TL;DR Digi International disclosed CVE-2026-75937, a critical Digi DAL OS vulnerability scored 9.4 on CVSS 4.0. One crafted HTTP POST to the web admin interface can run commands as root. Digi has shipped patches for most devices, but several end-of-life models will never get one. Why It Matters Digi Accelerated Linux (DAL OS) runs on Digi's IX, EX, and TX cellular routers, Connect IT and Connect EZ console servers, AnywhereUSB hubs, and XBee gateways.

TL;DR Moxa disclosed two Moxa MGate vulnerabilities on October 2, 2026. The worse flaw, CVE-2026-86325, scores 9.4 on CVSS 4.0 and lets a read-only user corrupt device memory. The second, CVE-2026-86326, lets a privileged attacker install tampered firmware. Why It Matters MGate protocol gateways link serial and Ethernet devices in industrial networks. According to a 2016 CISA advisory, Moxa estimates these units run across energy, water, manufacturing, and government sectors.

ICS Advisory Project The ICS Advisory Project is an open-source project that provides the Critical Infrastructure Security Agency (CISA) ICS Advisories, visualized as a Dashboard and in Comma-Separat...

Welcome to the Open Security Conference (osco), the people-centred international gathering for everyone interested in cybersecurity. Join us 5-8 November 2026 in Rückersbach, Germany.

Discover how AI lowers the barrier for attacks on energy infrastructure, see key factors driving vulnerability, and explore strategies for better defense.

TL;DR The Apache Software Foundation disclosed CVE-2026-102508, a critical Apache PLC4X vulnerability in its OPC UA driver, on September 30, 2026. It scores 9.2 under CVSS 4.0. An attacker in a network position between client and server can impersonate the server and steal user credentials. Why This Apache PLC4X Vulnerability Matters Apache PLC4X is a set of libraries for talking to industrial programmable logic controllers (PLCs).

ICS Advisory Project The ICS Advisory Project is an open-source project that provides the Critical Infrastructure Security Agency (CISA) ICS Advisories, visualized as a Dashboard and in Comma-Separat...

TL;DR CISA published advisory ICSA-26-272-02 on September 29, 2026, covering 10 Toptech TMS7 vulnerabilities that also affect TopHAT. The worst, CVE-2026-71379, scores CVSS 10.0 and lets an unauthenticated attacker export database tables. Toptech fixed all ten in release 7.8. Why These Toptech TMS7 Vulnerabilities Matter Toptech Systems builds terminal management software used in fuel and bulk liquid terminals. CISA lists the affected sectors as energy, chemical, and transportation systems, deployed worldwide.

Researchers found 19 flaws in a Pepperl+Fuchs industrial gateway, including a critical authentication bypass that could give attackers root access to OT...

Welcome to the Open Security Conference (osco), the people-centred international gathering for everyone interested in cybersecurity. Join us 5-8 November 2026 in Rückersbach, Germany.

CISA and the FBI released a joint fact sheet urging critical infrastructure operators to mitigate cyber risks from third-party ICS integrators.

ICS Advisory Project The ICS Advisory Project is an open-source project that provides the Critical Infrastructure Security Agency (CISA) ICS Advisories, visualized as a Dashboard and in Comma-Separat...

OT-Sicherheit 2026 unter der Lupe: 88 Prozent der Firmen glauben an ihre Sicherheit, doch wo sind die Mängel?

CISA and the FBI released a joint fact sheet urging critical infrastructure operators to mitigate cyber risks from third-party ICS integrators.

Few OT programs closely monitor building systems. Survey data shows weak OT asset visibility lines up with longer outages after incidents.