Briefings ·
OTASEC Daily Briefing | 04-11-2026
Supermarket refrigeration attacks spread to more countries, and a Node-RED flaw is now being used to install a Linux bot and backdoors. Phoenix Contact and Welotec advisories and fresh government guidance round out the day.
1Update: supermarket fridge attacks hit British and German businesses
Refrigerator controls at supermarkets and grocery stores across Europe were hacked early Monday in the second wave in recent weeks, following a first wave in France. Unidentified perpetrators defrosted fridges and stock spoiled; reports mention British businesses and several German supermarkets where temperatures were raised. Secomea responded by urging stronger OT remote access controls.
For asset owners: Review who and what can reach refrigeration and building controls remotely, and enforce strong authentication and access restrictions on those paths.
2Update: Node-RED flaw CVE-2026-58115 exploited to install Linux bot and backdoors
VulnCheck found attackers exploiting the authentication flaw CVE-2026-58115 in Node-RED, a flow-based programming tool built into some industrial control products. The attacks target unprotected servers and install a Linux bot and backdoors. This CVE id was already reported earlier as actively exploited.
For asset owners: Find Node-RED instances in your environment, including those embedded in industrial products, keep them off exposed networks and apply vendor fixes.
3Other advisories: Phoenix Contact PLCnext and CodeMeter, Welotec TK routers
CERT@VDE published three Phoenix Contact advisories: CodeMeter Runtime license validation flaws in PLCnext firmware (versions below 8.41a) and in licensed desktop tools (8.x below 9.10), plus PLCnext Engineer flaws before 2026.6 that may cause a complete loss of confidentiality, integrity and availability. A separate advisory covers multiple vulnerabilities in Welotec TK routers that may allow command injection with root privileges or denial of service by a high-privileged remote attacker.
For asset owners: Check your PLCnext, PLCnext Engineer and Welotec TK router inventory against the listed versions and schedule updates.
4ESET uncovers Gorbag cyberespionage campaign in Ukraine
ESET identified a previously underreported Russia-aligned threat actor, tracked as Gorbag. It conducts targeted cyberespionage against Ukrainian administrations, the defense sector and a transportation hub.
For asset owners: Transport and government-linked operators in the region should review ESET's findings and compare them with their own monitoring.
5CISA and Australia's CISC issue critical infrastructure guidance
CISA launched its 2026 Critical Infrastructure Security and Resilience campaign, urging owners to prioritize OT security, operational continuity and recovery planning. Australia's CISC published updated Critical Infrastructure Risk Management Program guidance, urging stronger cyber and supply chain controls.
For asset owners: Use the guidance to test your recovery plans and supply chain controls.
6Industrial AI adoption outpaces OT security readiness
Industrial Cyber reports that AI implementation in OT and ICS environments is outpacing the security measures organizations have in place. This leaves OT environments exposed to emerging threats.
For asset owners: Include security review in any AI project that touches OT or ICS before it goes live.
7Update: Dispel joins Project Lifeline 250 for rural hospitals
Dispel, a vendor of secure remote access for OT, announced its participation in the White House-backed Project Lifeline 250. The aim is to secure remote access at rural hospitals.
For asset owners: Healthcare operators should review how remote access to OT and medical systems is secured and monitored.