Welcome to the Daily OT Security News for October 15, 2026. This briefing covers five source-verified OT, IoT, and critical-infrastructure developments. Publication and update dates are identified with the sources; incident facts, vulnerability advisories, and policy or training announcements are distinguished below.
Intermarché cyberattack exposes refrigeration security risks as French supermarkets face operational disruption
News briefing
Reporting published October 12–13 describes a cyberattack overnight into October 12 that manipulated connected refrigeration at French supermarket chains. Intermarché’s parent, Les Mousquetaires, told Reuters that about 150 stores were affected; refrigeration units reached as high as 50°C for six hours, and affected food was discarded to avoid health risks. The Paris prosecutor described a large-scale attack affecting connected refrigerators, with food losses and fires reported; Prime Minister Sébastien Lecornu instructed ANSSI to investigate. Retailer counts differ across contemporaneous accounts, so the 150-store figure is attributed to the parent group.
Danfoss told Reuters it was aware of incidents affecting a limited number of French refrigeration-management systems and said affected units were running outdated firmware. Danfoss advisories separately document CVE-2025-41450 (AK-SM 8xxA versions before 4.2; vendor base score 8.2; patch 4.2) and post-authentication CVE-2025-41451 (versions before 4.3.1; 8.7) and CVE-2025-41452 (versions before 4.3.1; 6.8; patch 4.3.1 for the latter two). These historical advisories do not establish that affected stores used those models or that any of these CVEs was exploited in this incident. The reported access path and incident-specific technical cause remain unconfirmed.
What to do
- Inventory refrigeration system managers and connected controllers by model, firmware, location, and operational owner; establish whether remote access is necessary and approved.
- For confirmed AK-SM 8xxA deployments, compare installed firmware against Danfoss’s current advisories and apply vendor-approved fixed releases after operational testing; confirm applicability with Danfoss or the refrigeration integrator before changing production equipment.
- Restrict administration to trusted management networks or secured remote-access paths, review internet exposure and accounts, and coordinate changes with refrigeration operations. Patching alone does not replace access controls or network segmentation.
- Validate temperature alarms, escalation contacts, safe operating procedures, and manual response plans; preserve controller and remote-access logs if investigating suspicious changes.
Sources
- Industrial Cyber, “Intermarché cyberattack exposes refrigeration security risks…” — October 13, 2026.
- Reuters, “Hackers heat French supermarket fridges, sparking fires…” — October 12, 2026 (updated October 13 per Reuters search listing).
- France 24/AFP, “’Unprecedented’ cyberattack targets refrigeration units…” — October 12, 2026.
- Danfoss Security Advisory DSA-2025-03-01 — published March 24, 2025; update September 1, 2025.
- Danfoss Security Advisory DSA-2025-08-01 — August 1, 2025.
Inductive Automation Ignition Software
News briefing
CISA published advisory ICSA-26-286-01 on October 13, 2026, concerning CVE-2026-92817, an incorrect-authorization flaw in Inductive Automation Ignition. The affected ranges are Ignition 8.1.0 through 8.1.54 and 8.3.0 through 8.3.8. The CVE record specifies that an authenticated user with access to a Vision project could use a valid Vision session identifier to gain Designer-level privileges. CVSS is 8.8 (v3.1, High; CVSS v4.0 score 8.7).
The CVE description says elevated privileges could enable arbitrary code execution in the Ignition Gateway process. Inductive Automation recommends upgrading to 8.1.55 or 8.3.9 or newer; those are the vendor-confirmed fixed releases. CISA says it had no reports of known public exploitation specifically targeting this vulnerability at advisory publication. The advisory identifies critical manufacturing, energy and information technology among relevant sectors. Potential Gateway compromise is not, by itself, evidence of a particular plant-process impact.
What to do
- Inventory Ignition deployments and determine whether they run an affected version; prioritize a planned upgrade to 8.1.55, 8.3.9 or a newer vendor release after compatibility and operational testing.
- Until upgrades are complete, restrict Gateway access to trusted users and hosts, minimize network exposure, and keep control-system networks isolated behind firewalls. CISA recommends these exposure-reduction measures; they do not fix the vulnerability.
- Review access to Vision projects and Designer-level privileges, and investigate anomalous Gateway activity using established incident procedures. Do not assume exploitation solely because a system is on an affected version.
- Coordinate change timing and impact analysis with OT and system owners before making production changes; report suspected malicious activity through established internal procedures and to CISA as appropriate.
Sources
- CISA, ICSA-26-286-01: Inductive Automation Ignition Software — initial release October 13, 2026. Supports affected ranges, CVSS 8.8, sector context, general consequence, defensive recommendations and CISA’s exploitation-status statement.
- CVE Record (CVE-2026-92817), CNA record — published October 13, 2026; updated October 14, 2026. Supports the session/prerequisite detail, Gateway code-execution description, version boundaries, CVSS v3.1/v4.0 scores and fixed versions.
- Inductive Automation Trust Center, Ignition Software Upgrade Recommendations — the page’s advisory text says it was updated September 17, 2026. Supports the vendor’s recommendation to update to 8.1.55 or 8.3.9 or newer and its description of possible Gateway-process/host consequences.
Swann Communications SWIFI-SE2KIC
News briefing
On October 13, 2026, CISA published an ICS advisory for the Swann SWIFI-SE2KIC camera. It identifies three missing-authentication-for-critical-function vulnerabilities (CVE-2026-107605, CVE-2026-107606, and CVE-2026-107607) affecting firmware version 2.0.22 and earlier. Successful exploitation could expose camera video without authentication; an October 14 report describing the flaws says the affected functions include live video and snapshots, and require an attacker on the local network. CISA states the flaws are not remotely exploitable and that it had received no reports of known public exploitation specifically targeting them.
CISA displays a CVSS v3 score of 6.2; the October 14 report assigns that score to each of the three CVEs. CISA categorizes the advisory under Commercial Facilities and says the product is deployed worldwide. The advisory and reviewed vendor guidance do not identify a fixed firmware release, so owners should verify remediation status with Swann rather than assume an available update resolves these flaws.
What to do
- Inventory SWIFI-SE2KIC cameras and check their firmware version; prioritize versions 2.0.22 and earlier for follow-up.
- Ask Swann whether a fixed release or model-specific mitigation is available. Swann’s general app guidance explains how to check for and install available firmware, but does not confirm that an update fixes these CVEs.
- Keep affected cameras off direct internet exposure; restrict access to trusted local networks and place them behind appropriate firewall controls. CISA advises minimizing exposure and isolating control-system networks and remote devices from business networks.
- Review router/firewall rules and remote-access paths, including any camera or video-stream port forwarding; reassess controls after a vendor-verified fix is applied.
Sources
- CISA, Swann Communications SWIFI-SE2KIC — initial release October 13, 2026.
- CISA, Releases Two Industrial Control Systems Advisories — October 13, 2026, 2:15 p.m. EDT.
- ISSSource, Swann Communications Camera Mitigations — October 14, 2026 (publication date shown in search listing); provides the CVE-by-CVE description and local-network context.
- Swann Support, How to Update Firmware Using the Swann Security App — no publication/update date displayed; general update instructions only.
DOE, INL launch weekly series on cyber-informed engineering to advance cybersecurity in energy infrastructure
News briefing
The U.S. Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response (CESER) and Idaho National Laboratory (INL) announced the CIE Back-to-School Weekly series. DOE published its announcement on October 13; Industrial Cyber reported it on October 14. The education program is intended to help energy professionals and engineers explore and apply Cyber-Informed Engineering (CIE), one of 12 foundational principles at a time.
According to DOE, weekly learning-hub modules will include a principle overview, an application case study, and questions to help engineers consider applying the principle to their energy systems. The series opened with Principle 1, Consequence-Focused Design, and is planned to conclude with a CIE Handbook. This is a training and resource initiative—not an incident report, vulnerability advisory, or evidence of exploitation. DOE frames CIE as integrating cybersecurity into infrastructure engineering and design, including engineered controls intended to reduce consequences of cyber-enabled attacks.
What to do
- Energy asset owners and engineering teams can review the DOE learning hub and its first module, then decide whether the material fits current design, upgrade, or operations work.
- Use the CIE Implementation Guide and analysis resources to structure a cross-functional discussion among engineering, operations, safety, and cybersecurity teams about consequential failure scenarios and potential engineered mitigations.
- Consider whether relevant projects can document consequence-focused design assumptions and review them through the system lifecycle; adapt controls to the specific system rather than treating the learning material as a prescribed checklist.
- Continue established OT security practices alongside engineering work. The announcement does not replace operational safeguards or prescribe device-specific patches, configurations, or incident actions.
Sources
- U.S. DOE CESER, “CESER Launches CIE Back-to-School Series: A Weekly Deep Dive into CIE Principles” — October 13, 2026 (primary announcement).
- Industrial Cyber, “DOE, INL launch weekly series on cyber-informed engineering to advance cybersecurity in energy infrastructure” — October 14, 2026.
- U.S. DOE CESER, Cyber-Informed Engineering — undated program overview (accessed October 15, 2026).
ECSO outlines six priorities for EU space cybersecurity policy, from secure-by-design systems to threat intelligence sharing
News briefing
The European Cybersecurity Organisation (ECSO) is calling for a dedicated European industrial policy for space cybersecurity, arguing that regulation alone will not build the capability needed to protect Europe’s space infrastructure. Its publication proposes a long-term public-private partnership to coordinate investment, innovation, certification, intelligence sharing and incident response. ECSO cites satellites’ long service lives, difficulty of updating them after launch, and growing dependence on commercial technologies and connected ground systems as sector-specific challenges.
The ECSO paper sets out six investment priorities: security-by-design across the lifecycle; post-quantum cryptography readiness; ground-segment hardening; continuous security testing and validation; governance, supply-chain assurance and workforce training; and threat-intelligence sharing and sector engagement. Suggested measures include identity and access management, segmentation, protected command and telemetry links, software bills of materials, cyber ranges and mission-specific training. This is a policy-recommendation publication—not an incident report, vulnerability advisory, or evidence that a named system has been exploited. It does not identify a CVE or affected product/version.
What to do
- Space operators and relevant ground-system owners can map critical assets, suppliers and dependencies across satellite, ground and digital environments, then prioritize controls against their own mission risk.
- Review identity and access controls, network segmentation and protection of command/telemetry links in the ground segment; treat the ECSO proposals as policy guidance, not a substitute for applicable requirements or local risk assessment.
- Plan assurance for long-lived assets: track supplier and software-component dependencies, establish update and cryptographic-agility plans where technically feasible, and test incident response and recovery.
- Monitor subsequent EU policy and standards work before treating the recommendations as binding obligations; coordinate threat-information sharing through appropriate sector channels.
Sources
- Industrial Cyber, “ECSO outlines six priorities for EU space cybersecurity policy…” — October 14, 2026. Supports the candidate’s publication date, summary and attribution.
- European Cybersecurity Organisation (ECSO), “EU Cybersecurity Industrial Policy for Space” — October 12, 2026 according to indexed metadata; the page text does not display a date. Primary source for the six priorities, challenges, proposed partnership and recommended measures.
