Daily OT Security News: November 12, 2026
Today’s developments cover AI-assisted vulnerability discovery in the embedded networking software inside OT and IoT devices, a data breach at Maersk traced to an acquired legacy system, US utilities testing frontier AI against grid software, ENISA’s 2026 assessment of EU critical-infrastructure readiness, and the remediation gap exposed by a federal water-utility pilot. Source publication dates and event dates are distinguished below; advisories and reports do not establish exploitation unless explicitly stated.
1. AI-assisted research finds 66 new flaws in TCP/IP stacks used across OT and IoT
Source and event dates: Forescout announced the research on November 12, 2026. The study covered 10 TCP/IP stacks and reported 54 findings to vendors and maintainers; disclosure is ongoing. No exploitation event is reported.
News briefing
Forescout Research – Vedere Labs published “Finding Critical Infrastructure Bugs with Off-the-Shelf AI,” describing an AI-assisted research harness built around generally available models. It applied the harness to 10 popular TCP/IP stacks, including seven the team had analyzed in earlier Memoria research and three new ones. The researchers validated 99 vulnerabilities, 66 of them previously unknown. Fifty-two percent of the 66 new vulnerabilities were rated high or critical, and 54 were reported to vendors and maintainers. The system also rediscovered 40% of previously known vulnerabilities.
The approach cut analysis time from roughly nine months of manual work to 90 hours, combining about 10 hours of independent AI analysis with 80 hours of validation. Static analysis across the 10 stacks cost about $935, or $2.58 per finding. Binary-only analysis was roughly six times more expensive and took twice as long as source-code analysis, but it still produced results, which matters for proprietary firmware where source code is unavailable. Forescout says TCP/IP stacks are embedded in OT, IoT, medical, network and other cyber-physical products, so one flaw can propagate through many downstream devices and vendors.
Forescout recommends prioritizing by reachability, exploitability and operational impact rather than treating all findings equally. It also recommends disabling unnecessary services such as FTP, Telnet, IPv6 and web administration interfaces; isolating end-of-life devices in tightly controlled segments; accelerating patching where fixes exist; and requiring support lifetimes, vulnerability-disclosure policies, SBOMs and ongoing security testing in procurement.
OT implications
The results change the planning assumption for OT vulnerability management: discovery is becoming faster and cheaper, while the path from a vendor fix to an embedded-device patch remains slow. Asset owners should inventory affected device models and firmware versions, ask vendors whether their TCP/IP stacks are in scope, and track advisories for the 66 new findings as they are disclosed. Because many OT devices cannot be patched quickly, exposure reduction and segmentation are the controls that can be applied now. Internet-facing management interfaces and end-of-life devices deserve priority. A device with no CVE yet should not be treated as unaffected; the research shows how quickly unknown flaws can be found.
Sources: Forescout: AI-assisted critical-infrastructure research announcement; ComputerWeekly: Forescout bug-hunting coverage; Forescout Research – Vedere Labs.
2. Maersk confirms data theft from acquired legacy system as WhiteArmor demands $5 million
Source and event dates: Maersk published its statement on November 11, 2026. WhiteArmor listed Maersk on its leak site on November 7, 2026, and set a 30-day payment deadline. Maersk has not disclosed when the intrusion occurred or how access was obtained.
News briefing
Maersk said it identified unauthorized access and data extraction from one of its local legacy systems, inherited through a previous acquisition. The company said its cyber security team launched an investigation, took action to secure the system, and found no indication that other Maersk systems or customer and partner systems connected through APIs and EDI were affected. It said findings so far strongly suggest no sensitive data has been disclosed and that it does not anticipate disruption to customer operations. Booking and shipment management remain available.
WhiteArmor listed Maersk on its leak site on November 7 and demanded $5 million in bitcoin within 30 days. The group claims about 100 GB of data from the OCF/LF Logistics platform, which Maersk acquired with LF Logistics in 2022. Its claim includes roughly 29,000 driver records, 16,093 of them with plaintext passwords; 16,123 staff accounts, including 33 superadministrators; signed delivery receipts; inventory, purchase orders and advance shipping notices; and 27,842 mobile-device logs with phone numbers, emails and IMEI identifiers. The claims have not been independently verified, and Maersk has not confirmed WhiteArmor’s involvement or the data types involved.
Maersk operates about 700 container ships, roughly 13.5% of global fleet capacity, 60 terminals in 35 countries and operations in 130 countries. The company rebuilt its infrastructure after the 2017 NotPetya attack, which disrupted IT for ten days and cost up to $300 million.
OT implications
No operational-technology impact has been reported, and the incident should not be described as a port or terminal control-system compromise. The OT-relevant lesson is about inherited and adjacent systems: an acquired logistics platform can hold credentials, integration paths and identity data that support physical operations. Asset owners should include legacy and acquired systems in incident-response scope, map API and EDI connections to operational partners, remove plaintext password storage, reduce standing superadministrator access, and monitor for credential reuse. Where logistics or vendor systems connect to OT-adjacent processes, verify that segmentation and monitoring cover those paths rather than relying on the statement that the incident is isolated.
Sources: Maersk: IT security incident statement; BleepingComputer: Maersk breach and WhiteArmor demand; SecurityWeek: Maersk data theft.
3. US utilities test Anthropic’s Mythos AI to find vulnerabilities in energy systems
Source and event dates: Bloomberg reported the utility testing on November 11, 2026. Duke Energy’s chief security and information security officer said Anthropic enabled access in late summer 2026. No specific vulnerability or incident is disclosed.
News briefing
Bloomberg reported that some US power companies, including Duke Energy, are testing Anthropic’s advanced AI models and integrating them into their cyber defenses to find software vulnerabilities. Duke Energy’s Martin Strasburger said Anthropic enabled utilities to use the tools late this summer, after months of requests to the company and US officials. Utilities are using the models to surface weaknesses in their own code and systems, according to the report.
Access to the most capable models is controlled. Anthropic screens would-be users, and organizations seeking the least-restricted versions must clear company approval and US government review, Bloomberg reported. Anthropic previously gave a limited group, including Amazon, Apple and JPMorgan, access to Mythos through Project Glasswing; its Cyber Mission program pairs top models and technical teams with critical-infrastructure operators. Duke Energy has also received access to OpenAI’s Project Daybreak, according to the report. Cost remains a concern: utilities still pay for the models, and Strasburger called the spending significant.
The context is a faster threat landscape. Bloomberg noted that AI models have escaped test environments and that AI can compress work that once took weeks into hours; it also cited Volt Typhoon’s presence in US critical-infrastructure networks and an August attack that took a small UK power plant offline. Anthropic and the White House declined to comment.
OT implications
AI-assisted discovery can find real weaknesses in grid software, but it does not by itself make the grid safer. The operational bottleneck is remediation: verifying a finding, identifying the affected device and firmware, testing the change without disrupting generation or delivery, and documenting closure. Utilities adopting these tools should define that workflow before expanding model access, or they will accumulate findings faster than they can act on them. Access controls, logging and human approval matter because the same models can be used offensively. The report also reinforces that OT security is becoming a data-governance problem: topology, device and vulnerability information shared with AI providers needs contractual and technical protection.
Sources: Bloomberg: Anthropic’s Mythos AI looking for cyber flaws in energy systems; Briefs: Utilities tap Anthropic’s AI to shore up grid cyber defenses.
4. ENISA finds improving EU maturity but uneven critical-infrastructure and supply-chain readiness
Source and event dates: ENISA published the 2026 Report on the State of Cybersecurity in the Union on November 10, 2026. The reporting period runs from July 2024 to July 2026. Industrial Cyber reported on the findings on November 12, 2026.
News briefing
ENISA’s second biennial report introduces an EU Cybersecurity Index and puts the bloc’s average maturity at 71.53 points out of 100. Supply-chain management was among the strongest areas at 89.91 points, while national CSIRTs averaged 54.76, reflecting uneven capability. ENISA assesses the threat level as substantial and says AI is accelerating vulnerability discovery and exploitation, acting as a force multiplier for attackers and defenders. Geopolitical developments, ideologically motivated activity and financially driven crime are shaping the landscape.
The report says some groups claimed intrusions into operational technology or industrial environments, but verified disruptions remained limited. It also finds that NIS2 transposition is still incomplete two years after the October 17, 2024 deadline; the Cyber Resilience Act becomes fully applicable on December 11, 2027, with reporting obligations and conformity-assessment body notifications applying from September 11, 2026. Critical sectors are improving, but legacy systems burden energy, rail, water and public administration, and 45% of organizations struggle to find skilled professionals.
Compliance is the main investment driver for 70% of surveyed organizations. Supply-chain attacks are a concern for 47%, second to ransomware at 55%; 90% say they have supply-chain controls, yet 37% rank supply-chain risk management as the hardest NIS2 requirement, and more than a third outside banking feel unprepared. In ICT service management, 43% ran no cybersecurity assessments in 2024 and 45% took more than three months to patch critical systems.
OT implications
For EU-facing asset owners, the report shifts the emphasis from transcribing NIS2 to proving implementation. OT teams should be able to show an asset inventory, patch and vulnerability status, supplier assessments, incident-response exercises and business-continuity plans for critical operations. The finding that OT disruption claims were mostly unverified is not reassurance; it reflects limited reporting and visibility. The legacy-system burden in energy, water and rail is a direct argument for discovery and remediation programs that do not depend on replacing entire control systems. Supply-chain risk management deserves particular attention because it is both a leading score and the hardest requirement for many entities.
Sources: ENISA: 2026 Report on the State of Cybersecurity in the Union; Industrial Cyber: ENISA report coverage.
5. Project Watershed 250 exposes the water sector’s remediation gap
Source and event dates: Project Watershed 250 launched in San Antonio on August 31, 2026, as a six-month pilot. Industrial Cyber published its feature on November 10, 2026. The FBI and EPA alert referenced in the article was issued July 30, 2026; attacks began July 27.
News briefing
Project Watershed 250 is a six-month federal pilot that helps water utilities discover and correct cybersecurity vulnerabilities. It brings together the White House Office of the National Cyber Director, Texas Cyber Command, the Texas Governor’s Office, the EPA and CISA, with private-sector partners. Participating utilities receive red-team assessments, AI tools, threat intelligence, training, remediation help and defensive tools at no cost. Texas alone has more than 7,400 public water systems and 3,000 wastewater treatment facilities serving 31 million people.
The pilot follows a July 30 FBI and EPA alert warning that utilities in at least seven states had been hit since July 27. Attackers targeted internet-exposed Rockwell Automation/Allen-Bradley MicroLogix programmable logic controllers; some incidents disrupted water operations, and attackers changed device passwords and IP addresses, leaving operators unable to monitor and control equipment. Industrial Cyber’s feature focuses on what happens after a vulnerability is found: utilities often lack the staff, procurement paths, governance and sustained funding to remediate, and the pilot’s free tools may become paid subscriptions when it ends.
Texas Cyber Command’s vendor terms require providers to disclose service limits, expiry dates and post-pilot costs, and bar automatic conversion to paid services. The EPA announced $11.75 million in grants for 10 midsize and large drinking-water projects on August 31, but the awards went to larger systems, not the smallest utilities most exposed. Experts quoted by Industrial Cyber said remediation is often less about funding than about decision-making authority, competing operational priorities and the friction between security, operations and governance teams.
OT implications
The pilot’s central lesson is that discovery without remediation does not reduce risk. Water utilities should use the attention to build a repeatable remediation path: rank findings by operational consequence and reachability, not raw CVSS; assign ownership across security, operations and vendors; test changes against service continuity; and budget for recurring maintenance, not just one-time tools. Internet-exposed PLCs with default or shared passwords remain a direct path to lost monitoring and control. Segmentation, password rotation, firmware updates where supported, and removal of unnecessary internet exposure are the minimum controls. The pilot’s end date is a reminder that grant-funded tools need a sustainment plan.
Sources: Industrial Cyber: Project Watershed 250 feature; CISA: Iranian-affiliated actors exploit PLCs across US critical infrastructure.
Safety and change management: Before changing production OT, coordinate with asset owners and vendors, assess safety and service dependencies, back up configurations, test where feasible, and use approved maintenance and rollback procedures.
