Daily OT Security News: November 02, 2026
This edition is based on verified primary advisories and supporting reporting linked in each section; source dates are listed with each story.
1. CISA adds PHP2Shell to KEV as industrial vendors report affected OT products
Source date: 2026-10-27
News briefing
CISA’s October 26 update added two PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities Catalog and urged organizations to inventory PHP installations and patch immediately. CISA says CVE-2026-109618 and CVE-2026-109619 are critical unauthenticated remote-code-execution flaws in PHP.
SecurityWeek reported that multiple industrial vendors found affected products, including Schneider Electric’s EcoStruxure Control Engineering and B&R’s APROL process-control system. Reported exposure and remediation differ by product; this is not evidence that every vendor product is affected.
OT implications
Because the flaws enable unauthenticated remote code execution in PHP, a vulnerable web-facing component in an OT product could let an attacker execute code on its host. Depending on the product’s role and network access, compromise could threaten operational applications or create a foothold requiring coordinated containment and remediation. Neither cited article establishes attacks against these named OT products specifically.
Sources
- CISA alert on critical PHP vulnerabilities requiring immediate patching
- SecurityWeek report on industrial vendors checking products for PHP2Shell vulnerabilities
2. CISA republishes Siemens advisory on SIMATIC S7 PLC web-server vulnerabilities
Source date: 2026-10-22
News briefing
CISA republished Siemens’ advisory on eight vulnerabilities in web servers on SIMATIC S7-1500 and related controllers. The advisory covers CVE-2026-63350 through CVE-2026-63357 across listed product entries including SIMATIC S7-1500, ET 200SP, Drive Controllers, software controllers and PLCSIM Advanced.
CISA says exploitation could run malicious code in an authorized user’s browser session and allow PLC operations within that user’s authorization. Siemens had no fix available at publication; interim guidance includes disabling an unnecessary web server, limiting ports 80 and 443 to trusted IPs, restricting access to qualified personnel, and uploading only trusted trace files.
OT implications
The affected devices are PLCs used to control industrial processes, so malicious actions performed through an authorized diagnostics session could affect the controller within that user’s privileges. Practical exposure depends on deployed models, whether the web server is enabled and reachable, and the user’s authorization; the cited sources describe vulnerabilities, not a confirmed incident or production outage.
Sources
- CISA ICS advisory on Siemens SIMATIC S7 web-server vulnerabilities
- Daily OT Security News coverage from October 23, 2026
3. CISA discloses four EPICS Base control-system vulnerabilities
Source date: 2026-10-27
News briefing
CISA published an advisory on four vulnerabilities affecting EPICS Base releases 7.0.10 and earlier, a core component of the open-source EPICS toolkit used in control systems at scientific facilities and across critical manufacturing. The flaws affect network-protocol message handling and can cause process crashes, memory corruption or disclosure.
Code execution is a potential consequence of the most severe flaw but was not demonstrated. EPICS Base 7.0.11 includes security fixes, and CISA reported no known public exploitation at publication.
OT implications
EPICS Base supports communication with and control of instruments and equipment through Channel Access and pvAccess. A vulnerable network-facing server could be crashed or destabilized, potentially interrupting monitoring, data collection or control; actual consequences depend on architecture, redundancy and independent protections. Operators should inventory affected deployments, prioritize systems reachable from untrusted or broadly accessible segments, and test updates or supported backports before rollout, including compatibility with legacy clients.
Sources
- CISA ICS advisory on EPICS Base vulnerabilities
- SecurityWeek report on EPICS research facility control software flaws
4. Hitachi Energy warns of command-injection and Dirty Frag flaws in CoreTec transformer-monitoring devices
Source date: 2026-10-27
News briefing
Hitachi Energy’s October 27 PSIRT advisory 8DBD000258 reports two High-severity vulnerabilities in CoreTec: CVE-2026-13162, an OS command-injection flaw, and CVE-2026-43284, a Dirty Frag Linux-kernel flaw. The cited reporting describes CoreTec as digital transformer-monitoring and diagnostics equipment in the TXpert ecosystem.
CVE-2026-13162 lets an authenticated user with certain roles execute system commands through unsanitized timezone input, according to ISSSource. CVE-2026-43284 is described as allowing local privilege escalation to root on CoreTec5. The sources do not establish that these flaws directly enable control of a transformer or the grid.
OT implications
CoreTec supports transformer monitoring and diagnostics, so compromise or loss of availability could undermine confidence in, or access to, monitoring and diagnostic information. The command-injection issue requires an authenticated user with certain roles; Dirty Frag is described as a local privilege-escalation path. Operators should identify exact models and versions, restrict exposure, segment networks and coordinate changes with operational owners.
Sources
5. Siemens warns of critical Brotli Node2Shell flaw in Industrial Edge management products
Source date: 2026-10-30
News briefing
Siemens ProductCERT published advisory SSA-443410 on October 30, 2026, warning that CVE-2026-111497 in Google’s Brotli decoder affects Industrial Edge management products. Siemens rates it CVSS v3.1 9.8 and says a crafted Brotli-compressed stream could let a remote unauthenticated attacker corrupt memory, disclose sensitive information, cause denial of service or potentially execute arbitrary code.
Siemens said its central cloud services had been fixed in stages beginning October 28 and 29 with no user action required; affected applications require review of current product-specific remediation guidance. CISA added the CVE to KEV on October 27 based on evidence of active exploitation, which does not establish compromise of any Siemens installation.
OT implications
The exposure concerns the Industrial Edge management plane. The practical task is to identify deployed Industrial Edge components and distinguish cloud services fixed centrally from locally managed affected applications that may need operator action. Exploitation could affect confidentiality, integrity or availability of management software; actual operational impact depends on deployment and connectivity.
