Briefings ·
OTASEC Briefing 21-10-2026
Siemens confirms active exploitation of a Software Center flaw, and a joint advisory puts SafePay ransomware at more than 600 critical infrastructure victims. The EU Cyber Resilience Act and AI risks to OT round out the day.
1Siemens Software Center flaw exploited; CISA adds Siemens, Plex2Shell and SiteGuard flaws to KEV
Siemens confirmed active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center (CVSS v4.0 8.4), used in a ClickFix malware campaign. The advisory was published on 15 October and updated on 17 October; the flaw was reported by Huntress Labs. CISA also ordered US federal agencies to patch exploited flaws in Plex Media Server (Plex2Shell), Siemens and SiteGuard products.
For asset owners: Check where Siemens Software Center is installed on engineering and OT-adjacent workstations, apply the Siemens advisory mitigations, and warn users about ClickFix-style lures.
2CISA and FBI: SafePay ransomware has hit over 600 critical infrastructure organizations
CISA says the SafePay ransomware gang has breached more than 600 critical infrastructure organizations worldwide since 2024. The FBI and cyber agencies in the UK and Germany describe SafePay as among the most active groups, gaining access by guessing passwords, exploiting vulnerabilities and phishing.
For asset owners: Review password policies and MFA on remote and IT-to-OT access paths, prioritise patching of internet-facing systems, and check phishing defences.
3Update: EU Cyber Resilience Act won't force fixes for fridge controllers hit in French attack
Following the recent attack on supermarket refrigeration systems, The Record reports that the EU Cyber Resilience Act, in effect since last month, only requires vulnerability fixes and free updates during a product's support period, which manufacturers define. Separately, Advantech and DEKRA are targeting industrial cybersecurity gaps as CRA implementation advances.
For asset owners: Ask suppliers for the declared support period and update commitments of installed devices, and do not rely on the CRA alone for legacy equipment.
4Other advisories: Festo AX OS in CEPE and Pilz IndustrialPI
CERT@VDE published advisories on Festo AX OS in CEPE (based on PLCnext), affected by OpenSSL vulnerabilities CVE-2025-15467 and CVE-2025-69419. Pilz reported flaws in the IndustrialPI piControl kernel module (before 2.8.0-1; memory corruption, denial of service), PiCtory (before 2.17.0; CSRF) and RevPiPyLoad (before 0.11.1; arbitrary file access or deletion). No exploitation is mentioned.
For asset owners: Check whether you run the affected Festo and Pilz versions and plan updates, limiting network access to these devices until then.
5AI and OT: Booz Allen tests and CISA/NSA/NIST guidance on autonomous AI
Booz Allen warns that frontier AI models, given limited human direction, achieved all eight objectives in controlled tests of an industrial environment, including exploiting OT pathways and manipulating controllers. Separately, CISA, NSA and NIST urge safeguards, continuous monitoring and incident reporting for autonomous super intelligence systems.
For asset owners: Treat AI-assisted attacks as a realistic scenario: verify segmentation and monitoring of controller access, and review any AI tooling connected to OT.
6Accenture, Dragos and SANS launch foundation for under-resourced US utilities
Accenture, Dragos and SANS Institute launched a foundation with approximately $10 million in initial funding and services. It will provide technology, deployment services and training at no cost to up to 500 under-resourced utilities.
For asset owners: Smaller utilities should look into eligibility for this support to close basic OT monitoring and training gaps.
7APT28 breaches NATO naval shipbuilder with new reflective loader
Symantec attributes attacks on two NATO member states to APT28 (Fancy Bear), tracked as Swallowtail, including a breach of a naval shipbuilder. The activity involved the HOOKEDGE backdoor and a new reflective loader.
For asset owners: Defence-sector and manufacturing suppliers should check their logs and threat intelligence feeds for the reported tooling and tighten monitoring of IT networks adjacent to OT.