Briefings ·
OTASEC Daily Briefing | 29-10-2026
Volt Typhoon's disrupted Silent Train access network leads a day that also brings a report on exploited flaws in network appliances, a new CISA advisory for EPICS Base and policy moves on cloud dependence and software liability.
1Volt Typhoon used Silent Train network for zero-day attacks
Chinese state-sponsored group Volt Typhoon has been attributed to a now-disrupted covert access network called Silent Train, first identified in late 2023. It relied on rotating chains of compromised SOHO, IoT and enterprise devices, and was used in four zero-day exploitation campaigns and for strategic access, according to a Lumen Black Lotus Labs report.
For asset owners: Review exposed edge, SOHO and IoT devices that touch your OT networks, and monitor for unexpected inbound connections from consumer or small-office infrastructure.
2Update: InfraTrust report on exploited network infrastructure flaws and PHP2Shell
An InfraTrust report warns that attackers are actively exploiting vulnerabilities across critical network infrastructure. The PHP2Shell flaws put web management interfaces of firewalls, VPNs, application delivery controllers and other appliances at risk.
For asset owners: Make sure appliance management interfaces are not reachable from untrusted networks and apply vendor patches for PHP2Shell where available.
3CISA advisory: EPICS Base vulnerabilities
CISA published ICSA-26-300-01 for EPICS Base, covering CVE-2026-114595 to CVE-2026-114598. Exploitation could cause denial of service, memory corruption, information disclosure or potentially arbitrary code execution, with the Critical Manufacturing sector listed.
For asset owners: Check whether EPICS Base is used in your control or research systems and plan updates following the advisory guidance.
4ACM: Dutch energy suppliers heavily dependent on US cloud
According to ACM, Dutch energy suppliers depend strongly on a limited number of US cloud providers, including Amazon.
For asset owners: Map which operational and customer-facing functions rely on a few cloud providers and review your exit and continuity plans.
5Moldova probes possible foreign involvement in government cyberattack
Moldova is investigating possible foreign involvement in a major cyberattack on government systems. Prime Minister Vasile Tofan said, per local media, that it may be part of a wider campaign targeting citizens' personal data and government digital infrastructure.
For asset owners: Operators supporting government or public services should review incident response readiness and monitoring of externally facing systems.
6UK to consider software vendor liability for cyber breaches
The new UK budget says the government will consider where liability for cyber breaches should sit. This could be a landmark shift for a country that has relied on voluntary codes for software vendor security.
For asset owners: Review supplier contracts and security requirements, as liability expectations for software vendors may shift.