Today's briefing · Sunday 25 October 2026
OTASEC Daily Briefing | 25-10-2026
A quiet day: Siemens has published two advisories as a follow-up to the PHP2Shell story, and one vendor launch targets OT asset documentation.
Live feed
Every OT/ICS-relevant story from 14 sources, updated hourly.
-
PHP2Shell: AI Exploits for Long-Known Vulnerabilities
Waterfall Security commentary by Andrew Ginter explains how frontier AI turned long-known PHP vulnerabilities in PHP2Shell into real attacks, and what OT defenders should do about it.
-
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Researchers report a large campaign that breached exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls and VPNs, gaining access to numerous organizations worldwide.
-
UK proposes 14-year prison terms for undersea cable sabotage
The UK government proposes raising the maximum prison term for deliberate undersea cable damage to 14 years, updating the Submarine Telegraph Act 1885.
-
UK proposes 14-year jail terms for subsea cable saboteurs
A UK White Paper proposes 14-year jail terms for damaging subsea cables and unlimited fines for ship owners whose vessels cause damage.
-
Forescout warns internet-exposed refrigeration controls could enable attacks on food supply chains and hospitals
Forescout Vedere Labs found 12,976 internet-exposed service observations tied to refrigeration control systems, which could enable attacks on food supply chains and hospitals.
-
US Coast Guard releases NVIC 02-26 to guide maritime operators on cybersecurity plans, IT and OT risk assessments
The US Coast Guard released NVIC 02-26 to help maritime operators meet cybersecurity plan requirements and assess IT and OT risks.
-
Indurex secures €7 million to unify engineering intelligence, OT security and process safety
Indurex raised 7 million euros to develop AI-based engineering intelligence, OT security and process safety for cyber-physical systems.
-
NineTenths joins ISASecure to support industrial cybersecurity across energy, water and manufacturing
NineTenths has joined ISASecure, an industrial cybersecurity certification program.
-
Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
ESET reports Sandworm and UAC-0099 used spear-phishing and a new mesh network backdoor in a destructive wiper attack on a Ukrainian logistics company.
-
SSA-566512 V1.0: PHP2Shell Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices
Siemens advisory SSA-566512 lists RUGGEDCOM APE1808 devices affected by PHP2Shell vulnerabilities in Palo Alto Networks PAN-OS, and points to upstream workarounds.
-
SSA-566435 V1.0: PHP2Shell Vulnerabilities in Siemens Software Products
Siemens published advisory SSA-566435 on the impact of the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 on its software products.
-
Amazon: first PHP2Shell attacks observed on October 17
Amazon reports the first PHP2Shell attacks were observed on October 17, four days before the vulnerability became publicly known.
-
What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers
Palo Alto Networks confirms all PAN-OS and Panorama versions are affected by PHP2Shell, with no fixed releases yet, while Fortinet and Cisco investigate their products.
-
SafePay ransomware compromised 600 critical organizations worldwide; urge patching and network defenses
CISA, FBI and partners warn that SafePay ransomware has compromised around 600 critical organizations worldwide and urge patching and network defenses.
-
Black Kite debuts Quantum Readiness controls to assess post-quantum security across vendor ecosystems
Black Kite released Quantum Readiness, a new product for assessing post-quantum security across vendor ecosystems.
-
Corsha launches Folio to automate OT network mapping and industrial system documentation
Corsha launched Folio, a new module for automating OT network mapping and industrial system documentation.
-
ICSA-26-295-01: Kiloview E3 NDI Encoder
CISA published advisory ICSA-26-295-01 on Kiloview E3 NDI Encoder vulnerabilities that could allow an attacker to fully compromise the device.
-
Tech trio launches $10 million initiative to help under-resourced utilities bolster cybersecurity
A privately funded $10 million initiative will support up to 500 under-resourced utilities in strengthening their cybersecurity.
-
PQC in Healthcare: From Data Risk to Migration Readiness
Forescout's Vedere Labs examines healthcare security threats, including insecure specialized medical devices and challenges of PQC migration.
-
Accenture, Dragos and SANS Institute launch $10 million initiative to strengthen cybersecurity at US utilities
Accenture, Dragos and SANS Institute launch a 10 million dollar initiative to strengthen cyber defenses at under-resourced US utilities.
-
Russian hackers teamed up to wipe data at Ukrainian grain firm
Researchers said Russian state-linked Sandworm worked with another threat actor to carry out a destructive attack wiping data at a Ukrainian grain logistics company last year.
-
Industrial Automation Cybersecurity for Retail Operations
A Claroty blog argues industrial automation cybersecurity matters for retail operations, citing cyberattacks on French supermarket chains.
-
GAO outlines 2027-2032 agenda for congressional oversight of federal cyber defenses, critical infrastructure, AI risks
The US GAO outlined a 2027-2032 agenda for congressional oversight of federal cyber defenses, critical infrastructure protection and AI risks.
-
Singapore’s CSA and Google identify safeguards and access controls to address autonomous AI agent risks
Singapore's CSA and Google convened policymakers and infrastructure leaders to discuss safeguards for autonomous AI agent risks.
-
Resilience reports energy and utilities sector faces rising cyber exposure from ransomware, vulnerable OT systems
Resilience's analysis of energy and utilities cyber insurance claims highlights ransomware and vulnerable OT systems as rising exposures.
-
Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June
Ransomware groups are exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect patched in May, to breach organizations including in healthcare, government and energy.
-
FBI: at least six hundred critical organizations fell victim to SafePay ransomware
The FBI reports at least 600 organizations in vital sectors across several continents have fallen victim to SafePay ransomware.
-
CISA: SafePay ransomware hit over 600 critical infrastructure orgs
CISA says the SafePay ransomware gang has breached over 600 critical infrastructure organisations worldwide since 2024.
-
Nozomi Networks, SEL integrate OT SDN visibility with AI-powered cybersecurity for critical infrastructure
Nozomi Networks and SEL announced an expansion integrating OT SDN visibility with AI-powered cybersecurity.
-
Dispel, Tenable integrate OT asset intelligence with zero-trust remote access controls to boost industrial cybersecurity
Dispel announced an integration with Tenable OT Exposure combining asset intelligence with zero-trust remote access.
-
CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
CISA added four vulnerabilities, including Siemens flaws, to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch them.
-
Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion
The Belarus-aligned group Partisan Zmiy spent nearly two years in a Russian healthcare network, hiding the Vasilek backdoor in VMware Tools.
-
FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024
The FBI and UK and German cyber agencies say the SafePay ransomware gang targets businesses and critical infrastructure via password guessing, vulnerability exploitation and phishing.
-
Accenture, Dragos, and SANS Institute Launch Foundation to Strengthen Cyber Defenses for Under-Resourced U.S. Utilities
Accenture, Dragos and SANS Institute launch a foundation providing about $10 million in free cyber defense technology and training to up to 500 under-resourced US utilities.
-
EU cyber law won’t force fixes for fridge controllers hit in French attack
The EU Cyber Resilience Act only requires fixes and free updates during manufacturer-defined support periods, which may not cover fridge controllers hit in a French attack.
-
Upstream oil and gas: Securing operations across distance, remoteness and harsh environments
The article discusses securing upstream oil and gas operations such as wellheads, gathering systems and offshore platforms across remote and harsh environments.
-
CISA, NSA, NIST urge safeguards, continuous monitoring, incident reporting for autonomous super intelligence systems
CISA, NSA, NIST and NCSC urge safeguards, continuous monitoring and incident reporting for autonomous superintelligence AI systems.
-
Booz Allen warns frontier AI models can exploit OT pathways, manipulate controllers and move robotic equipment
Booz Allen reported that frontier AI models achieved all eight objectives in controlled tests, including exploiting OT pathways, manipulating controllers and moving robotic equipment.
-
Tactien Group launches CAST platform for independent counter-drone system testing at critical infrastructure sites
The Tactien Group launched CAST, a platform for independent testing of counter-drone systems at critical infrastructure sites.
-
ISA/IEC standards require integrated safety and cybersecurity for industrial control systems, OT-Knight’s Barreto Jijón says
A post on ISASecure argues that asset owners need to integrate functional safety and cybersecurity for industrial control systems under ISA/IEC standards.
No items match these filters.