Daily OT Security News: November 09, 2026
Five source-verified OT, connected-device and critical-infrastructure developments published or updated November 3–9, 2026. Some describe earlier vulnerabilities or incidents; their dates and the limits of reported operational impact are identified below.
1. Researchers observe SSHole attempts as OpenSSH bypass raises embedded-device concerns
Source date: November 8, 2026. Event dates: SANS dates the first apparent SSHole-specific attempts on its honeypots to November 5; the OpenSSH and Alpine fixes were published November 5.
News briefing
SANS Internet Storm Center reported SSH login attempts against its honeypots consistent with CVE-2026-123158, known as SSHole. The sensors retained only the first 255 password characters, limiting what the observations establish; SANS did not confirm how many attempts succeeded. Separately, Previdian told Help Net Security that an attacker obtained root access to a Previdian Alpine/OpenSSH honeypot. Neither observation establishes compromise of a production OT device. The bypass affects certain unpatched OpenSSH servers on Linux using musl libc without PAM, under specific conditions: SSH must be reachable, password authentication enabled, an SSH-eligible account must have an asterisk as its password field, and another local account must have a $5$ or $6$ password hash. Under those conditions an oversized password can authenticate as the eligible account. Direct root login depends on the SSH configuration or a separate privilege-escalation path.
OT implications
Medcrypt says it reproduced the bypass on a stock Yocto image, illustrating a possible embedded-system exposure, not proof that a particular medical or OT product is affected. Ask device suppliers whether the exact firmware has affected OpenSSH, musl and authentication settings, including any backported fix. OpenSSH 10.6p2 contains the upstream workaround; Alpine lists patched packages by branch and says to restart sshd after updating. If an update is not yet possible, Alpine recommends disabling SSH password authentication after confirming that an alternative login works, then restarting sshd. Restrict unnecessary SSH access and review accepted-password logins to accounts that should not accept passwords. Coordinate access and software changes with operational owners; no patient harm or physical-process disruption is established by the sources.
Sources: SANS Internet Storm Center: SSHole scans; Help Net Security: reported honeypot exploitation; Alpine Linux advisory; OpenSSH 10.6p2 release notes; Medcrypt: Yocto testing.
2. Nozomi announces FedRAMP Moderate certification for its government OT/IoT cloud service
Source date: November 9, 2026. Event date: The FedRAMP Marketplace listed the service as certified as of November 5; it does not specify a separate certification date.
News briefing
Nozomi Networks announced that Vantage for Government has achieved FedRAMP Moderate certification. The federal FedRAMP Marketplace lists the specific software-as-a-service offering as FedRAMP Certified, in Ongoing Certification, under the Rev5 Agency path and Class C (Moderate). Nozomi describes the service as providing OT/IoT asset inventory, vulnerability assessment and threat monitoring; those are vendor claims, not independent verification of performance. The announcement does not report a new vulnerability or exploitation.
OT implications
Certification provides reusable federal security-assessment evidence for this particular cloud service; it does not by itself establish that an agency’s devices or operational environment are secure. Agencies remain responsible for authorizing their own systems and for configuration, access, integrations and their own controls. Nozomi’s announcement mentions third-party integrations, while its government-edition comparison says they are not yet available. Before deployment, confirm the current integration scope with the vendor and review the certification package and operational requirements.
Sources: Nozomi Networks announcement; FedRAMP Marketplace: Vantage for Government; Nozomi government-edition comparison; FedRAMP agency-use guidance.
3. Prosys updates OPC UA tools after eMudhra certificate compromise
Source date: November 4, 2026. Event dates: Prosys published its security advisory October 26 and updated it November 4; the product releases were announced November 4.
News briefing
Prosys released OPC UA Simulation Server 2026.2.2, Browser 2026.2.2 and Monitor 1.7.8 with updated Java runtimes addressing eMudhra certificate issues tracked as CVE-2026-91403 and CVE-2026-114820. The company says Forge’s bundled Java runtime also trusts affected certificate authorities. An attacker possessing a compromised CA key and able to intercept a vulnerable outbound TLS connection could impersonate its destination. For Simulation Server and Browser, the affected data-connection scenario is OPC UA PubSub over MQTT/TLS; the three tools’ auto-updaters were also affected. Conventional OPC UA client/server connections use a separate application certificate store and are not affected by this issue. Prosys reported no known exploitation in the wild as of October 26; that historical statement is not a current finding. It says a future Forge release will address the issue but does not name a fixed Forge version.
OT implications
Inventory relevant Prosys installations and verify versions, connection settings and trust stores. Prosys says affected Forge outbound MQTT, HTTPS, LDAP/Active Directory and OAuth2 connections could expose credentials or data to an intercepting attacker. Malicious inbound values could reach devices only if the relevant Forge nodes are connected to them; no plant compromise or safety incident is established. Deploy the three available updates under OT change control. Pending the Forge fix, Prosys advises explicitly selecting trusted CA certificates for affected connections or removing its listed eMudhra roots from the bundled Java trust store; explicit CA selection does not cover OAuth2 token requests. Follow the product-specific instructions, account for possible connectivity effects, and do not disable certificate or hostname validation.
Sources: Prosys November 4 release announcement; Prosys eMudhra security advisory; OpenJDK October 21 advisory; OpenJDK October 24 advisory.
4. University Hospitals restored MyChart after Oct. 22 cybersecurity incident; limited bill-pay outage remained
Source date: November 8, 2026. Event dates: MyChart restoration was announced November 7, 2026; unusual server activity was detected October 22, 2026.
News briefing
University Hospitals announced on November 7 that its MyChart patient portal was available again, a recovery milestone after unusual server activity was detected on October 22 and systems were disconnected from the internet. Cleveland.com reported on November 8 that some data and test-result updates could be delayed while records were reconciled and that the bill-pay area remained unavailable on Sunday. UH said its hospitals, emergency departments and physician offices stayed open, clinicians could access patient charts internally, and the vast majority of appointments and procedures continued. The disruption nevertheless increased calls and required some patients to use alternative channels. The type and cause of the cyber activity have not been publicly specified in these sources; ransomware, another intrusion method, a disruption of hospital care, and medical-device impacts are not confirmed.
OT implications
No effect on OT, medical devices, building controls or physical-security systems is established, and the reporting does not show a crossing from enterprise IT into those environments. Healthcare OT teams can use this as a continuity and dependency-check scenario: map any shared identity, network, DNS, hosting or communications dependencies between patient-facing IT and clinical, building or physical-security workflows; confirm segmentation and monitoring boundaries; and maintain tested alternate procedures that preserve care and life-safety functions if enterprise services are isolated. MyChart’s restoration does not establish restoration of any unreported OT system or demonstrate which controls caused recovery.
Sources: Cleveland.com: UH restores patient access to MyChart; WKYC: MyChart back online after cybersecurity incident; University Hospitals: Cybersecurity Incident (earlier incident notice; does not reflect the November 7 restoration).
5. UK NCSC assessment warns AI-enabled intrusion may increasingly target CNI legacy technology by 2028
Source and event date: November 3, 2026, the assessment’s publication date; no specific intrusion event is reported.
News briefing
On November 3, the UK National Cyber Security Centre published “Artificial intelligence and cyber intrusion,” an assessment of AI-enabled cyber-threat trends through 2028. The NCSC judges it likely that attackers will use AI-cyber capabilities against known vulnerabilities in critical national infrastructure (CNI) legacy technology and against attack-surface opportunities created by AI deployment within CNI. It also judges that AI-powered malware will highly likely be used in a ransomware attack on UK CNI by 2028. The report’s three scenarios are plausible illustrations, not predictions. The assessment covers CNI broadly rather than being an OT-specific technical study; it is not evidence of current AI-powered exploitation of OT or an operational disruption.
OT implications
Treat the assessment as a planning signal, not an incident alert. Review inventories of legacy assets and map their dependencies and permitted remote or enterprise connections. Prioritize exposure reduction and patch planning on a risk basis, validating changes with asset owners and vendors in representative test environments before production deployment. Include AI services newly connected to operational environments in architecture and access reviews, and exercise recovery plans for scenarios that could affect process availability or safety. The assessment identifies no specific OT product, exploit, affected operator or immediate mitigation.
Sources: UK NCSC: Artificial intelligence and cyber intrusion; UK NCSC: Cyber chief on AI-powered attacks and critical infrastructure.
Safety and change management: Before changing production OT, coordinate with asset owners and vendors, assess safety and service dependencies, back up configurations, test where feasible, and use approved maintenance and rollback procedures. Do not infer a compromise or process disruption without evidence.
