Daily OT Security News: September 11, 2026 — verified items below.
CISA advisory release covers pipeline monitoring, satellite terminals, and medical ICS software
An OpenText Cybersecurity Community roundup on September 10 reports four newly released CISA advisories covering NextGen Mirth Connect, Orthanc DICOM Server, AVEVA Pipeline Integrity Monitor, and an updated advisory for ST Engineering iDirect iQ-Series terminals. The roundup directs administrators to CISA’s published advisories for technical details and mitigations, and the OpenText summary itself refers readers to the original CISA postings for full technical context and specific mitigation guidance. Source: OpenText Cybersecurity Community reporting CISA advisories
SANS data underscores IT-to-OT movement as a primary exposure path
Dark Reading’s coverage of the SANS State of ICS/OT Cybersecurity report highlights that attackers commonly exploit IT-network weaknesses before moving toward OT environments. The reporting cites SANS data showing 74.4% of reported incidents were non-ransomware and 11.7% were ransomware. It lists initial access vectors with remote services and internet-accessible devices each at 23.7%, workstations and removable media each at 20.3%, and supply-chain compromise at 20.3%. Dark Reading attributes these statistics and conclusions to the SANS report. Source: Dark Reading
OT exposure management shifts toward asset-criticality and operating context
Claroty argues that OT and CPS remediation should prioritize risk according to asset criticality, connectivity, exploitability, compensating controls, and potential physical impact rather than simply vulnerability volume. The article highlights inventories, segmentation, remote-access controls, configuration management, behavioral baselines, and human oversight as core controls. Claroty presents these elements as a framework for focusing limited remediation resources on the most consequential risks in operational environments, describing a risk-prioritization approach rather than asserting a single prescriptive solution. Source: Claroty
Passive discovery and integrity monitoring emphasized for IoT and CPS visibility
In its September 10 announcement, Fortinet says it extends IoT and cyber-physical-system visibility through a combination of passive and active device discovery. The company states these capabilities can identify and categorize assets by manufacturer, firmware, and industrial function, and that real-time firewall file monitoring can surface unauthorized changes. Fortinet frames these capabilities as features intended to improve asset classification and change detection; the announcement presents them as vendor-described capabilities rather than independently validated outcomes. Source: Fortinet
