1. Eight ICS advisories in one cycle, and the two with no version number to patch to

CISA · September 15, 2026

CISA released eight industrial control system advisories on September 15, ICSA-26-258-01 through -08. The batch is worth reading as a set rather than a queue, because the vendor spread is unusual for one cycle: two SCADA and RTU platforms, three Siemens products, two video-surveillance lines and one shipboard fleet-operations system. CISA’s own stated action is the usual one — “CISA encourages users and administrators to review these ICS Advisories for technical details and mitigations” — so the triage is yours to do.

Start with the highest score. ICSA-26-258-03 covers mySCADA myPRO Manager, where CVE-2026-73807 is a missing-authorization flaw (CWE-862) on the command API at CVSS v3.1 9.8 and v4.0 9.3: an unauthenticated attacker reaching the network can invoke privileged management functions. Versions 2.1 and earlier are affected and 2.2 fixes it. The same advisory carries CVE-2026-82567, an unauthenticated HTTP endpoint on the notification gateway that will send arbitrary SMS through a connected GSM modem — lower-scoring at v3.1 6.3 and adjacent-network only, but a useful reminder that the messaging path out of a SCADA box is an attack surface as well as an alerting one. ICSA-26-258-01, Digital Watchdog’s VMAX DVR and NVR lineups, is the other critical: CVE-2026-66890 and CVE-2026-66887 both at CVSS 9.6, with authentication bypass, hard-coded credentials, missing authorization and predictable session-token generation chaining to root-level command execution. Firmware updates are available and there is no known public exploitation of any advisory in the batch.

Two advisories in this cycle cannot be closed the normal way, and they are the ones to escalate. ICSA-26-258-02 covers Wärtsilä FOS-Onboard, the shipboard fleet-operations system, with two hard-coded cryptographic key flaws under CWE-321: CVE-2026-78225, a hard-coded server key in the deployer-ng Update Controller at CVSS v3.1 9.0 and v4.0 9.5, and CVE-2026-81855, a hard-coded client authentication key in the robot testing framework component at v3.1 9.1 and v4.0 9.3. Affected version is 5.07.0923.01; the patch comes from the vendor on contact, with no published fixed version number. Because the keys cannot be rotated without patching, this is a standing exposure on shipboard control infrastructure rather than something a configuration change closes. ICSA-26-258-08, the CareCam CM2507 IP cameras, is worse in one specific way: CVE-2026-88259 at CVSS 7.5 plus CVE-2026-84398, CVE-2026-85497 and CVE-2026-81321 covering unauthenticated video stream access, empty passwords on privileged accounts and weak credentials — and the vendor was non-responsive, so there is no fix. Network isolation is the entire mitigation.

The remainder are conventional, with one gap. ICSA-26-258-05 covers the Siemens Reyrolle 7SR5 transmission protection relay under Siemens advisory SSA-142885, with at least seven CVEs; the one that matters is CVE-2026-62647, a random number generator not seeded from a true RNG that produces predictable session identifiers, CVSS v3.1 7.4 and v4.0 9.3, letting an unauthenticated remote attacker predict authentication tokens and impersonate a legitimate user on management interfaces. All versions before V2.70 are affected and V2.70 fixes it. CVE-2026-62652 in the same advisory is debugging symbols shipped in firmware binaries, which eases reverse engineering rather than granting access. ICSA-26-258-06 (Siemens Mendix SAML) and -07 (Siemens Teamcenter, a reflected cross-site scripting flaw in the authentication redirect) are both rated high, and Siemens has released new versions for Teamcenter. ICSA-26-258-04, Schneider Electric SCADAPack x70 — the 47x, 47xi, 47xd, 470R and 57x RTU lines — is rated medium and is the frustrating one: no CVE identifier, CVSS score or fixed firmware version has been published, and Schneider’s own mitigation language warns that “failure to apply the mitigations provided below may increase the risk of unauthorized access to RTU configuration.” Treat it as a configuration-hardening task now and a patch task later. One thing this batch is not: the Schneider Modicon M580 issue from the same September cycle is a separate advisory and not part of these eight.

Sources: CISA

2. The tanker boardings: what the Coast Guard actually said, and what it did not

The Record · September 16, 2026

US authorities boarded two oil tankers following suspected cyber incidents: the first on August 21 in the Gulf of Mexico, the second on August 24. The boarding parties were not routine inspections — they combined Coast Guard law enforcement personnel, a Coast Guard vessel inspector, a Coast Guard Cyber Protection Team and the FBI’s Cyber Action Team. One vessel is named by Bloomberg as the VL Prosperity, attacked on August 7 while transiting the Strait of Gibraltar; the second tanker has not been named.

Separating the confirmed from the attributed matters more than usual here. Confirmed by the Coast Guard: indications that the vessels’ networks were compromised, that the boardings were conducted to “ensure integrity of the vessel’s operational and information technology systems,” and a 30-hour loss of communications as the one concrete operational effect. Also confirmed, and just as important: no operational disruptions, no vessel instability, no physical danger and no environmental impact from either incident. Attributed but not established: “foreign cyber actors” is the Coast Guard’s characterisation, not a named state or group, and nobody has claimed responsibility. Unverified entirely: the striking claims that attackers increased engine speed and disabled fuel and engine-oil tank systems originate with the Iranian outlet Mehr and are explicitly not independently confirmed by US authorities. Dahvid Schloss, COO of Suzu Labs, has noted publicly that two separate claims are circulating and urged skepticism pending verification. If you are briefing a board or a fleet operations group this week, brief the 30-hour comms loss and the network-compromise indications, and mark the propulsion claims as unconfirmed single-source reporting.

The useful takeaway is not the attribution, it is the response model. A cyber incident on a vessel underway produced a physical boarding by a federal cyber team, and the artefacts that determine how well that goes — current network diagrams, an inventory of what is actually on the bridge and engineering networks, logs that survive a 30-hour communications outage, and a designated shipboard point of contact — are the same artefacts the MTSA maintenance obligations exist to keep current. That is the connection worth drawing between this incident and the two maritime engineering pieces in this week’s index. The Wärtsilä FOS-Onboard advisory in the same fortnight makes the point sharper still: shipboard systems are now carrying advisory-grade cryptographic findings while the fleet is at sea.

Sources: The Record · Dragos (MTSA maintenance) · Waterfall Security Solutions

3. CIP-014-4: one 36-month clock, a 1,500-foot survey, and a 2028 date

Industrial Cyber · September 16, 2026

FERC has approved NERC CIP-014-4, published in the Federal Register on September 15. The enforceable effective date is October 1, 2028, which sounds distant until you read what R2 now asks for. Three changes carry the standard. R1 establishes a single unified 36-calendar-month cycle for transmission owners to review and update their list of applicable transmission stations and substations, replacing the split 30-month and 60-month timelines that sat under R5 of CIP-014-3. R2 is new: identification of nearby facilities within 1,500 feet — 457 metres — measured fence-line to fence-line. R3 requires a documented risk assessment methodology with “technically justified thresholds for instability, uncontrolled separation or cascading.” Requirements R6 through R10 carry forward substantively unchanged from CIP-014-3 R2 through R6, so the existing physical security plan machinery survives.

Applicability is unchanged in shape: transmission facilities at 500 kV and above, substations in the 200–499 kV band that meet the specified interconnectivity and criticality tests, and nuclear interface facilities. As filed, the compliance burden falls on 344 transmission owners, estimated at 3,440 hours annually and $286,862 in total, which works out to $833.90 and 10 hours per entity per response. Those are the filing’s own numbers, and they are almost certainly an underestimate of the R2 work for any entity with stations in developed areas.

The R2 obligation is the one to start scoping now, because it is a land-use survey rather than a desk exercise. Fence-line to fence-line at 1,500 feet means someone has to determine what sits adjacent to each in-scope station — a fuel depot, a rail siding, a data centre, a school, a building tall enough to overlook the yard — and document it. That is GIS work plus site verification, repeated on the 36-month cycle, and it is the kind of task that is cheap if you already hold current facility mapping and expensive if you do not. Initial risk assessments are due by October 1, 2028, with subsequent assessments no later than every 36 months thereafter. The sensible sequencing is to do the station list under R1 first, run the 1,500-foot identification against that list, and only then write the R3 methodology — because the thresholds you have to technically justify will be much easier to defend once you know what is actually next door.

Sources: Industrial Cyber

4. The SCALANCE “12 vulnerabilities” headline, corrected

Industrial Cyber · September 18, 2026

Nozomi Networks Labs published a technical writeup this week on twelve vulnerabilities affecting the Siemens SCALANCE LPE9403 Local Processing Engine, Siemens part number 6GK5998-3GS00-2AC2. Two corrections belong on the front of it before anyone opens a ticket. First, the twelve CVEs span two product lines, not one: CVE-2025-40572 through CVE-2025-40580 — nine of them — affect the SCALANCE LPE9403, while CVE-2025-40581 through CVE-2025-40583 affect the SINEMA Remote Connect Edge Client at V2.1 and below. Second, and more important for triage, these are CVE-2025 identifiers. CVE-2025-40572 was published on May 13, 2025, and Siemens advisory SSA-327438 with the fix in V4.0 HF0 has been available since. This is a research publication about vulnerabilities disclosed over a year ago, not a fresh disclosure of unpatched devices. If your LPE9403 estate is on V4.0 HF0 or later, this week’s headline does not create work for you.

What the research does add is the chaining picture. The flaw classes across the set are privilege escalation, path traversal, authentication bypass, command injection, buffer overflow and memory-handling errors, scoring from CVSS 5.3 to 8.5 individually — none of them dramatic alone. CVE-2025-40572 is representative: CWE-732, improper permission assignment on critical resources, CVSS v3.1 5.5 and v4.0 6.8, letting a non-privileged local attacker read sensitive data off the device. Four of the flaws, CVE-2025-40575 through CVE-2025-40578, sit in the DCP protocol implementation, each at 5.3. Chained together, though, they yield root-level control of the device, and Nozomi’s claimed downstream impact is the part that translates to plant risk: telemetry manipulation and alarm suppression, lateral movement across OT networks by way of compromised SINEMA servers, and exfiltration of credentials, configuration files and network maps.

The practical action is a version audit rather than an emergency patch. Confirm every SCALANCE LPE9403 is at V4.0 HF0 or later — all versions below that are affected — and confirm your SINEMA Remote Connect Edge Client version separately, because that is the half of the finding the headline drops. Then note the pattern for the next time it appears: a medium-severity set whose individual scores justify a routine patch window, but whose chained outcome is root on a device that sits between your cell networks and your remote-access path.

Sources: Industrial Cyber

5. Manufacturing ransomware: patching is improving, identity is not

Cybersecurity Dive · September 17, 2026

Black Kite’s 2026 Manufacturing & Distribution Report, covering January 1 to July 29, 2026, counted 1,183 manufacturing ransomware victims — up 39.7% on the 847 recorded in the same window of 2025, and 22% of all 7,551 disclosed victims across every industry. The multi-year line is steeper than any single year suggests: 540 incidents in 2022, 926 in 2023, 1,071 in 2024, 1,600 in 2025. The victim profile is consistent and specific: 70.2% of victims sat in the $10M–$100M revenue band, with a median victim revenue of $42.9 million. Mid-market manufacturers, in other words — large enough to lose real money to downtime, small enough to run a thin security function.

The geography has shifted, and that is the headline most coverage misses. US victims numbered 412 cases, only 34.8% of the manufacturing total, while European victims rose 85.4% year over year and Germany alone rose more than 83%. The group mix behind it: Qilin with 178 incidents, The Gentlemen with 142, Akira with 96, DragonForce with 70 and INC Ransom with 65 — and The Gentlemen did not exist before September 2025. Worst-hit subsectors were Machinery Manufacturing with 701 victims (15.2%), Fabricated Metal Products with 515 (11.2%), and Transportation Equipment and Chemical Manufacturing with 425 and 423 (9.2% each).

The genuinely new finding is the hygiene trend line, and it cuts in two directions at once. An attack-surface scan of the largest manufacturers as of August 2026 found 74.8% carrying a CVSS 8+ vulnerability, 61.4% carrying a CVSS 9+, 54.2% hosting a known exploited vulnerability, and 69.1% appearing in stealer logs. Set against prior years, the patching numbers are moving the right way — critical vulnerability exposure down to 75% in 2026 from 80% in 2024, known-exploited exposure down to 54% from 67%. Credential exposure did not move: flat at roughly 70%, with stealer-log presence among breached firms rising from 25% in 2023 to 42% in 2026. Ferhat Dikbiyik, Black Kite’s Chief Research and Intelligence Officer, puts the demand side plainly: “What makes manufacturing and distribution so attractive to ransomware operators is the immediate operational impact.” The supply side is now mostly credentials. If your OT security programme is still structured around a patch cadence and a vulnerability dashboard, this dataset says the marginal dollar belongs somewhere else — on credential hygiene, on remote-access paths, and on knowing which of your engineers’ accounts appear in an infostealer dump.

One adjacent item belongs here with a caveat attached. Huntress research published this week describes a new Settra ransomware variant deployed against a retailer and a manufacturer, with genuinely interesting IT tradecraft — MeshAgent RMM for persistence, bring-your-own-vulnerable-driver, cipher and diskpart used for anti-forensics, binaries named after the victim’s domain, and a .locked extension. No OT or ICS impact was reported in either victim. It reached an OT bulletin because one victim manufactures things, which is precisely the reasoning that lands an IT intrusion in a plant network in the first place.

Sources: Cybersecurity Dive · Infosecurity Magazine

6. The states hold the mandate; the utilities hold the risk

Industrial Cyber · GovInfoSecurity · CyberScoop · September 16–18, 2026

NASCIO and General Dynamics Information Technology published “The Expanding Cyber Perimeter: States and Critical Infrastructure Protection,” drawing on the 2026 NASCIO State CIO Survey and the 2026 NASCIO-Deloitte Cybersecurity Study. The headline numbers show intent: 90% of state CIOs rate cyberattacks on critical systems a high concern, and 73% have folded critical infrastructure protection into comprehensive state plans. The reach numbers show the gap. State cyber services extend to other branches of government for 57% of states, to local governments, libraries and special districts for 55%, to K-12 for 53%, to higher education for 35% — and to public utilities including electric, water and wastewater for just 32%, to tribal governments for 28% and to public hospitals for 24%. The constituencies with the most operational technology are the ones state programmes reach least.

The report names OT directly as the pressure source: “Rising operational technology (OT), Supervisory Control and Data Acquisition (SCADA) systems and cyber-physical risks further intensify pressure on states.” Its sector list is the full critical-infrastructure spread — communications networks, electric grids, water and wastewater systems, data centres, hospitals, oil pipelines, transportation systems, and dams and hydro-water systems. Its own conclusion is that without clearer governance authority, stronger local capacity and stable federal support, “national resilience will remain uneven.” Michael Geraghty, CISO for the State of New Jersey, supplies the sentence that explains why reach is hard even where funding exists: “You can’t simply tell local governments that you’re from the state and you’re here to help; you have to demonstrate it through meaningful action.”

Utah is the worked example of doing that. Its shared-services model reaches roughly 80% of local government entities, and the state secured $1.5 million in additional water-sector cybersecurity funding. The funding and support channels named around it are the State and Local Cybersecurity Grant Program, CISA programmes and MS-ISAC. Two GovInfoSecurity pieces this week circle the same territory from the practitioner side — one on states extending cyber support beyond their own networks, one arguing that cyber defence alone cannot keep critical services running, which is the resilience half of the same problem.

The fourth item in this group is an opinion piece and its provenance matters. Writing in CyberScoop, Darron Makrokanis argues that US cyber strategy overlooks the infrastructure that moves the military — commercial ports and railroads carrying military equipment, civilian utilities serving installations, small water systems, ICS calibration settings and engineering-data integrity — and cites 130 documented attack techniques across five threat groups, Iranian-linked water utility attacks across 12 states, and a four-day UK power plant outage. He is also Chief Revenue Officer at Summit 7, a CMMC compliance services firm, and the piece argues against the current CMMC implementation pause. The infrastructure argument stands on its own facts; the regulatory recommendation travels with a commercial interest, and both should be read together.

Sources: Industrial Cyber · GovInfoSecurity (states expand support) · GovInfoSecurity (defence alone) · CyberScoop (opinion)

7. Medtech gets a procurement baseline, and a funding argument

Industrial Cyber · September 17–18, 2026

Health-ISAC has set a nine-domain MedTech cybersecurity baseline intended to guide medical device procurement and deployment. The significant word in that sentence is procurement. A baseline organised around what a buyer can require at purchase and commissioning is a different instrument from a standard organised around what a manufacturer should build — it gives a hospital, an integrated delivery network or a group purchasing organisation a structure to write into a contract, and it gives device manufacturers a single set of domains to answer against rather than a different questionnaire per customer.

Alongside it, the Healthcare Sector Coordinating Council has backed a set of healthcare cybersecurity bills while calling for broader funding and stronger coordination between HHS and CISA. Those two items belong together: a procurement baseline gives buyers leverage, and the coordination and funding question determines whether the smaller providers — the ones with the oldest imaging fleet and no clinical engineering security role — ever get to use it. For anyone running biomedical or clinical engineering estate, the practical read this week is to check whether the nine domains map onto your existing device intake checklist, and to treat any gap as a question for your next contract cycle rather than a retrofit project.

Sources: Industrial Cyber (Health-ISAC baseline) · Industrial Cyber (HSCC)

8. Three asset-intelligence announcements, and what is actually shipping

Industrial Cyber · September 16–17, 2026

Three announcements landed in the OT asset-intelligence corner within two days, two of them from Nozomi Networks. They are genuinely distinct pieces of news rather than one launch told three times, but they are at very different stages of reality, and the difference is the useful part.

The most concrete is the Cyolo integration, announced September 16. It describes bidirectional asset synchronisation between the two platforms, with Nozomi risk scores feeding Cyolo access policies — which is a specific, checkable claim: the asset inventory becomes an input to the access decision rather than a separate database someone reconciles quarterly. Michael Langer, VP Product at Cyolo, and Adam Markham, Technology Alliances Director at Nozomi, front the announcement. If you already run both products, this is a configuration question for this quarter.

Nozomi Compass, announced September 17, is the bigger claim and the further-off one. It brings OT asset intelligence, governed workflows and compliance management into a single platform, with mapping claimed against NERC CIP, IEC 62443, NIS2 and TSA directives. What it does not have yet is availability: it ships to customers in January 2027. There is no pricing, no named customer and no independent validation, and the quotes are from CEO Andrea Carcano and CTO Moreno Carullo. Every capability claim is therefore forward-looking, which is fine for roadmap planning and not yet usable as a procurement decision.

Cylus launched Cylus.ai at InnoTrans 2026, adding what it describes as agentic intelligence to its CylusOne rail platform. Read the announcement carefully and the product half is thin: no availability date, no customers, no metrics, and no named rail standard — no CLC/TS 50701 or IEC 62443 conformance claim. The substantive news is the advisory board, which is genuinely notable for a rail security vendor: Nuria Fernández, former FTA Administrator; Josef Doppelbauer, former Executive Director of the EU Agency for Railways; and Mario Péloquin, former President and CEO of VIA Rail Canada. Treat it as a positioning and credibility announcement, because that is what it is.

Sources: Industrial Cyber (Cyolo integration) · Industrial Cyber (Nozomi Compass) · Industrial Cyber (Cylus.ai)

9. What actually hits exposed OT, and what a patient adversary is looking for

TXOne Networks · Dragos · August 24–31, 2026

TXOne’s honeypot report for the first half of 2026 counted 490.5 million sessions, peaking at 139.46 million in May, with 904,999 CVE-tagged IPS hits across 589 distinct vulnerabilities and 188 million unique malware payloads. Industrial protocols drew targeting across Modbus, S7, DNP3, DICOM, BACnet, Niagara Fox and GE SRTP. Read the ratios rather than the totals — the report does not disclose how many honeypots were deployed or where, so the absolute counts have no denominator. Three ratios carry the findings. Attacker infrastructure is rented, not residential: 97% of sessions from the 99 highest-volume attacker IPs traced back to cloud and VPS providers, with AWS alone accounting for 20.4% of top-tier traffic — which means blocking by geography or by residential reputation buys you very little. Malware delivery is concentrated on one port: 445/TCP carried 32,133 of 35,043 downloads, 91% of the total. And credentials are the door being tried: roughly 5.4 million SSH credential attempts, led by admin/admin at 225,613, ubuntu/ubuntu at 186,901 and root/root at 146,321 — with a Solana-focused pair at 223,014 outranking most defaults, which tells you how much of this traffic is indiscriminate crypto-hunting rather than industrial targeting. The top payloads were commodity coin miners and generic trojans, not ICS malware. TXOne’s own summary is the honest one: “Opportunistic attacks continue to dominate. Most observed activity targeted well-known vulnerabilities, default credentials, and exposed services rather than sophisticated zero-days.”

Dragos’s reconnaissance research describes the other tail of the distribution. Its framing device is xOT — the company’s own coinage, defined by Danielle Gauthier, Dragos Senior Product Marketing Manager for cyber threat intelligence, as “the full operational technology environment — every system that influences a physical process.” The term is vendor terminology, but the organising argument is sound and worth adopting regardless of the label: what makes an asset significant to an adversary is connectivity, position, trust relationship and operational dependency, not whether it sits inside the control loop. On that reading, engineering workstations, webcams and meters, VPN infrastructure, network gear, GIS data, network diagrams and the business systems that interface with operations are all in scope.

The threat-group detail underneath is the substantive part. VOLTZITE, which overlaps with Volt Typhoon, is characterised by reconnaissance objectives rather than exploitation — GIS data, OT network diagrams, SCADA configurations, operating instructions and process details — with recent activity including access to engineering workstations and extraction of configuration and alarm data to determine process shutdown conditions. That is an adversary building a model of your plant, not looking for a foothold. Akira, with 628 tracked incidents since early 2025, works the other way: compromised VPN infrastructure, credential abuse, internet-facing systems, and specifically Linux-based IoT devices that fall outside EDR coverage — the same credential-shaped weakness the manufacturing dataset flags. FrostyGoop remains the worked example of consequence from outside the traditional boundary: in 2024 it manipulated ENCO controllers at a Ukrainian municipal energy company into reporting false temperature readings. Put the two reports side by side and the practical conclusion is unglamorous. The internet-facing noise is commodity and credential-driven, and the targeted end of the spectrum is after your documentation. Both are addressed by the same two things: credential hygiene on remote access, and knowing where your network diagrams and process documentation actually live.

Sources: TXOne Networks · Dragos

10. SANS rebuilds incident response, and OT gets its own chapters

Industrial Cyber · SC Media · September 18–19, 2026

SANS has published DAIR, a Dynamic Incident Response framework by SANS Fellow Joshua Wright, and it is the first rebuild of the SANS incident response model in two decades — replacing the linear six-step PICERL sequence with an adaptive model intended to let teams change course as an intrusion changes shape. It runs to 720 pages and is free under Creative Commons. It is a general IR framework rather than an OT one, and it earns its place in this bulletin for a specific reason: it carries contributed operational technology and control-systems chapters by Dean Parsons. Those chapters are the part to read first if you run a plant, because the assumption PICERL quietly encodes — that containment and eradication can proceed on the responder’s schedule — is exactly the assumption that breaks when the affected asset is a running process.

Two practitioner guides published the following day make the organisational case alongside it. One walks through building an OT security operating model — the ownership, interfaces and decision rights between plant engineering and the security function that determine whether any framework gets used. The other examines what OT resilience actually controls, which is the more uncomfortable question: resilience language is often used to describe outcomes nobody has specified, and the useful version names which processes must keep running, for how long, in what degraded mode, and who is authorised to make that call. Together with DAIR’s OT chapters, they are a coherent autumn reading list for a team that has an advisory backlog and no agreed process for deciding what to do about it.

Sources: Industrial Cyber · SC Media (operating model) · SC Media (OT resilience)