Daily OT Security News: October 25, 2026
Five recent, source-verified developments relevant to operational technology and connected-device security. Original source dates are shown for each story. Vulnerability disclosures are not evidence of a production-system compromise. Apply changes only through approved OT change control.
1. Coast Guard publishes NVIC 02-26 maritime cybersecurity implementation guidance
Source dates: 2026-10-20
News briefing
On October 20, the Coast Guard announced NVIC 02-26, guidance for owners and operators covered by the Maritime Transportation Security Act and 33 CFR Part 101, Subpart F. It explains how to document a qualified Cybersecurity Officer, conduct a Cybersecurity Assessment, and develop and submit a Cybersecurity Plan, with July 16, 2027 given as the deadline. Four enclosures address plan development and maintenance, a sample officer-designation letter, penetration-testing guidance, and an optional NIST Cybersecurity Framework-based risk-filtering method to scope environments, identify critical IT and OT systems, and assess dependencies. The testing guidance discusses periodic tests during five-year renewal cycles and OT safety considerations; penetration testing is not required for the initial plan submission. The Coast Guard describes its requirements as performance-based and says regulated entities are not required to hire a third party for an assessment or plan. This is implementation guidance for an existing rule, not a new regulation issued today.
Why it matters for OT
The optional scoping method offers operators a structured way to document critical IT and OT assets and their dependencies, which can help connect cybersecurity planning to operational and safety-critical functions. That matters where port, vessel, or facility systems are interdependent. The guidance also explicitly raises OT safety considerations for penetration testing and says testing is not part of the initial Cybersecurity Plan submission. Operators should therefore plan any testing around authorized scope and operational constraints, rather than treating it as routine IT scanning.
Evidence note: The Coast Guard announced this guidance on October 20, not October 25. Details are based on its announcement and resource center; the underlying NVIC PDF was not independently retrieved. This guidance implements an existing rule rather than creating a new regulation.
Sources: Coast Guard Releases New Maritime Cybersecurity Compliance Guidance | Coast Guard Maritime Cybersecurity Resource Center | US Coast Guard releases NVIC 02-26 to guide maritime operators on cybersecurity plans, IT and OT risk assessments
2. Moxa patches secrets-access and shared CA-key flaws in AIG-302 edge gateways
Source dates: Original Moxa disclosure: 2026-10-16; CISA publication: 2026-10-20
News briefing
On October 20, 2026, CISA published an ICS advisory for two vulnerabilities in Moxa AIG-302 ThingsPro Edge firmware through version 1.4.0. CVE-2026-109812 is a missing-authorization flaw in the internal secrets API; CVE-2026-109813 involves a shared hard-coded root CA private key. CISA says exploitation could expose sensitive information and lists a CVSS v3 score of 8.1. Moxa’s October 16 vendor bulletin rates the issues separately under CVSS 4.0: 6.9 (Medium) and 8.6 (High), respectively. Moxa says the first requires a low-privileged authenticated attacker with adjacent-network access; the second can be exploited by an unauthenticated attacker with adjacent-network access. Moxa provides firmware 1.4.1 as the security patch. CISA reported no known public exploitation specifically targeting these flaws and says they are not remotely exploitable. CISA recommends minimizing exposure and isolating control networks behind firewalls.
Why it matters for OT
An edge gateway can sit at the boundary between field equipment, operational networks, and upstream services; unauthorized access to its secrets or exposure of a shared CA key can undermine confidentiality and trust in communications. Operators should identify AIG-302 units and firmware versions, assess whether affected devices are reachable from adjacent networks, and plan the vendor patch with operational impact analysis. Interim firewalling and segmentation reduce exposure but do not replace the firmware fix. Patch or certificate-related changes should be tested and coordinated with OT engineering to preserve process availability.
Evidence note: Moxa originally disclosed these flaws on October 16; CISA published its advisory on October 20. Adjacent-network access is required. CVSS v3 and v4 scores use different scoring systems. CISA reported no known public exploitation at publication.
Sources: Moxa AIG-302 ThingsPro Edge — CISA ICS Advisory ICSA-26-293-03 | CVE-2026-109812, CVE-2026-109813: Vulnerabilities in Industrial Computing Products — Moxa MPSA-262560 | CISA Releases Six Industrial Control Systems Advisories
3. Hitachi Energy MicroSCADA X SYS600: CISA republishes September advisory on three vulnerabilities
Source dates: Original Hitachi Energy advisory: 2026-09-01; CISA republication: 2026-10-20; vendor revision: 2026-09-29
News briefing
On October 20, 2026, CISA republished Hitachi Energy’s advisory for MicroSCADA X SYS600, a SCADA product used in the energy sector worldwide. This is not a new October disclosure: Hitachi first published advisory 8DBD000249 on September 1 and revised it September 29. The three CVEs span CSV formula injection (CVE-2026-9852), OS-authenticated access to SYS600 application objects without SYS600 authentication (CVE-2026-9853), and escalation from engineering-tool access to Windows administrator (CVE-2026-9854). The CSV issue can affect exported logs and, depending on user configuration, may enable code execution on a user’s machine. Hitachi rates the advisory High; CISA’s summary lists CVSS v3 7.8, while CVE records show CVSS v4 scores of 4.6 for CVE-2026-9852 and 8.5 for each of the other two. CISA lists versions through 10.7 and 10.8 as affected, but its converted page does not clearly map each CVE to a version. Operators should confirm applicability and vendor remediation guidance, limit exposure, isolate control networks, and assess changes before deployment.
Why it matters for OT
The flaws matter in an operational environment because access to the Windows host or SYS600 engineering tools can undermine the separation between host-level users and SCADA application controls; the CSV flaw also creates risk when operators export logs. CISA recommends reducing exposure, placing control networks behind firewalls and separating them from business networks, using secured remote access, and assessing operational impact before changes. The advisory does not report confirmed exploitation; its SSVC vector includes E:N. Apply vendor-approved remediation with site engineering and availability requirements in view.
Evidence note: CISA republished Hitachi advisory 8DBD000249 on October 20; the original was released September 1 and revised September 29. The converted CISA page is ambiguous about per-CVE affected-version mapping, so confirm applicability and the remediation path with current Hitachi guidance. No confirmed in-the-wild exploitation is reported in the advisory.
Sources: Hitachi Energy MicroSCADA X SYS600 Product (CISA ICSA-26-293-04) | Hitachi Energy Cybersecurity Alerts and Notifications | CVE-2026-9852 Record | CVE-2026-9853 Record | CVE-2026-9854 Record
4. HMS fixes Windows kernel-crash flaws in PEAK-System PCAN drivers
Source dates: 2026-10-20
News briefing
On October 20, 2026, CISA published an ICS advisory on six vulnerabilities in HMS Networks’ PEAK-System PCAN Windows CAN drivers used for fieldbus communication. Affected versions are Device Driver Setup through 5.1.2.1151 and PCAN Windows CAN device drivers through 5.1.2. Successful exploitation could crash the Windows kernel. The CVEs are CVE-2026-109576, CVE-2026-101103, CVE-2026-94188, CVE-2026-103672, CVE-2026-110322 and CVE-2026-105960; CISA’s CSAF lists five at CVSS 3.1 5.5 (medium) and one at 7.1 (high). HMS addressed the issues in version 5.1.4 and recommends upgrading to the newest available version. CISA says the flaws are not remotely exploitable and that no known public exploitation targeting them had been reported to CISA at publication. The agency advises limiting network exposure and isolating control systems behind firewalls.
Why it matters for OT
The exposure is on Windows hosts interfacing with PCAN CAN hardware, not simply PLC firmware: a locally reachable driver flaw can turn a test bench, maintenance workstation or other CAN-connected host into a kernel-availability risk. CISA lists transportation, healthcare, energy and critical manufacturing sectors and says deployment is worldwide. Prioritize asset/version discovery and a vendor-supported upgrade coordinated with operational owners, testing compatibility and service impact before deployment. Network isolation remains an important layer, not the driver fix.
Evidence note: This is an October 20 disclosure. CISA’s web summary and machine-readable CSAF differ in how they present the vulnerability count; the CSAF lists six CVEs, five with CVSS 3.1 scores of 5.5 and one at 7.1. CISA says these flaws are not remotely exploitable and reported no known public exploitation at publication.
Sources: CISA ICS Advisory ICSA-26-293-01: HMS Networks PEAK-System PCAN Windows drivers | CISA CSAF advisory ICSA-26-293-01
5. CISA updates urgent PHP remote-code-execution patch guidance
Source dates: 2026-10-21 (CISA alert’s dated URL/original alert; updated 2026-10-23)
News briefing
CISA’s alert, first dated October 21 and updated October 23, urges immediate patching of two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619 (“php2shell”). The PHP project’s release notice was issued October 21; CERT-EU records both as CVSS 9.2. The unauthenticated remote-code-execution flaws affect PHP installations serving web requests, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed; PHP identifies mod_php as highest risk. CISA lists PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as fixes, tells operators to inventory PHP even when embedded, prioritize internet-facing systems, and take systems on unsupported PHP 8.1 or earlier offline if they cannot update. CISA’s alert said it had not observed successful exploitation at publication. Later Censys reporting describes conflicting honeypot reports, including unsuccessful attempts and an Amazon claim of broader activity; successful exploitation is therefore not established here. CISA’s October 23 revision added a SIGMA detection rule and partner guidance.
Why it matters for OT
PHP may be embedded in internet-facing management portals or other operationally important web services. Unauthenticated code execution could threaten a host and its service, but sources do not establish exploitation of industrial control equipment or process-control impact. OT teams should inventory runtime dependencies with IT and application owners, prioritize exposed hosts, coordinate vendor-supported updates, and, if systems cannot be updated, temporarily remove unsupported services from internet reach as CISA advises. Detection and recovery plans should account for web-worker shell launches and tool downloads.
Evidence note: The alert was originally dated October 21 and updated October 23. CISA’s no-successful-exploitation statement is bounded to its publication; subsequent reporting contains conflicting claims, so this briefing does not establish successful widespread exploitation. No industrial process compromise is established by these sources.
Sources: Critical Vulnerabilities in PHP Require Immediate Patching | PHP 8.3.36 Released | GHSA-w8hw-w9fx-j79h: CVE-2026-109618 PHP security advisory | GHSA-6wmf-4rv5-p3rp: CVE-2026-109619 PHP security advisory | Critical Vulnerabilities in PHP – CERT-EU Security Advisory 2026-018 | PHP Unauthenticated Remote Code Execution [CVE-2026-109618 and CVE-2026-109619]
