This week at a glance
A Bloomberg feature this week collected incidents that OT teams have been seeing one at a time. In Spain, from late 2024 to this summer, crematorium ovens stopped working, a factory making renewable-energy transformers caught fire, and heating and ventilation at two wineries drove temperatures up. Spanish police arrested a man in March whom they accuse of helping a group linked to as many as 40 attacks in Spain, including on water pumping and food-storage refrigeration. The groups involved are CARR and Z-Pentest, and their method, set out in an earlier joint advisory from CISA, the FBI, the NSA and more than 20 partners, needs no software flaw at all: find a control screen reachable over VNC with a default or weak password, then change setpoints, alarms and passwords. A day later Nextgov reported that US Cyber Command and Defense Department investigators are examining whether freezer failures that spoiled food at about six military commissaries in August, including one switched into defrost mode at Fort Huachuca, were a cyberattack. French authorities are helping, after October’s attacks on refrigeration at more than 350 French sites.
On the state side, Lumen’s Black Lotus Labs described Silent Train, the covert network of compromised routers, IoT and enterprise devices that Volt Typhoon has used since late 2023. Chains are rebuilt in under two minutes, more than 27 device classes are abused, and hundreds of victims have been notified, including water, energy, rail and maritime operators. PHP2Shell, the two critical PHP flaws patched on October 21, has reached industrial products: Schneider Electric, Siemens (RUGGEDCOM APE1808), ABB and B&R, Belden, HMS and Wibu-Systems have confirmed affected products, while Claroty and Waterfall explain where the bugs sit in historian, building-management and remote-maintenance web interfaces. An autonomous research system found four flaws in EPICS Base, the control toolkit behind particle accelerators and fusion experiments, in under four hours; some are more than 30 years old.
Policy and compliance filled the rest of the week. CISA’s new strategy, CISA 2030, makes OT modernization, asset visibility and OT supply-chain integrity one of its key objectives. Australia’s signals agency reported a 20% rise in incidents and an 80% jump in notifications. NERC CIP-003-9’s vendor remote-access rules for low-impact sites are now enforceable, and a FERC staff review counted 49% more compliance exceptions than a year earlier. A maritime coalition opened Blue Initiative, a free index of nearly 30,000 vulnerabilities mapped to ship and port systems.
On our watch list
- Attribution of the commissary freezer failures. Investigators have not confirmed a cause or named anyone. Watch for an official finding from Cyber Command or the Defense Department, the make of the refrigeration controllers involved, and whether the access path matches the French supermarket attacks.
- More arrests and charges against CARR and Z-Pentest helpers. Spain arrested a suspect in March, and the US has charged a Ukrainian national with working for both groups. Watch for court outcomes and for police in other NATO countries naming local recruits.
- New physical-damage claims at small sites. The incidents Bloomberg describes hit a funeral home, wineries, a transformer factory and village water systems. Watch for claims against similar small operators, which are the least likely to have someone watching their remote screens.
- PHP2Shell patches that are still missing. Belden’s NetModule NRSW had no fix at publication, Schneider’s EcoStruxure Control Engineering only has mitigations, and Hitachi Energy is still investigating. Watch for those fixes and for CISA ICS advisories that republish vendor findings.
- First PHP2Shell exploitation against an OT product. Confirmed attacks so far have hit honeypots. A confirmed compromise of an industrial router, historian or building-management portal would move this from IT patching to an OT incident.
- Volt Typhoon zero-days on more edge devices. Black Lotus Labs lists confirmed zero-day campaigns against Versa Director, N-able N-Central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator. Watch for new edge-device advisories and for utilities among the notified victims going public.
- CISA 2030 milestones. CISA says it will start a programmatic review within 60 days and deliver an implementation and measurement approach within 180. Watch whether the OT objective comes with funding, named programs or measurable targets.
- Low-impact CIP-003-9 audit findings. The vendor remote-access requirements have been enforceable since April 1. Watch for the first published findings at solar, wind and storage sites, and for whether auditors read “vendor” as broadly as ReliabilityFirst suggests.
- More AI-found bugs in old control software. Causal Security’s system found the EPICS flaws in hours. Watch for similar disclosures in other open-source or long-lived industrial code, and for whether maintainers can keep up with the volume.
- Uptake of Blue Initiative. The index has 37 entries for maritime-specific products. Watch whether ship-system makers and port operators contribute advisories, which would make it more than a mapped copy of CISA’s data.
At top left, CARR and Z-Pentest connect to exposed HMIs and weak passwords, which link out to refrigeration and food OT (where US Cyber Command’s freezer investigation sits) and to water and energy utilities. Spain ties the hacktivist cluster to the arrests described by Bloomberg. At top right, Volt Typhoon, Black Lotus Labs and Silent Train run through SOHO routers and edge devices to vendor remote access. CISA sits at the centre, linking the hacktivist advisory, EPICS Base, PHP2Shell, the Blue Initiative maritime index and CISA 2030. At the bottom, PHP2Shell connects Schneider Electric, Siemens, Claroty and Waterfall, and AI-accelerated exploitation joins Waterfall’s argument with Causal Security’s EPICS findings. On the right, NERC CIP-003-9, FERC/NERC, vendor remote access, Dragos and segmentation form the grid-compliance cluster.
View interactive topic map →
Article index
Sabotage and physical consequences
Bloomberg on pro-Russia hacktivists causing physical damage across NATO countries, a Pentagon investigation into spoiled commissary freezers, retail building-automation risks, the insurance gap for physical losses, and an Australian look at hacking as a front line.
State actors and the threat picture
Volt Typhoon’s ephemeral covert network, Australia’s annual threat report, a new DDoS botnet, attackers who disable security tools before ransomware, and how intrusions move from remote access into OT.
PHP2Shell and vulnerabilities
Industrial vendors confirm PHP2Shell exposure, two vendor analyses of what it means for OT, decades-old EPICS flaws, a free maritime vulnerability index and a Korean recap of AI-built attack tools.
AI and industry moves
Frenos estimates two years before AI can reliably plan OT attacks, Schneider, NVIDIA and HPE launch edge AI agents, and Dragos adds a public-sector board, xOT features and segmentation validation.
| Article |
Source |
Published |
| 17. Frenos warns advances in AI attack planning could increase cybersecurity risks for critical infrastructure, ICS systems |
Industrial Cyber |
Oct 26, 2026 |
| 18. Schneider Electric, NVIDIA, HPE introduce edge AI agents for industrial monitoring, cybersecurity and energy optimization |
Industrial Cyber |
Oct 26, 2026 |
| 19. Dragos Public Sector Names Board with Former U.S. Cyber and Defense Leaders, Extends Capabilities with Industry's First xOT Cybersecurity Platform |
Dragos |
Oct 27, 2026 |
| 20. What Can Reach Your Critical OT Systems, and Should It? |
Dragos |
Oct 29, 2026 |
Grid, energy and water
CIP-003-9 vendor-access audit risk, a FERC review showing more compliance exceptions, device identity for grid networks, a data breach at a nuclear plant operator, and water utilities under compute-driven pressure.
Policy and standards
CISA 2030’s OT objectives, Asia-Pacific policy changes, ODVA’s IEC 62443 certification, a vendor primer on OT regulation and a feature on manufacturing governance gaps.
| Article |
Source |
Published |
| 26. CISA 2030 targets OT modernization, asset visibility, supply chain security through risk-based critical infrastructure defense |
Industrial Cyber |
Oct 29, 2026 |
| 27. OT-ISAC tracks 2026 Asia-Pacific cybersecurity policy shifts affecting critical infrastructure, OT and industrial operations |
Industrial Cyber |
Oct 26, 2026 |
| 28. ODVA advances security, connectivity, automation and interoperability |
Control Global |
Oct 26, 2026 |
| 29. OT Cybersecurity: Why Evolving Regulations Form the Foundation for Operational Resilience |
Siemens |
Oct 28, 2026 |
| 30. Manufacturing cybersecurity faces persistent governance gaps as accountability, funding, operational priorities diverge |
Industrial Cyber |
Oct 27, 2026 |
Detailed write-ups
1. Pro-Russia hacktivists are turning exposed control screens into physical damage
Bloomberg · October 27, 2026
Bloomberg’s Ryan Gallagher reports hundreds of attacks on water treatment plants, factories, hydroelectric dams and other sensitive sites in NATO countries. The feature opens in Spain, where a run of incidents from late 2024 into this summer first looked like equipment faults. Crematorium ovens at a funeral home in Alicante stopped working. Machinery making renewable-energy transformers at a factory in Catalonia malfunctioned and started a fire. Heating and ventilation at two wineries sent temperatures up and disrupted production. In March, Spanish police arrested an Italian man living in Spain and accused him of helping a group behind as many as 40 attacks in the country, including on water-pumping stations and food-storage refrigeration, with more than $100,000 in losses. Police linked the campaign to the Russian government.
The groups in the frame are Cyber Army of Russia Reborn (CARR), which US prosecutors link to Russian military intelligence, and Z-Pentest, formed in 2024 by former CARR and NoName057(16) members and now under EU sanctions. Their method is set out in a joint advisory from CISA, the FBI, the NSA and more than 20 partners, including Spanish police and the UK’s NCSC. They look for human-machine interface screens reachable from the internet over VNC with default, weak or no passwords, then change whatever the screen allows: setpoints, limits, alarms, device names and passwords. No software vulnerability is needed. Summaries of the feature also recount a Danish village where 450 homes lost water after a pump controller protected by the password 1234 was set to zero pressure, and pipes burst the next day.
The advisory warns that these actors don’t understand the processes they touch, so they can’t predict the results. “Rather than focusing on strategically significant targets, they are opportunistic and breach whatever is available to them,” CISA said. That makes any small plant, winery, cold store or village water system with a remote screen a target, whether or not it thinks of itself as critical infrastructure.
Sources: Bloomberg
2. Pentagon investigates suspected cyberattack behind spoiled commissary freezers
Nextgov/FCW · Claroty · October 28-29, 2026
Freezer failures in August spoiled food at about six US military commissaries, the on-base grocery stores, according to an anonymous US official cited by Nextgov/FCW. At Fort Huachuca in Arizona, a freezer reportedly switched into defrost mode and heated its contents. US Cyber Command and Defense Department law-enforcement units are investigating whether the failures were a hack, and French authorities are working with them. Earlier in October, attackers overrode temperature controls on commercial refrigeration at more than 350 French sites. Nextgov says it is not yet clear who is responsible or whether investigators have confirmed the cause, and the article does not name the equipment involved.
The pattern of defrost-mode changes at food sites matches what the French retailers saw, and the Food and Agriculture ISAC has warned that attackers are going after internet-accessible industrial controls in a sector that cannot afford downtime. Claroty’s note on retail building management adds a related risk: KNX, the building-automation standard common in European stores, has no built-in authentication, access control or integrity protection unless KNX Secure is deliberately deployed. “KNX deployments lack what today are considered fundamental security capabilities such as authentication and access controls,” Claroty writes. It recommends inventorying KNX devices and gateways, putting building systems in their own zone, and routing third-party access through controlled gateways.
For anyone running refrigeration or building automation, the takeaway is the same as in France: know where the management interfaces are, who can reach them, and whether a setpoint or mode change would raise an alert before the stock warms up.
Sources: Nextgov/FCW, Claroty
3. Volt Typhoon’s Silent Train: a covert network rebuilt every day
CyberScoop · October 28, 2026
Lumen’s Black Lotus Labs has described Silent Train, the covert access operation the China-backed Volt Typhoon group has run since late 2023 and leaned on more heavily since the FBI and Justice Department disrupted its KV Botnet in early 2024. It is built from compromised small-office routers, IoT devices and enterprise infrastructure. Chains of relays are assembled and torn down constantly: researchers watched a new chain go up in under two minutes, and sessions average about four hours. Specific device types are kept for specific positions in the chain.
More than 27 device classes have been abused, including products from Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS. The group used these chains to run confirmed zero-day campaigns against Versa Director, N-able N-Central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator. Black Lotus Labs has notified hundreds of victims in telecoms, government, defense, universities and IT, as well as water, energy, transportation, maritime, rail, aviation and emergency services. The framework is “fundamentally difficult to disrupt because there isn’t one network to take down,” said Michael Horka, principal information security engineer at Black Lotus Labs.
For utilities, the lesson is about the edge. Volt Typhoon’s interest in pre-positioning inside critical infrastructure is well documented, and Silent Train shows the routers, management consoles and SD-WAN controllers at the IT/OT boundary are both its way in and its cover. Block-lists of known infrastructure will not keep up with a network that changes daily.
Sources: CyberScoop
4. PHP2Shell reaches the plant floor
SecurityWeek · Waterfall Security · Claroty · October 25-29, 2026
PHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, two flaws in the PHP engine that can allow unauthenticated remote code execution. PHP fixed them on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35; branch 8.1 and older need an upgrade or a maintained vendor fix. SecurityWeek rounded up the industrial vendors’ findings. Schneider Electric confirmed three affected products: EcoStruxure Security Expert (fixed in 1.48.4.0), ProLeiT LINEoptimize (remediation through support) and EcoStruxure Control Engineering (mitigations only for now). Siemens said RUGGEDCOM APE1808 devices running affected PAN-OS versions are vulnerable. ABB flagged MES deliveries that bundle DokuWiki, and its B&R unit said APROL is affected up to R 4.4-65. Belden’s NetModule NRSW is affected in all versions with no patch yet, so Belden advises disabling the web interface; macmon 6.x and 7.x are affected too. HMS and Wibu-Systems shipped updates. Rockwell Automation and Moxa have found no affected products, and Hitachi Energy is still checking.
Claroty explains where the flaws hide in OT: web front ends and supporting applications such as historian reporting, building management, camera interfaces, imaging systems and remote-maintenance portals. Web tools that configure PLCs, meters or EV chargers could leak credentials, tokens and certificates from memory, and industrial routers with embedded PHP could give an attacker root. It suggests hunting for multipart POST requests with many repeated headers or very long field names followed by HTTP 500 errors, and for oversized PHPSESSID cookies, and reminds teams that patching doesn’t prove a system wasn’t already compromised.
Waterfall’s Andrew Ginter makes the wider point. Similar PHP memory bugs were looked at in 2020 and 2024 and set aside because building an exploit was too much work, and frontier AI has changed that. “AI does not replace attack experts but makes those experts enormously more productive,” he writes. His advice is to find and patch or isolate vulnerable PHP now, then use Cyber-Informed Engineering to remove attack paths that don’t need to exist.
Sources: SecurityWeek, Waterfall Security, Claroty
5. Decades-old EPICS flaws patched in accelerator and fusion-lab control software
SecurityWeek · October 28, 2026
CISA disclosed four vulnerabilities in EPICS Base, the core of the open-source toolkit that research facilities use to build control systems. Causal Security says ITER’s fusion reactor control system is built on EPICS and Argonne’s Advanced Photon Source uses it heavily. Versions 7.0.10 and earlier are affected, and 7.0.11 fixes them. The most severe, CVE-2026-114595 (CVSS 9.8), is an integer overflow in network request handling that can corrupt memory, crash the process and possibly allow code execution. The others are an out-of-bounds write (CVE-2026-114596, 8.2), an out-of-bounds read that can leak memory (CVE-2026-114597, 7.5) and a type confusion bug (CVE-2026-114598, 7.5).
All four sit in the handling of Channel Access and pvAccess, EPICS’s network protocols, and need no authentication or user interaction, only network access to TCP 5064 or 5075. They were found by Cipher, Causal Security’s autonomous research system, in under four hours, and code history puts them at roughly 14.5 to 31.5 years old. Maintainers were told on June 9 and merged fixes in July and August. Code execution was not demonstrated and no exploitation has been reported. “Operationally, this could potentially mean interrupted particle beams, disrupted experiments, lost monitoring data, or expensive shutdowns of critical research equipment,” said Shubham Raj, Causal Security’s co-founder.
The case shows two trends at once: AI-assisted bug hunting is now finding flaws that have survived decades of human review, and long-lived scientific and industrial code is where it will find many more.
Sources: SecurityWeek
6. CISA 2030 puts OT modernization in the plan, and Australia shows the pressure
Industrial Cyber · October 26-30, 2026
CISA’s new strategy, CISA 2030: Defend, Harden, Prevail, released on October 26, is organised around three pillars: lead national cyber defense, prioritize national infrastructure security and mobilize national resilience. One of its key objectives is to strengthen the security and resilience of operational technology by working with owners and operators to modernize OT environments, improve asset visibility and anomaly detection, and assure OT supply-chain integrity. Another positions software security and supply-chain transparency as a strategic priority. The strategy says the physical and cyber sides of critical infrastructure can no longer be treated separately, and that CISA will move from a passive posture to an anticipatory one focused on removing adversary access. It commits to a programmatic review within 60 days, an implementation and measurement approach within 180 days and a progress update within a year.
Australia’s ASD ACSC annual report gives a sense of scale. It responded to more than 1,500 incidents in 2025-26, up 20%, and sent more than 4,400 notifications of potential malicious activity, up almost 80%. Critical infrastructure accounted for 154 incidents, 10% of the total, with electricity, gas, water and waste services making up 17% of those. Phishing (36%), valid accounts (16%) and drive-by compromise (10%) were the top ways in. OT-ISAC’s survey of Asia-Pacific policy adds Japan’s unified critical-infrastructure standards, in force since October 1, and India’s power-sector cyber regulations, which take effect on April 1, 2027.
For OT teams, asset visibility and supply-chain assurance are now written objectives in the main US agency’s plan. That gives programs that have struggled for budget a reference point, though the strategy has no dollar figures yet.
Sources: Industrial Cyber, Industrial Cyber, Industrial Cyber
7. NERC CIP: vendor access at low-impact sites, and 49% more compliance exceptions
Industrial Cyber · Environment+Energy Leader · October 26-28, 2026
CIP-003-9 has been enforceable since April 1. Its new Section 6 requires owners of low-impact bulk electric system assets that allow vendor electronic remote access to have a way to determine that access, disable it, and detect known or suspected malicious communications tied to it. Centrii points out that most solar, wind and storage sites fall into the low-impact category. Evidence must be kept for three calendar years, but low-impact audits can reach back six, and the records are usually scattered: approvals in email, session logs in an equipment maker’s remote-support tool, and the people able to cut access working for an O&M contractor. The standard never defines “vendor”, and ReliabilityFirst suggests treating any non-employee with remote access as one. “Written plans show intent; records show the process ran,” Centrii says.
A FERC staff review published on October 27 counted 1,619 compliance exceptions and 206 Find, Fix, Track and Report cases submitted between October 2024 and September 2025, up from 1,089 and 232 the year before. That is about 49% more compliance exceptions and 11% fewer FFTs. FERC found the programs met expectations; the faults in its sample of 63 cases were one incomplete description and two wrong start or end dates. In the previous period, CIP standards accounted for 57% of compliance exceptions. Environment+Energy Leader notes the figures count submissions, not whether grid compliance got worse.
For asset owners, the practical job is the same in both stories: for each vendor path into each site, name who approves it and who can shut it off, and keep the records in one place for as long as an audit can look back.
Sources: Industrial Cyber, Environment+Energy Leader
8. Blue Initiative: a free vulnerability database for ships and ports
SecurityWeek · October 27, 2026
Cydome, Japan’s ClassNK classification society, Bureau Veritas, the Maritime Transportation System ISAC and Rakuten Maritime have launched Blue Initiative, a free public database of IT and OT vulnerabilities relevant to ships and ports. It holds nearly 30,000 entries, more than 2,000 rated critical by CVSS and more than 580 known to be exploited. Only 37 are in products built specifically for maritime use, many of them found this year.
Most entries are pulled automatically from CISA’s ICS advisories and Known Exploited Vulnerabilities catalog and mapped to maritime systems; a smaller number carry analysts’ notes, and entries are reviewed by Cydome researchers and partners. Users can search, filter and sign up for alerts, and the community can contribute. “Identifying which vulnerabilities actually matter to the systems maritime companies operate is a major challenge,” said Cydome CEO Nir Ayalon.
With US Coast Guard cyber plans due in 2027 and Volt Typhoon’s victims now including maritime operators, a filter that shows which advisories touch a given vessel or terminal could save time. Its value will depend on whether equipment makers add advisories for the maritime products that CISA does not cover.
Sources: SecurityWeek
Calls to action
- Find and close remote screens. Search your external ranges, cellular modems and vendor-installed remote-access boxes for HMIs and VNC services. Remove internet exposure, change default and weak passwords, and require MFA through a managed gateway.
- Alert on setpoint, mode and alarm changes. Treat a remote change to a temperature setpoint, defrost mode, pump pressure or alarm limit as a security event, especially outside maintenance windows, and agree who responds and how fast it can be reversed.
- Patch or isolate PHP2Shell in OT products. Check advisories from Schneider Electric, Siemens, ABB/B&R, Belden, HMS and Wibu-Systems against your inventory. Disable NetModule web interfaces until Belden ships a fix, and look for the multipart-POST and oversized-PHPSESSID patterns Claroty describes.
- Upgrade EPICS Base to 7.0.11. Research facilities should also make sure Channel Access (TCP 5064) and pvAccess (TCP 5075) can’t be reached from outside the controls network, and test client compatibility before rolling out.
- Review edge devices against Silent Train. Check SOHO routers, SD-WAN controllers and management consoles at the IT/OT boundary for unexpected outbound sessions and configuration changes, and retire end-of-life edge hardware.
- Build your CIP-003-9 vendor-access record now. For each low-impact site, list every vendor path, the approver, the person who can disable it, and where session records live. Pull records out of OEM and contractor tools before the next change of operator.
- Map your fleet and terminals against Blue Initiative. Maritime operators can filter the index to their onboard and port systems and subscribe to alerts for new entries.
|