Daily OT Security News: October 29, 2026

Blog

Daily OT Security News: October 29, 2026

Five source-verified developments published October 22–28, 2026, selected for this edition using a source cutoff of October 29, 2026, 13:00 UTC. Each briefing distinguishes reported facts from operational considerations.

1. New IoT Report Finds TVs, Smart Plugs and NAS Devices Account for Two-Thirds of Smart Home Vulnerabilities

Source date

Original primary report: October 22, 2026. Later coverage and joint issuer release: October 28, 2026. The cited Spur research was published June 22, 2026.

News briefing

Bitdefender’s October 28 article about its joint report with NETGEAR says telemetry from roughly 10.4 million protected home routers, sampled January–September 2026, recorded 270.3 million vulnerability observations for TVs, 266.7 million for smart plugs, and 261.6 million for NAS devices. The report displays category shares of 22.7%, 22.4%, and 22.0%, or 67.1% combined. An observation is a device–known-vulnerability match; it is not a count of unique devices or a successful attack.

The article also reports 4.85 billion port scans, 90.1% of approximately 5.38 billion attack-category events, and 466.6 million brute-force events, including 455 million against Windows RDP. Scans and attempted logins do not establish compromise. Its smart-TV proxy discussion cites separate June research by Spur that found residential-proxy SDK fingerprints in 2,058 of 6,038 LG and Samsung TV apps scanned; Spur describes an app/connection-sharing concern rather than proof of malware infection.

There is a material reporting discrepancy: the article and joint release state approximately 1.2 billion vulnerability observations, while the primary PDF overview repeatedly states 6.2 billion. The listed category counts and 67.1% share are consistent with roughly 1.19 billion. The story should therefore be read as an exposure and lifecycle signal, with the denominator caveat retained.

OT implications

Treat this consumer-home dataset as a lifecycle and exposure signal, not evidence of compromise or a measure of OT prevalence. OT/IoT owners should reconcile inventory to exact vendor, model, firmware, and support status; review applicable vendor advisories and remote-access exposure; and prioritize unsupported or externally reachable devices using site risk criteria. Validate firmware and configuration changes in an approved test or maintenance window with backups, rollback, and operational-owner approval. Do not apply blanket updates, retirements, or network changes in live environments based on aggregate smart-home statistics.

Sources

2. OT-ISAC Tracks 2026 Asia-Pacific Cybersecurity Policy Shifts Affecting Critical Infrastructure, OT and Industrial Operations

Source date

Later coverage: October 26, 2026; the article says its editorial review was October 20. Relevant original instruments include Japan’s standards in force October 1, 2026, India’s July 31 Gazette notification, Singapore’s July 29 code issuance, and Australia’s October 15 guidance.

News briefing

The October 26 Industrial Cyber article summarizes OT-ISAC’s regional policy roundup, which distinguishes binding rules, future commencement, draft proposals, and nonbinding guidance rather than asserting one new Asia-Pacific-wide OT mandate. Japan’s National Cybersecurity Office says the Common Cybersecurity Standards for Critical Infrastructure entered into force October 1, 2026, after adoption July 31. India’s July 31 Gazette regulations cover entities managing OT associated with the interconnected power system and connected IT; they generally take effect April 1, 2027, with six provisions deferred to separate orders and a 50 MW applicability threshold for specified generation, captive-generation, and storage entities. Singapore’s CSA lists its 2026 CII Code of Practice as issued July 29 for regulation of designated CII owners.

The roundup also covers supervisory measures, government-specific legacy-technology requirements, and advisory material, including Australia’s ASD Essentials for OT, published October 15. The official Australian chapter describes itself as guidance and recommends a risk-informed approach that accounts for OT safety and availability. These examples have different jurisdictions, sectors, commencement dates, and legal status. This is a policy-development story, not a report of a cyber incident or vulnerability disclosure.

OT implications

Confirm country-, sector-, and designation-specific applicability, then map relevant clauses or guidance to asset inventories, OT/IT dependencies, suppliers, evidence ownership, and remediation plans. Treat India’s April 2027 commencement and deferred provisions separately from rules already in force; use Japan’s standard and Singapore’s CII code only where the organization and sector are in scope. Prioritize safe, documented gap assessment and change planning. Test changes, use compensating controls where patching is unsafe or infeasible, and schedule firmware, configuration, or network changes through engineering, safety review, maintenance windows, and established change control. Nonbinding guidance can inform improvement planning but should not be represented as law.

Sources

3. Centrii Flags Audit Risks as NERC CIP-003-9 Tightens Vendor Remote Access Controls for Low-Impact BES Systems

Source date

Original Centrii analysis: October 21, 2026. Later Industrial Cyber coverage: October 26, 2026. NERC lists CIP-003-9 as mandatory subject to enforcement beginning April 1, 2026.

News briefing

Industrial Cyber reported that Centrii sees compliance and recordkeeping challenges for entities operating low-impact Bulk Electric System (BES) cyber systems that permit vendor electronic remote access. This is a compliance-readiness story, not a report of a cyber incident or a new technical vulnerability. CIP-003-9 Attachment 1, Section 6 applies to assets containing low-impact BES Cyber Systems that allow vendor electronic remote access established under Section 3.1. It requires a process to determine that access, disable it, and detect known or suspected malicious inbound and outbound communications associated with it.

NERC requires retention of evidence for each requirement for three calendar years, but expressly allows a Compliance Enforcement Authority to request other evidence covering the full period since the last audit when that period is longer. ReliabilityFirst says low-impact audits may cover six years and recommends retaining evidence for the full period since the last audit where practical; six years is not the standard’s stated baseline retention rule. Possible evidence listed in the standard includes preauthorization steps, vendor-login alerts, session monitoring or recording, logs, documented disable methods, and evidence of malicious-communications detection. FERC’s 2025 inflation adjustment confirms that $1,584,648 per violation per day is a statutory maximum under Federal Power Act Section 316A, not a typical or automatic penalty.

OT implications

For covered registered entities, map every vendor or third-party remote-access path to the relevant low-impact BES asset, name the responsible approver and person empowered to disable access, and preserve dated approvals, access/session records, disable-test results, and malicious-communications detection evidence in a retrievable repository for the applicable audit lookback. Coordinate record custody with OEMs, operators, and O&M contractors. Test procedures only through approved change management and authorized maintenance windows; do not interrupt active operational, protection, or control connections or alter live systems without engineering safety review, operator coordination, and a tested recovery plan.

Sources

4. Forescout Warns Internet-Exposed Refrigeration Controls Could Enable Attacks on Food Supply Chains and Hospitals

Source date

Original Forescout research: October 22, 2026. Later Industrial Cyber coverage: October 23, 2026. CERT-FR alert: October 12, 2026; Belgian CCB notice: October 13, 2026. Related vendor and CISA advisories are from 2025.

News briefing

Forescout’s Vedere Labs reported that French authorities and responders investigated compromises affecting more than 700 supermarkets in October 2026; public reporting described malicious changes to refrigeration temperature and defrost settings and resulting food losses. CERT-FR’s October 12 alert confirms numerous compromises of Danfoss AK-SM and AK-SC controllers. A separate October 13 Belgian CCB notice also lists Copeland XWEB and Dixell XWEB among affected systems. Forescout says the incidents used ordinary supervisory functions, but initial access, the vulnerabilities used, attacker infrastructure, persistence, and responsible actors remain unconfirmed.

Forescout’s October 22 scan identified 12,976 exposed service observations across 6,017 public IP addresses in 99 countries and territories and ten product groups. These are observations, not a count of unique devices confirmed vulnerable or compromised. It found 3,762 Danfoss StoreView observations with AK-SM 800A firmware older than 4.3.1. Danfoss says versions earlier than 4.3.1 are affected by CVE-2025-41451 and CVE-2025-41452; CISA lists CVSS v4.0 scores of 8.7 and 6.8. Versions before R4.2 are also affected by CVE-2025-41450. CISA’s August 2025 update reported no known public exploitation specifically of these vulnerabilities at that time; neither Forescout nor the incident advisories establish that they were used in the 2026 compromises.

OT implications

Inventory refrigeration supervisory interfaces and the full contractor/network access path, remove direct public access, and retain remote service only through an approved secure gateway or VPN with named accounts, least privilege, MFA, and session logging. Coordinate changes with refrigeration operators and service providers; review setpoints, defrost schedules, and alarms; and validate safe operation after any change. Patch supported versions or plan replacement for end-of-life equipment only after impact assessment, backups, and tested recovery. Where compromise is suspected, follow the authority or manufacturer response process and verify configuration and process conditions before return to service.

Sources

5. CISA warns nine vulnerabilities affect Kiloview E3 encoder firmware before 1.30

Source date

Original CISA ICS advisory: October 22, 2026. Kiloview firmware 1.30 release entry: October 10, 2026; firmware page displays October 12. NVD published the cited CVE record October 22 and modified it October 23.

News briefing

CISA’s October 22 ICS advisory identifies nine CVEs affecting Kiloview E3 NDI Encoder firmware earlier than 1.30 and warns successful exploitation could fully compromise a device. The listed issues span command injection, missing authentication, insufficient session expiration, path traversal, a null-pointer dereference, and hard-coded credentials. CISA’s summary displays a vendor CVSS v3 score of 9.9, but the accessible advisory does not map that score to individual CVEs. CISA said no known public exploitation specifically targeting these vulnerabilities had been reported to it at publication.

Kiloview’s official firmware page lists version 1.30, released October 10, with security changes to web authentication, API validation/access protection, ONVIF authentication/access control, and system services; CISA identifies versions below 1.30 as affected. CISA recommends minimizing network exposure, isolating control-system devices behind firewalls, and using secure, updated VPN access where remote access is necessary. The advisory directs organizations to assess impact and risk before deploying mitigations.

OT implications

For sites using the E3 as a contribution or streaming encoder, identify the model and installed firmware, then prioritize any version below 1.30 for a controlled upgrade assessment. Keep management access off the public internet, segment the encoder from business networks, and restrict and monitor administrative access while remediation is planned. Test vendor firmware and streaming/NDI workflows in a representative environment, back up configuration, and deploy through approved maintenance and rollback procedures; coordinate with operations because changes can interrupt video services. CISA reported no known public exploitation to it at publication, so the advisory is not evidence of an incident and does not justify bypassing change control.

Sources

Share this

Recent Posts
Awards - Briefs - Solutions
Viakoo Honored as Next Gen IoT Security Winner in Cyber Defense Magazine's 2023 Global InfoSec Awards
SINET-award-2022
IoT breakthrough award
viakoo wins 2022 global 100
armis and Viakoo end to end cyber security protection