Briefings ·
OTASEC Daily Briefing | 30-10-2026
Today's briefing follows up on PHP2Shell, now reaching Welotec SMART EMS, and on Volt Typhoon's Silent Train relay network. It also covers the University of New Mexico recovery and new US policy and guidance on CISA 2030, cloud security and AI agent identity.
1Update: PHP2Shell flaws reach Welotec SMART EMS
CERT@VDE published advisory VDE-2026-127 for Welotec SMART EMS. Two memory-safety vulnerabilities in the bundled PHP runtime allow an unauthenticated remote attacker to execute arbitrary code in the context of the PHP web worker. All versions up to and including v3.5.3 are affected, and exploitability depends on the PHP server interface, configuration and worker reuse.
For asset owners: Check whether SMART EMS is deployed in your environment, apply the vendor's guidance for versions up to v3.5.3 and limit remote access to the web interface.
2Update: Volt Typhoon hid sensitive intrusions behind Silent Train relays
Lumen's Black Lotus Labs reports that the Chinese state-sponsored group Volt Typhoon used a constantly rotating relay network, named Silent Train, to hide its most sensitive intrusions. The network consists of chains of compromised SOHO and IoT devices, and the group targeted enterprise control planes.
For asset owners: Review internet-facing SOHO and IoT devices at remote sites and monitor traffic into enterprise management systems that sit next to OT.
3Update: University of New Mexico restores hospital systems after cyberattack
The University of New Mexico has restored the systems used by its healthcare facilities after an attack that forced it to divert ambulances and cancel classes at its medical school. The university urges people not to contact the hackers.
For asset owners: Test whether your continuity plans for clinical and operational systems cover diverted services and a staged restoration.
4Update: CISA 2030 strategy emphasises OT modernization and asset visibility
Coverage of the CISA 2030 strategy highlights its focus on OT modernization, asset visibility and supply chain security. It describes a shift towards risk-based defense of critical infrastructure.
For asset owners: Use the strategy's priorities as a checklist for your own OT asset inventory and supplier security work.
5NIST outlines 10 design tenets for AI agent identity management
NIST has outlined 10 design tenets for agent identity management systems and proposes safeguards for identity and access management of AI agents.
For asset owners: If AI agents are being piloted near OT or industrial data, review how they are identified and what access they receive.
6US bill proposes Common-Sense Cloud Security Act for critical infrastructure
US Representative McCormick, a Republican from Georgia, introduced the Common-Sense Cloud Security Act. The bill aims to strengthen cloud cybersecurity and protect critical infrastructure.
For asset owners: Map which OT-related services depend on cloud providers so you are ready if cloud security requirements tighten.
7OmniTrust launches GridAuth for energy grid device identity
OmniTrust announced GridAuth, a device identity and trust management platform for energy utilities and equipment makers.
For asset owners: Treat this as a vendor announcement and assess device identity and certificate management in your own grid assets on its merits.