Today's briefing · Tuesday 20 October 2026
OTASEC briefing – 20-10-2026
AI-assisted exploit development against Internet-facing OT leads today, alongside new detail on the PEERSTITCH intrusion and a cyberattack on building automation vendor LOXONE. Regulation and remote-access governance round out a quieter day.
- Claroty: AI rebuilt Danfoss AK-SM 800A exploits in 28 minutes 1 source
- Update: Unit 42 links PEERSTITCH to FortiOS flaw exploited after FortiManager compromise 1 source
- LOXONE hit by cyberattack; customer installations reported safe 1 source
- India's CEA power sector cybersecurity deadline set for April 2027 1 source
- Survey: frontline workers routinely work around MFA 1 source
- Dispel launches Zero Trust Engine for OEM remote service 1 source
- Calls for enforceable AI accountability and zero trust in critical infrastructure 1 source
Live feed
Every OT/ICS-relevant story from 14 sources, updated hourly.
-
Your frontline workers have a workaround for that MFA prompt
A Sapio Research survey of 700 IT and security decision-makers found 95% saw frontline workers bypass MFA and share credentials in healthcare and manufacturing.
-
Dispel Zero Trust Engine for OEMs to secure remote industrial service, standardize access, strengthen compliance
Dispel announced a Zero Trust Engine aimed at OEMs for securing remote industrial service access.
-
Need for enforceable AI accountability, zero-trust security as AI-driven cyber risks threaten critical infrastructure
An article argues that AI-enabled cyber risks threaten critical infrastructure and calls for enforceable AI accountability and zero-trust security.
-
Claroty Team82 shows AI can rebuild Danfoss controller exploits in 28 minutes, putting Internet-facing OT at risk
Claroty Team82 reproduced three disclosed Danfoss AK-SM 800A refrigeration controller vulnerabilities using AI in 28 minutes, raising risk for Internet-facing OT.
-
Unit 42 traces Peerstitch malware deployment to FortiOS vulnerability exploited after FortiManager compromise
Unit 42 traced Peerstitch malware to a FortiOS flaw exploited after a FortiManager compromise at a telecom managed service provider.
-
Nozomi outlines IT and OT security priorities ahead of India’s April 2027 CEA power sector cybersecurity deadline
Nozomi outlines IT and OT security priorities ahead of India's April 2027 power sector cybersecurity deadline set by the CEA.
-
LOXONE getroffen door cyberaanval maar klantinstallaties veilig en operationeel
Smart home and building automation vendor LOXONE was hit by a cyberattack on its internal business systems, while customer installations remained secure and operational.
-
NIST Special Publication (SP) 800-82 Rev. 4 (Draft), Guide to Operational Technology (OT) Security
NIST released a draft revision 4 of SP 800-82, a guide to securing operational technology across industrial and critical infrastructure systems.
-
Only 13% of OT Network Segments Are Fully Isolated: Analysis
Forescout research finds only 13% of OT network segments are fully isolated, with OT and medical devices often sharing segments with enterprise assets.
-
How decades of disconnected modernization created OT security debt manufacturers can't escape - Industrial Cyber
An analysis argues that manufacturers' modernization adds connectivity without fixing architectural weaknesses, creating accumulated OT security debt.
-
Singapore prioritizes critical infrastructure in quantum-safe push, funds cryptographic discovery, legacy OT migration
Singapore's CSA issued quantum-safe migration guidance for critical infrastructure and funds cryptographic discovery and legacy OT migration.
-
MITRE ATT&CK v20 expands critical infrastructure threat coverage with new IT and OT attack techniques
MITRE released ATT&CK version 20, expanding critical infrastructure coverage with new IT and OT attack techniques.
-
French supermarket cyberattack exposes risks of unsecured remote access and legacy refrigeration systems
Reports describe cyberattacks on French supermarket refrigeration systems that disrupted hundreds of stores overnight from October 11, highlighting risks of remote access and legacy systems.
-
Ampyx Cyber examines FERC 2026 CIP audit findings on generator registration, shared control and AI access risks
Ampyx Cyber reviews FERC 2026 CIP audit findings, pointing to gaps in generator registration, risk categorization and AI access controls.
-
Microsoft, Health-ISAC dismantle phishing infrastructure targeting critical infrastructure, healthcare sector
Microsoft and Health-ISAC are working to dismantle three components of the YAM Store, CoGUI and Iron cybercrime marketplace used for phishing against healthcare and critical infrastructure.
-
Randy Resnick joins IGEL to advance Zero Trust and cyber resilience across IT and OT environments
IGEL announced that Zero Trust expert Randy Resnick has joined the company to support IT and OT security initiatives.
-
SANS Institute launches IT and OT training tracks to strengthen Singapore’s critical infrastructure cybersecurity
SANS Institute launched IT and OT training tracks for practitioners in Singapore's critical information infrastructure sectors.
-
NCSC-2026-0437 [1.00] [H/H] Kwetsbaarheid verholpen in BeyondTrust Remote Support
BeyondTrust fixed critical vulnerability CVE-2026-102764 (CVSS 9.3) in Remote Support, allowing unauthenticated remote file placement or modification in versions up to 26.2.3.
-
Twaalfhonderd Copeland-koelsystemen supermarkten online toegankelijk
About 1,200 Copeland refrigeration systems at supermarkets, including 48 in the Netherlands, are reported to be accessible online.
-
Kritiek lek in BeyondTrust Remote Support sinds augustus misbruikt bij aanvallen
BeyondTrust says a critical vulnerability in Remote Support has been exploited in attacks since August 29.
-
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
China-linked group Armory Castle exploited a zero-day in BeyondTrust Remote Support from late August 2026, tracked as CVE-2026-102764 (CVSS 9.3).
-
BeyondTrust patches zero-day exploited in attacks since August
BeyondTrust warned customers to patch a critical Remote Support flaw that has been exploited in zero-day attacks since late August.
-
ICS Advisories | CISA
CISA's ICS advisories index page; the excerpt contains no specific advisory details.
-
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
A suspected threat actor exploits CVE-2025-61624 in FortiOS to deploy PEERSTITCH, a memory-resident ARM64 malware bypassing tagged VPN session checks.
-
FERC identifies cybersecurity compliance gaps in US power sector, flags risks from AI tools and third-party control systems
FERC identified cybersecurity compliance gaps among US electricity sector entities, including delays and risks from AI tools and third-party control systems.
-
n0n extortion claims target 38 global maritime and logistics organizations, raising port data exposure concerns
SOCRadar reported that the n0n extortion group claimed 38 maritime and logistics organizations worldwide, raising concerns about port data exposure.
-
Cybersecurity of over-the-air update mechanisms for vehicles
Kaspersky ICS CERT discusses securing over-the-air update campaigns, preventing package tampering and limiting damage to connected vehicles.
-
Honderden koelsystemen supermarkten toegankelijk vanaf internet
Hundreds of supermarket refrigeration systems, 26 of them in the Netherlands, remain accessible from the internet.
-
Palo Alto Networks waarschuwt voor misbruik van beveiligingslek in firewalls
Attackers are actively exploiting a remote code execution vulnerability in Palo Alto Networks firewalls, which the company warns about.
-
Distributiecentra Albert Heijn weer operationeel: 'In toenemende mate vollere schappen'
All Albert Heijn distribution centres are operational again, with fuller shelves increasingly reported; the excerpt does not state the cause of the disruption.
-
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
Palo Alto Networks released PAN-OS updates for CVE-2026-0322, a high-severity management interface RCE flaw under active exploitation.
-
ICSA-26-288-02: Guangzhou Juan IoT Technology EseeCloud
CISA published advisory ICSA-26-288-02 on Guangzhou Juan IoT EseeCloud vulnerabilities that could let attackers gain control of affected IP cameras.
-
ICSA-26-288-01: Eclipse Foundation Eclipse Milo
CISA published advisory ICSA-26-288-01 on Eclipse Milo vulnerabilities that could allow data deletion, credential theft, impersonation, or server unresponsiveness.
-
The internet’s attack surface moves at very different speeds
Censys reports exposed industrial control systems rose about 4% in two and a half years, while AI-related software exposure grew 63% in nine months.
-
SSA-580366 V1.0: DLL Sideloading Vulnerability in Siemens Software Center
Siemens disclosed a DLL sideloading vulnerability in Siemens Software Center allowing authenticated local attackers to execute code; fixes are expected in the week of 19 October 2026.
-
CISA warns admins to immediately fix Ivanti flaw exploited as zero-day
CISA urges immediate patching of an Ivanti Connect Secure flaw exploited as a zero-day since at least October 1st.
-
Kabinet wijst bezwaar DigiD-beheerder Solvinity af: 'Overnameverbod noodzakelijk'
The Dutch cabinet rejects the objection of DigiD administrator Solvinity and maintains that a US takeover must be prohibited as a threat to the public interest.
-
CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts
CISA urges immediate updates to Ivanti Connect Secure after an actively exploited authentication bypass, CVE-2026-104935, was disclosed.
-
CCB: 'Hang koelsystemen niet direct aan internet en installeer updates'
Belgian and German authorities urge supermarkets and businesses not to connect refrigeration systems directly to the internet and to install updates.
-
Kabinet maakt risicobeoordeling digitale infrastructuur niet openbaar
The Dutch cabinet will not publish its risk assessment of the country's digital infrastructure, citing national security.
No items match these filters.