Daily OT Security News: November 13, 2026
Today’s developments cover active exploitation of the PHP2Shell vulnerabilities in a destructive campaign against Check Point gateways alongside the Siemens OT products now confirmed affected, a Department of Energy program building AI defences for energy systems, a new UK scheme for adversary simulation of critical infrastructure, joint federal guidance pressing vendors on post-quantum readiness for ICS and IoT, and a funding round aimed at the firmware supply chain inside connected devices. Source publication dates and event dates are distinguished below; advisories and research findings do not establish exploitation unless explicitly stated.
1. PHP2Shell exploitation turns destructive, and Siemens adds OT products to the affected list
Source and event dates: Check Point Research published its findings on November 12, 2026. Scanning and exploitation began on October 30, 2026, about a week after fixes for PHP2Shell became available on October 21. The second wave began on November 2. CISA republished the Siemens ProductCERT advisories covering PHP2Shell on November 12, 2026.
News briefing
Check Point Research reported that an attacker scanned and exploited unpatched Check Point Security Gateways through Mobile Access portals, using PHP2Shell for initial access and CVE-2026-123039 for privilege escalation. PHP2Shell is tracked as CVE-2026-109618 and CVE-2026-109619, two critical remote code execution flaws in the core PHP runtime affecting PHP 5 onward; fixes were released on October 21. The first wave on October 30 targeted Israeli organisations and included destructive activity. A second wave on November 2 targeted organisations in multiple countries and sectors, with no destructive activity observed.
In the investigated intrusion, the attacker escalated from the portal service account to root by exploiting CVE-2026-123039 in the DynamicCLI interface, then placed PHP webshells in the templates directory used to build login pages. They deployed TSGA, a passive backdoor installed as slot_CPconfigdaemon with boot persistence, and TSProxy, a shared library written to /lib/libcpfwcommon.so that intercepts networking functions. Check Point says both are variants of PhiliKit, a framework previously documented in attacks exploiting Ivanti appliances and associated by ESET with China-nexus UNC5221. The attacker ran the gogo scanner, moved to a VMware ESXi host over SSH using the vpxuser account, executed the destroy_v6 wiper, and left DREAM_ANNEXATION.txt notes in the directories it processed.
Check Point said the evidence does not support a high-confidence attribution. Destructive intent, a focus on Israel and a Hebrew wiper note do not fit known China-nexus patterns, and an initial access broker role or a false-flag operation remain plausible. Neither wave showed a sector preference. Separately, CISA’s November 12 republication of Siemens advisories records PHP2Shell’s reach into OT product lines. ICSA-26-316-01 lists building-automation and energy products including AMIS TS, Energy Engage, Spectrum Power 3, 4, 7 and TG, Heliox Rapid and the bt-monitoring-vm local monitoring component; ICSA-26-316-05 lists RUGGEDCOM APE1808, where the exposure comes through PAN-OS. Both carry a CVSS v3 score of 9.8. Siemens says it is still assessing impact, with some fixes released and others pending. The destructive campaign targeted Check Point gateways, not Siemens products, and no exploitation of Siemens OT products has been reported.
OT implications
PHP2Shell is a runtime flaw, so the affected population is defined by what a product embeds rather than by the product category. Spectrum Power is a control-system platform and RUGGEDCOM APE1808 is a ruggedised compute module whose PAN-OS dependency carries the flaw. Asset owners should ask vendors for the specific product and version entries in the Siemens advisories rather than assuming a controller is out of scope. The destructive outcome at the ESXi host is the more transferable lesson: a compromised internet-facing gateway can become a route to the virtualisation layer that hosts management and engineering systems. Inventory gateway and remote-access appliances, confirm patch state against the October 21 PHP release, restrict management interfaces from the internet, and check whether ESXi management is reachable from the same segment as the gateway.
Sources: Check Point Research: PHP2Shell exploitation on Check Point Gateway; SecurityWeek: PHP2Shell exploited in destructive Check Point gateway attacks; CISA: Siemens Building Automation and Energy Products (ICSA-26-316-01); CISA: Siemens RUGGEDCOM APE1808 (ICSA-26-316-05).
2. DOE’s AI-FORTS program builds AI defences for energy infrastructure and treats AI as a target
Source and event dates: Industrial Cyber reported the program details on November 13, 2026, based on an interview with the CESER program lead. AI-FORTS launched in 2024, with several projects starting in summer 2025. The Sandia National Laboratories C2E2 agreement was announced in September 2026.
News briefing
The Department of Energy is developing AI-powered tools to strengthen the cybersecurity and operational resilience of critical infrastructure through the Artificial Intelligence for Operationally Resilient Technologies and Systems initiative, known as AI-FORTS. It is overseen by the Office of Cybersecurity, Energy Security, and Emergency Response (CESER) and aligns with the first goal of CESER’s fiscal 2026 to 2030 strategic plan. Sage Briscoe, CESER technical program manager and head of AI-FORTS, described three pillars to GovCIO Media and Research.
Secure From AI addresses attackers using large language models and other AI tools against energy infrastructure, including the evaluation and stress-testing methods needed to anticipate those attacks. Secure With AI applies AI to threat detection, threat hunting, OT and ICS visibility, anomaly detection, incident response decision support, automated assessment workflows and operate-through-compromise resilience. Secure AI treats the AI systems used to operate, control or defend energy systems as targets in their own right.
AI-FORTS consolidated existing DOE research, including Communications and Cybersecurity for the Energy Edge, or C2E2. In September, CESER and Sandia National Laboratories announced C2E2 work that automates power grid data engineering and helps operators detect and locate the source of cyber threats, using large language models and generative AI. DOE describes AI-FORTS as a long-term research effort conducted with national laboratories and utilities.
OT implications
The three-pillar structure is a useful model for utilities building their own AI programs, because it separates defending against AI-enabled attack, using AI for defence, and securing the AI itself. Most utility programs today address only the second. Operate-through-compromise resilience and OT visibility are the pillars that touch control-system operations directly, and both depend on accurate asset and dependency data. Utilities evaluating AI tools should ask how the tool’s output is validated, who approves an action, and what happens when the model is wrong. The Secure AI pillar matters wherever models inform operator decisions or automated assessment: those systems need the same inventory, access control and change management as any other OT component.
Sources: Industrial Cyber: DOE advances AI-FORTS program; DOE CESER: Cybersecurity testing for resilient industrial control systems.
3. UK NCSC opens Cyber Adversary Simulation scheme to critical infrastructure operators
Source and event dates: The NCSC announced the scheme on November 11, 2026. Industrial Cyber reported it on November 13. The scheme operates initially as a minimum viable product expected to run for about 18 months.
News briefing
The UK National Cyber Security Centre launched a Cyber Adversary Simulation scheme, known as CyAS, an assurance framework for commercial providers of adversary simulation services. The aim is to help critical national infrastructure operators and other critical organisations identify trusted suppliers to test their ability to prevent, detect and respond to realistic attacks. Providers are assessed against an NCSC-defined standard.
The methodology requires reconnaissance of an organisation’s technology, exposure and threat landscape before customer-specific attack plans are developed, followed by an adversarial, end-to-end assessment rather than traditional penetration testing or auditing of controls. The scheme was developed with Cyber Oversight Bodies including regulators and Lead Government Departments, and complements the NCSC’s Cyber Assessment Framework and Cyber Resilience Audit scheme. It is intended for organisations that understand their key services, have assessed cyber risk, and have controls, monitoring and incident response arrangements in place.
NCSC chief technology officer Ollie Whitehouse said the scheme would help organisations build a clearer picture of how they would stand up to genuine attacks. Deputy director Chris Ensor said it moves beyond penetration testing and auditing of controls by testing whether organisations can protect, detect and respond. The minimum viable product phase is expected to run for about 18 months while the NCSC gathers feedback and refines the model. The launch follows NCSC warnings that critical national infrastructure should prepare for AI-powered ransomware by 2028.
OT implications
Adversary simulation reaches OT only if the scope includes it. Operators should check whether a proposed engagement covers control-system networks, engineering workstations and remote-access paths, or stops at the IT estate. The scheme’s emphasis on prevention, detection and response together is the right frame for OT, where a useful test shows whether an intrusion into business IT can reach a PLC or an HMI, and whether the resulting operational change would be noticed. Organisations without an asset inventory, a segmentation baseline and an incident-response plan will get less from an exercise than from foundational work. For those already exercising, the value is in the evidence trail that regulators and oversight bodies can use.
Sources: NCSC: Scheme will help critical organisations test their cyber defences; Industrial Cyber: NCSC launches CyAS scheme.
4. CISA, NSA and Australian partners tell operators to press vendors on post-quantum readiness
Source and event dates: CISA, the Australian Signals Directorate’s Australian Cyber Security Centre and the NSA released the joint guidance and quick-reference list, reported by Industrial Cyber on November 9, 2026. Patero and Horizen Labs announced their post-quantum migration collaboration on November 13, 2026.
News briefing
The joint guidance, titled Post-quantum questions to ask your vendors, gives vendor-neutral questions for use in procurement, contract reviews and vendor assurance. CISA notes that cryptography is embedded in systems that are difficult to update and tied to long asset lifecycles, naming industrial control systems and IoT devices, and that an effective transition therefore depends on vendor readiness.
The questions follow the stages of a transition: identifying cryptographic dependencies, assessing risk, prioritising systems, implementing post-quantum cryptography and managing change. Vendors should be able to show a current cryptographic bill of materials covering algorithms, libraries, protocols, parameters and configurations, including third-party and embedded components. They should confirm whether hardcoded, fixed or hardware-bound cryptography exists, because that determines whether a product can be patched or must be replaced. The agencies ask for committed, versioned dates for PQC-ready products well before the end of 2030, hybrid modes treated as a temporary measure with a de-hybridisation plan, and PQC included in base licensing rather than sold as an add-on. Firmware authenticity mechanisms such as Secure Boot and UEFI are flagged as long-lived constraints.
On November 13, Patero and Horizen Labs announced a collaboration to help organisations locate cryptographic dependencies, sequence migration and pilot post-quantum protection on a scoped connection such as a remote administrative path or a link between sites. Horizen Labs will lead advisory engagements that produce a prioritised migration roadmap, while Patero’s PanoQoR supports cryptographic inventory work and CryptoQoR can be evaluated in a scoped pilot.
OT implications
OT equipment outlives most cryptographic assumptions. A controller installed today may still be in service when a cryptographically relevant quantum computer arrives, and its cryptography often sits in firmware that cannot be swapped. That makes the procurement questions the practical control: ask for the cryptographic bill of materials, ask whether cryptography is hardware-bound, ask for a dated PQC roadmap, and put the answers in the contract. For installed equipment, the first step is an inventory of where cryptography is used for authentication, key exchange and signing, including remote-access paths and vendor service connections. Long-lived sensitive data, such as design files or process history, faces harvest-now-decrypt-later risk and should be prioritised separately from device authentication.
Sources: CISA: Post-quantum questions to ask your vendors; Industrial Cyber: CISA, NSA, Australian cyber agencies urge early vendor readiness for PQC transition; Industrial Cyber: Patero, Horizen Labs partner on PQC migration.
5. Finite State raises $27 million as firmware supply-chain risk moves to the procurement line
Source and event dates: Industrial Cyber reported the funding round on November 12, 2026. The round is a Series C. The October vulnerability disclosures referenced in the announcement occurred in October 2026.
News briefing
Finite State announced a $27 million Series C round led by private funds managed by The O.H.I.O. Fund, with participation from CIBC Innovation Banking, Energy Impact Partners, Energize Capital and National Grid Partners. The company analyses the software and firmware inside finished devices to find known and zero-day vulnerabilities, covering vehicles, medical devices, industrial equipment, consumer electronics and utility infrastructure.
The company frames the round around a shift in the threat model. AI-assisted research in October found critical flaws in widely used software, including the PHP runtime, in a surge some security leaders call the Vulnpocalypse. AI has compressed the time from finding a flaw to attacking it from weeks to days or hours. A single flaw in a shared open-source component can sit inside millions of shipped products that are hard to inventory and slow to patch. Finite State says what ships in finished firmware often differs from what the source code and bill of materials describe.
Regulatory pressure is part of the case. The EU Cyber Resilience Act, FDA premarket cybersecurity requirements, UNECE R155 and R156 for vehicles and IEC 62443 for industrial systems all place the burden of proof on manufacturers. The company cited a projection that the IoT security market will reach $80.3 billion by 2031.
OT implications
For asset owners, the practical question is not which analysis platform a manufacturer uses but whether the manufacturer can answer questions about the firmware it shipped. Buyers of OT and IoT equipment should ask for a software bill of materials that reflects the shipped image rather than the build manifest, ask how the vendor tracks embedded open-source components, and ask how a fix reaches a device already in service. The October PHP and Node.js disclosures are a useful test case: vendors that could quickly say which products contained the affected libraries demonstrated a capability that others only claimed. For manufacturers, the funding signals that investors expect firmware analysis to be a product-security function rather than a pre-release checklist.
Sources: Industrial Cyber: Finite State raises $27 million.
Safety and change management: Before changing production OT, coordinate with asset owners and vendors, assess safety and service dependencies, back up configurations, test where feasible, and use approved maintenance and rollback procedures.
