Briefings ·
OTASEC Briefing – 18-10-2026
A BeyondTrust Remote Support zero-day exploited since late August leads the news, followed by exposed supermarket refrigeration systems and actively exploited firewall flaws. Guidance from NIST and new segmentation research round out the day.
1BeyondTrust Remote Support zero-day (CVE-2026-102764) exploited since August
BeyondTrust has patched a critical flaw in Remote Support, CVE-2026-102764 (CVSS 9.3), caused by improper origin validation in an internal messaging component. It has been exploited as a zero-day since late August (at least 29 August per BeyondTrust), and The Hacker News attributes the attacks to the China-nexus group Armory Castle. NCSC-NL rates the issue H/H and notes it can be exploited remotely without authentication.
For asset owners: Patch BeyondTrust Remote Support now and, given the exploitation window since August, review appliances and remote-access logs for signs of compromise.
2Supermarket refrigeration systems hit and exposed online
Industrial Cyber reports cyberattacks on French supermarket refrigeration systems that disrupted hundreds of stores overnight from 11 October, pointing to unsecured remote access and legacy systems. Security.NL reports that around 1,200 Copeland refrigeration systems, 48 of them in the Netherlands, are accessible online, up from the several hundred (26 in the Netherlands) reported a day earlier.
For asset owners: Check whether refrigeration and other building or facility control systems are reachable from the internet, and remove or secure that remote access.
3Palo Alto Networks patches actively exploited PAN-OS RCE (CVE-2026-0322)
Palo Alto Networks issued updates for CVE-2026-0322 (CVSS 8.6), a remote code execution flaw in the PAN-OS management interface. The flaw is under active exploitation, and The Hacker News describes it as requiring authentication.
For asset owners: Apply the PAN-OS updates and make sure firewall management interfaces are not exposed to untrusted networks.
4Forescout: only 13% of OT network segments fully isolated
New Forescout research on network segmentation finds that OT and medical devices often share network segments with other enterprise assets. Only 13% of OT network segments are fully isolated, according to the analysis.
For asset owners: Review how well your OT segments are separated from enterprise IT and prioritise isolating shared segments.
5NIST releases draft SP 800-82 Rev. 4 on OT security
NIST has published a draft of Special Publication 800-82 Rev. 4, Guide to Operational Technology (OT) Security. It gives guidelines for securing OT while addressing its performance, reliability and safety requirements, covering systems such as ICS and building automation.
For asset owners: Have your OT security team read the draft and compare it with your current security programme.
6FERC flags cybersecurity compliance gaps in US power sector
FERC identified cybersecurity compliance gaps among US electricity entities, including delays, and flagged risks from AI tools and third-party control systems. Ampyx Cyber's analysis of the CIP audit findings highlights gaps in generator registration, cyber risk categorisation and AI access controls.
For asset owners: Review how asset categorisation, third-party control system access and AI tool access are handled in your compliance programme.
7PEERSTITCH malware delivered via FortiOS flaw CVE-2025-61624
A suspected advanced threat actor is exploiting CVE-2025-61624 (CVSS 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. The attack delivers PEERSTITCH, a previously unreported memory-resident ARM64 malware.
For asset owners: Confirm that Fortinet devices are patched for CVE-2025-61624, even though the CVSS score is moderate, since it is being exploited.