Briefings ·
OTASEC Briefing – 19-10-2026
Unsecured remote access to refrigeration systems at French supermarkets leads the day, alongside a new draft of NIST's OT security guide and fresh data on weak OT network segmentation. A critical BeyondTrust fix and updates to MITRE ATT&CK also deserve attention.
1Supermarket refrigeration systems hit by cyberattacks and found exposed online
Cyberattacks on refrigeration systems disrupted hundreds of French supermarkets overnight from Oct. 11, with commentary pointing to unsecured remote access and legacy refrigeration systems. Separately, Security.NL reports that around 1,200 Copeland refrigeration systems, 48 of them in the Netherlands, are accessible online and therefore at risk.
For asset owners: Check whether any refrigeration or building-related control systems, including supplier-managed ones, are reachable from the internet, and close or secure that remote access.
2Forescout: only 13% of OT network segments fully isolated
New network segmentation research from Forescout finds that only 13% of OT network segments are fully isolated. OT and medical devices often share segments with other enterprise assets.
For asset owners: Review how your OT segments are separated from enterprise assets and verify that the segmentation actually works as designed.
3NIST publishes draft SP 800-82 Rev. 4 on OT security
NIST released a draft of Special Publication 800-82 Rev. 4, Guide to Operational Technology (OT) Security. It gives guidelines for securing OT while addressing its performance, reliability and safety requirements, and covers industrial control systems, building automation, rail, maritime and more.
For asset owners: Have your OT security team read the draft and compare it with your current security programme and controls.
4Critical BeyondTrust Remote Support flaw fixed (CVE-2026-102764)
BeyondTrust has fixed a critical vulnerability, CVE-2026-102764 (CVSS 9.3), in Remote Support. Insufficient validation of message origin between internal components lets an unauthenticated attacker exploit it remotely to affect files on an affected appliance.
For asset owners: If you use BeyondTrust Remote Support, including for vendor or OT access, apply the fix promptly.
5MITRE ATT&CK v20 expands critical infrastructure coverage
MITRE has released version 20 of its ATT&CK framework. It expands coverage of critical infrastructure threats with new IT and OT attack techniques.
For asset owners: Update your threat models and detection coverage mapping to the new ATT&CK version.
6Singapore issues quantum-safe migration guidance for critical infrastructure
The Cyber Security Agency of Singapore (CSA) issued quantum-safe migration guidance for organizations exposed to quantum-related cybersecurity risks. Critical infrastructure is prioritized, with funding for cryptographic discovery and legacy OT migration.
For asset owners: Start taking inventory of the cryptography used in long-lived OT assets so migration planning has a baseline.
7FERC 2026 CIP audit findings: registration, shared control, AI access
Ampyx Cyber examined FERC's 2026 CIP audit findings. It highlights gaps in generator registration, cyber risk categorization and artificial intelligence (AI) access controls.
For asset owners: Energy operators should check their own asset registration, risk categorization and AI access controls against these audit themes.