemens Software Center, which attackers exploit in ClickFix campaigns to deploy a remote access trojan.https://waterfall-security.com/ot-insights-center/ot-cybersecurity-insights-center/get-freezers-off-the-internet/otasec-item-0ad525d6c164Tue, 20 Oct 2026 06:17:23 +0000Practical advice for small retailers and water utilities on removing internet-exposed freezers and OT devices, using a firewall and fixed IP allow-listing.https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-03otasec-item-3750d37afa6eTue, 20 Oct 2026 06:00:00 +0000CISA advisory ICSA-26-293-03 reports Moxa AIG-302 ThingsPro Edge vulnerabilities that could let an attacker obtain and disclose sensitive information.https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-02otasec-item-eb847e15f7e1Tue, 20 Oct 2026 06:00:00 +0000CISA advisory ICSA-26-293-02 reports two WAGO web management flaws letting low-privileged authenticated users bypass privilege boundaries on controllers.https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-01otasec-item-f08dc5775d6eTue, 20 Oct 2026 06:00:00 +0000CISA advisory ICSA-26-293-01 reports PEAK-System PCAN Windows driver vulnerabilities from HMS Networks that could crash the Windows kernel.https://www.helpnetsecurity.com/2026/10/20/frontline-worker-authentication-passwordless/otasec-item-c99937e01285Tue, 20 Oct 2026 04:30:18 +0000A Sapio Research survey of 700 IT and security decision-makers found 95% saw frontline workers bypass MFA and share credentials in healthcare and manufacturing.https://industrialcyber.co/news/dispel-zero-trust-engine-for-oems-to-secure-remote-industrial-service-standardize-access-strengthen-compliance/otasec-item-36fbbcffd6bfMon, 19 Oct 2026 15:34:17 +0000Dispel announced a Zero Trust Engine aimed at OEMs for securing remote industrial service access.https://industrialcyber.co/zero-trust/need-for-enforceable-ai-accountability-zero-trust-security-as-ai-driven-cyber-risks-threaten-critical-infrastructure/otasec-item-a1b7e5284ba8Mon, 19 Oct 2026 13:04:46 +0000An article argues that AI-enabled cyber risks threaten critical infrastructure and calls for enforceable AI accountability and zero-trust security.https://industrialcyber.co/ai/claroty-team82-shows-ai-can-rebuild-danfoss-controller-exploits-in-28-minutes-putting-internet-facing-ot-at-risk/otasec-item-cf857959bd3dMon, 19 Oct 2026 13:00:23 +0000Claroty Team82 reproduced three disclosed Danfoss AK-SM 800A refrigeration controller vulnerabilities using AI in 28 minutes, raising risk for Internet-facing OT.https://industrialcyber.co/ransomware/unit-42-traces-peerstitch-malware-deployment-to-fortios-vulnerability-exploited-after-fortimanager-compromise/otasec-item-3861916e7ed6Mon, 19 Oct 2026 12:57:51 +0000Unit 42 traced Peerstitch malware to a FortiOS flaw exploited after a FortiManager compromise at a telecom managed service provider.https://industrialcyber.co/utilities-energy-power-water-waste/nozomi-outlines-it-and-ot-security-priorities-ahead-of-indias-april-2027-cea-power-sector-cybersecurity-deadline/otasec-item-4a0adadcc4b5Mon, 19 Oct 2026 12:52:21 +0000Nozomi outlines IT and OT security priorities ahead of India's April 2027 power sector cybersecurity deadline set by the CEA.https://www.security.nl/posting/958125/LOXONE+getroffen+door+cyberaanval+maar+klantinstallaties+veilig+en+operationeel?channel=rssotasec-item-4c113474481bMon, 19 Oct 2026 10:09:05 +0000Smart home and building automation vendor LOXONE was hit by a cyberattack on its internal business systems, while customer installations remained secure and operational.https://csrc.nist.gov/pubs/sp/800/82/r4/ipdotasec-item-a58c58e6ddccSat, 17 Oct 2026 12:49:08 +0000NIST released a draft revision 4 of SP 800-82, a guide to securing operational technology across industrial and critical infrastructure systems.https://securityweek.com/only-13-of-ot-network-segments-are-fully-isolated-analysisotasec-item-88196369f563Fri, 16 Oct 2026 17:45:04 +0000Forescout research finds only 13% of OT network segments are fully isolated, with OT and medical devices often sharing segments with enterprise assets.https://industrialcyber.co/features/how-decades-of-disconnected-modernization-created-ot-security-debt-manufacturers-cant-escapeotasec-item-6124a498c474Fri, 16 Oct 2026 13:00:00 +0000An analysis argues that manufacturers' modernization adds connectivity without fixing architectural weaknesses, creating accumulated OT security debt.https://industrialcyber.co/critical-infrastructure/singapore-prioritizes-critical-infrastructure-in-quantum-safe-push-funds-cryptographic-discovery-legacy-ot-migrationotasec-item-817f84d5897bFri, 16 Oct 2026 10:25:41 +0000Singapore's CSA issued quantum-safe migration guidance for critical infrastructure and funds cryptographic discovery and legacy OT migration.https://industrialcyber.co/industrial-cyber-attacks/mitre-attck-v20-expands-critical-infrastructure-threat-coverage-with-new-it-and-ot-attack-techniquesotasec-item-3d99c138b16bFri, 16 Oct 2026 10:21:13 +0000MITRE released ATT&CK version 20, expanding critical infrastructure coverage with new IT and OT attack techniques.https://industrialcyber.co/control-device-security/french-supermarket-cyberattack-exposes-risks-of-unsecured-remote-access-and-legacy-refrigeration-systemsotasec-item-351b55202c4aFri, 16 Oct 2026 10:16:57 +0000Reports describe cyberattacks on French supermarket refrigeration systems that disrupted hundreds of stores overnight from October 11, highlighting risks of remote access and legacy systems.https://industrialcyber.co/utilities-energy-power-water-waste/ampyx-cyber-examines-ferc-2026-cip-audit-findings-on-generator-registration-shared-control-and-ai-access-risksotasec-item-4397993c866dFri, 16 Oct 2026 10:11:31 +0000Ampyx Cyber reviews FERC 2026 CIP audit findings, pointing to gaps in generator registration, risk categorization and AI access controls.https://industrialcyber.co/medical/microsoft-health-isac-dismantle-phishing-infrastructure-targeting-critical-infrastructure-healthcare-sectorotasec-item-79000086a8caFri, 16 Oct 2026 10:08:07 +0000Microsoft and Health-ISAC are working to dismantle three components of the YAM Store, CoGUI and Iron cybercrime marketplace used for phishing against healthcare and critical infrastructure.https://industrialcyber.co/news/randy-resnick-joins-igel-to-advance-zero-trust-and-cyber-resilience-across-it-and-ot-environmentsotasec-item-3546e86a0039Fri, 16 Oct 2026 10:04:30 +0000IGEL announced that Zero Trust expert Randy Resnick has joined the company to support IT and OT security initiatives.https://industrialcyber.co/news/sans-institute-launches-it-and-ot-training-tracks-to-strengthen-singapores-critical-infrastructure-cybersecurityotasec-item-0e36815a4920Fri, 16 Oct 2026 10:02:23 +0000SANS Institute launched IT and OT training tracks for practitioners in Singapore's critical information infrastructure sectors.https://advisories.ncsc.nl/advisory?id=NCSC-2026-0437otasec-item-b2439be1a491Fri, 16 Oct 2026 08:59:16 +0000BeyondTrust fixed critical vulnerability CVE-2026-102764 (CVSS 9.3) in Remote Support, allowing unauthenticated remote file placement or modification in versions up to 26.2.3.https://security.nl/posting/957887/Twaalfhonderd+Copeland-koelsystemen+supermarkten+online+toegankelijk?channel=rssotasec-item-23310a1cc660Fri, 16 Oct 2026 08:19:54 +0000About 1,200 Copeland refrigeration systems at supermarkets, including 48 in the Netherlands, are reported to be accessible online.https://security.nl/posting/957878/Kritiek+lek+in+BeyondTrust+Remote+Support+sinds+augustus+misbruikt+bij+aanvallen?channel=rssotasec-item-f594b10a4251Fri, 16 Oct 2026 07:13:51 +0000BeyondTrust says a critical vulnerability in Remote Support has been exploited in attacks since August 29.https://thehackernews.com/2026/10/china-linked-hackers-exploited.htmlotasec-item-1fd194e19c3dFri, 16 Oct 2026 06:55:55 +0000China-linked group Armory Castle exploited a zero-day in BeyondTrust Remote Support from late August 2026, tracked as CVE-2026-102764 (CVSS 9.3).https://bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-augustotasec-item-ec520d18786aFri, 16 Oct 2026 06:18:08 +0000BeyondTrust warned customers to patch a critical Remote Support flaw that has been exploited in zero-day attacks since late August.https://cisa.gov/news-events/ics-advisoriesotasec-item-9c8e3a9223bcFri, 16 Oct 2026 05:50:54 +0000CISA's ICS advisories index page; the excerpt contains no specific advisory details.https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.htmlotasec-item-5fc8c6dd8c54Fri, 16 Oct 2026 04:59:36 +0000A suspected threat actor exploits CVE-2025-61624 in FortiOS to deploy PEERSTITCH, a memory-resident ARM64 malware bypassing tagged VPN session checks.https://industrialcyber.co/utilities-energy-power-water-waste/ferc-identifies-cybersecurity-compliance-gaps-in-us-power-sector-flags-risks-from-ai-tools-and-third-party-control-systemsotasec-item-6ca4ff2a3d7fThu, 15 Oct 2026 12:47:10 +0000FERC identified cybersecurity compliance gaps among US electricity sector entities, including delays and risks from AI tools and third-party control systems.https://industrialcyber.co/ransomware/n0n-extortion-claims-target-38-global-maritime-and-logistics-organizations-raising-port-data-exposure-concernsotasec-item-6cf04b489535Thu, 15 Oct 2026 12:41:16 +0000SOCRadar reported that the n0n extortion group claimed 38 maritime and logistics organizations worldwide, raising concerns about port data exposure.https://ics-cert.kaspersky.com/publications/reports/2026/10/15/cybersecurity-of-over-the-air-update-mechanisms-for-vehicles/otasec-item-d6e15895c313Thu, 15 Oct 2026 09:00:00 +0000Kaspersky ICS CERT discusses securing over-the-air update campaigns, preventing package tampering and limiting damage to connected vehicles.https://security.nl/posting/957699/Honderden+koelsystemen+supermarkten+toegankelijk+vanaf+internet?channel=rssotasec-item-cea651ef1002Thu, 15 Oct 2026 08:01:13 +0000Hundreds of supermarket refrigeration systems, 26 of them in the Netherlands, remain accessible from the internet.https://security.nl/posting/957698/Palo+Alto+Networks+waarschuwt+voor+misbruik+van+beveiligingslek+in+firewalls?channel=rssotasec-item-0501cbc46265Thu, 15 Oct 2026 07:38:03 +0000Attackers are actively exploiting a remote code execution vulnerability in Palo Alto Networks firewalls, which the company warns about.https://security.nl/posting/957694/Distributiecentra+Albert+Heijn+weer+operationeel%3A+%27In+toenemende+mate+vollere+schappen%27?channel=rssotasec-item-e7fd057ada66Thu, 15 Oct 2026 07:23:50 +0000All Albert Heijn distribution centres are operational again, with fuller shelves increasingly reported; the excerpt does not state the cause of the disruption.https://thehackernews.com/2026/10/palo-alto-networks-patches-pan-os.htmlotasec-item-fc3053d7e094Thu, 15 Oct 2026 06:17:58 +0000Palo Alto Networks released PAN-OS updates for CVE-2026-0322, a high-severity management interface RCE flaw under active exploitation.https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02otasec-item-cc3b7cd61609Thu, 15 Oct 2026 06:00:00 +0000CISA published advisory ICSA-26-288-02 on Guangzhou Juan IoT EseeCloud vulnerabilities that could let attackers gain control of affected IP cameras.https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-01otasec-item-093b66f08af6Thu, 15 Oct 2026 06:00:00 +0000CISA published advisory ICSA-26-288-01 on Eclipse Milo vulnerabilities that could allow data deletion, credential theft, impersonation, or server unresponsiveness.https://helpnetsecurity.com/2026/10/15/exposed-ai-infrastructure-reportotasec-item-ca31951d18c3Thu, 15 Oct 2026 05:00:02 +0000Censys reports exposed industrial control systems rose about 4% in two and a half years, while AI-related software exposure grew 63% in nine months.https://cert-portal.siemens.com/productcert/html/ssa-580366.htmlotasec-item-d1f6f4a1b7b4Thu, 15 Oct 2026 00:00:00 +0000Siemens disclosed a DLL sideloading vulnerability in Siemens Software Center allowing authenticated local attackers to execute code; fixes are expected in the week of 19 October 2026.https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-03otasec-item-b1c9b16b4541Thu, 15 Oct 2026 00:00:00 +0000Siemens Software Center loads DLLs from an uncontrolled search path, allowing local authenticated attackers to execute code; a fix is available.https://bleepingcomputer.com/news/security/cisa-warns-admins-to-immediately-fix-ivanti-flaw-exploited-as-zero-dayotasec-item-cca51efef3cdWed, 14 Oct 2026 12:58:07 +0000CISA urges immediate patching of an Ivanti Connect Secure flaw exploited as a zero-day since at least October 1st.https://security.nl/posting/957588/Kabinet+wijst+bezwaar+DigiD-beheerder+Solvinity+af%3A+%27Overnameverbod+noodzakelijk%27?channel=rssotasec-item-3d84fff2016eWed, 14 Oct 2026 12:36:31 +0000The Dutch cabinet rejects the objection of DigiD administrator Solvinity and maintains that a US takeover must be prohibited as a threat to the public interest.https://thehackernews.com/2026/10/cisa-urges-immediate-ivanti-connect.htmlotasec-item-c8c2a8e77f0cWed, 14 Oct 2026 12:30:42 +0000CISA urges immediate updates to Ivanti Connect Secure after an actively exploited authentication bypass, CVE-2026-104935, was disclosed.https://security.nl/posting/957584/CCB%3A+%27Hang+koelsystemen+niet+direct+aan+internet+en+installeer+updates%27?channel=rssotasec-item-7b42452ccc59Wed, 14 Oct 2026 12:21:02 +0000Belgian and German authorities urge supermarkets and businesses not to connect refrigeration systems directly to the internet and to install updates.https://security.nl/posting/957542/Kabinet+maakt+risicobeoordeling+digitale+infrastructuur+niet+openbaar?channel=rssotasec-item-05ded444a44eWed, 14 Oct 2026 09:23:04 +0000The Dutch cabinet will not publish its risk assessment of the country's digital infrastructure, citing national security.https://helpnetsecurity.com/2026/10/14/ivanti-zero-days-gain-root-patched-vpn-appliancesotasec-item-5b4c475b9b3bWed, 14 Oct 2026 08:59:19 +0000UTA0576 chained three Ivanti Connect Secure zero-days to gain root on fully patched VPN appliances, enabling credential theft and reconnaissance.https://security.nl/posting/957517/Ivanti+vpn-servers+volledig+gehackt+bij+aanval%2C+aanvallers+zoeken+BitLocker+keys?channel=rssotasec-item-e4e9d03d0ed5Wed, 14 Oct 2026 08:20:46 +0000Attackers combined three Ivanti VPN vulnerabilities to fully compromise servers during recent attacks, and are reportedly seeking BitLocker keys.https://industrialcyber.co/ai/hscc-publishes-ai-clinical-resilience-playbook-to-help-healthcare-organizations-manage-patient-safety-cybersecurity-risksotasec-item-142dd37babcaWed, 14 Oct 2026 07:27:39 +0000The HSCC published a playbook to help healthcare organizations manage patient safety and cybersecurity risks from clinical AI.https://industrialcyber.co/secure-remote-access/ecso-outlines-six-priorities-for-eu-space-cybersecurity-policy-from-secure-by-design-systems-to-threat-intelligence-sharingotasec-item-22f2e9b4cdacWed, 14 Oct 2026 07:19:50 +0000ECSO calls for a dedicated European industrial policy for space cybersecurity, including secure-by-design and threat intelligence sharing.https://industrialcyber.co/news/thinklabs-ai-names-dragos-robert-lee-to-board-to-accelerate-ai-driven-grid-planning-modernizationotasec-item-645e5d9edb5aWed, 14 Oct 2026 07:11:15 +0000ThinkLabs AI appointed Dragos' Robert Lee to its board to advance AI-driven grid planning and modernization.https://industrialcyber.co/news/doe-inl-launch-weekly-series-on-cyber-informed-engineering-to-advance-cybersecurity-in-energy-infrastructureotasec-item-df7b9967c645Wed, 14 Oct 2026 07:05:36 +0000The US DOE and Idaho National Laboratory launched a weekly series on cyber-informed engineering for energy infrastructure security.