Daily briefing

Today's Industrial Cyber Brief

9 stories made the cut this morning: 3 critical, 4 high, 2 medium, plus 7 more under Also today.

CriticalKnown exploitedPatch available

Barracuda email gateways under attack through chained flaws

The Register - security

What happened. Barracuda says attackers are exploiting two flaws in its Email Security Gateway (ESG). Chained, they allow commands to run with root privileges. The vendor reports a small number of affected organisations and has released patches. CVE-2026-116606 is rated 9.3.

Who is affected. Organisations running the Barracuda Email Security Gateway. The source does not say which organisations or sectors are affected, nor which versions.

What to do. Apply the Barracuda patches for the Email Security Gateway. Check whether you run these gateways and whether the administrative interface is reachable.

CriticalKnown exploitedPatch available

Bender fixes two exploited Linux kernel flaws in EDGE500IP

CERT@VDE advisories

What happened. Bender says two Linux kernel flaws (CVE-2025-39682 and CVE-2025-39964) affect the EDGE500IP. CISA lists both as known exploited. Bender says electrical safety is not affected and exploitation needs code execution on the device. The fix is in COMTRAXX firmware 5.1.1.

Who is affected. Users of the Bender EDGE500IP running COMTRAXX firmware before 5.1.1. The source names no specific organisations.

What to do. Update the Bender EDGE500IP to COMTRAXX firmware 5.1.1. Check which firmware version each device runs.

CriticalCheck your exposure

Fortinet FortiOS and FortiSASE routing flaw lets attackers send false routes

Fortinet PSIRT

What happened. Fortinet reports an authentication bypass in the ospf daemon of FortiOS and FortiSASE, rated 9.3. An unauthenticated attacker may broadcast link-state advertisements (LSAs, routing messages) through a specially crafted request.

Who is affected. Users of Fortinet FortiOS and FortiSASE. Industrial sites using FortiGate firewalls at the IT and plant boundary may be exposed. The source gives no versions.

What to do. Check whether you run FortiOS or FortiSASE with OSPF (a routing protocol) enabled, and follow the Fortinet advisory for fixed versions.

HighPatch available

FortiManager flaw lets low-privilege admin take over managed FortiGates

Fortinet PSIRT

What happened. Fortinet reports a template engine flaw in FortiManager and FortiManager Cloud, rated 8.4. A low-privileged Device Manager admin may gain super admin privilege on managed FortiGates by injecting malicious commands.

Who is affected. Users of Fortinet FortiManager and FortiManager Cloud, and the FortiGate firewalls they manage. The source gives no versions.

What to do. Check whether you run FortiManager and apply the fixed version from the Fortinet advisory.

HighMonitor

Check Point links three China-linked spying campaigns to Sparrow malware

Check Point Research

What happened. Check Point Research found three clusters (SilentDelivery, OceanGate, DarkWire) across Latin America, Asia and Europe. They share infrastructure and Sparrow malware code. Targets include telecoms, government, military, research and critical infrastructure. Methods include compromised internet-facing systems and watering-hole attacks.

Who is affected. Telecommunications providers, government, military, research institutions and critical infrastructure; compromised watering-hole websites were in government, shipping, and IT and research sectors. No specific products are named.

What to do. Review exposure of internet-facing systems and brief your security team on Sparrow activity; monitor for the indicators Check Point Research publishes.

HighMonitor

Refrigeration attacks in Europe may foreshadow US infrastructure attacks

SC Media (via Google News)

What happened. SC Media reports attacks on refrigeration in Europe and says they are a prelude to attacks on US critical infrastructure.

Who is affected. The source does not say which organisations are affected.

What to do. No action is named. Share with your SOC or OT security team so they can check for the same indicators.

HighMonitor

Report says hackers are targeting European infrastructure systems

CBS News (via Google News)

What happened. A CBS News headline reports that high-tech hackers are targeting infrastructure systems in Europe. The report gives no further detail on who is behind it, which systems or which organisations.

Who is affected. The source does not say which organisations are affected. Triage suggests energy, water and transport infrastructure in Europe may be involved.

What to do. Check how vendors and engineers reach your control systems remotely, and review who can connect and whether multi-factor authentication is enforced.

MediumCheck your exposure

Report warns Chinese solar inverters raise blackout risk

조선일보 (via Google News)

What happened. A Chosun Ilbo headline reports that cyber blackout risks are growing as Chinese solar inverters dominate the market. The report gives no further detail, and describes no confirmed attack or named product.

Who is affected. The source does not say which organisations are affected. Triage points to the energy sector and operators of solar inverters.

What to do. Check which solar inverters your site runs and whether they have internet or vendor remote connections.

MediumAwareness

CISA launches programme to find internet-exposed industrial devices with manufacturers

Industrial Cyber

What happened. The US Cybersecurity and Infrastructure Security Agency (CISA) launched an Installed Base Program with original equipment manufacturers (OEMs). It aims to identify owners of vulnerable, internet-exposed operational technology assets and share mitigation guidance. CISA may use subpoena authority where ownership cannot be established.

Who is affected. Owners and operators of critical infrastructure in the United States who run internet-exposed OT assets from participating equipment makers.

What to do. Check whether any of your OT devices are reachable from the internet and remove or restrict that exposure before you are contacted.

Also today

Smaller items, below the bar for the stories above. Listed so the day is complete. How the bar works

HighPatch available

Fortinet fixes login bypass flaw in its SSH service

Fortinet PSIRT

What happened. Fortinet reports a flaw in the SSH daemon of FortiOS, FortiSASE, FortiProxy and FortiPam. An unauthenticated attacker may bypass authentication using specially crafted credentials. The CVSS score is 7.4.

Who is affected. Users of Fortinet FortiOS, FortiSASE, FortiProxy and FortiPam. Industrial sites using these gateways for remote access are exposed, as vendors and engineers often reach plant systems through them.

What to do. Check whether you run FortiOS, FortiSASE, FortiProxy or FortiPam and apply the fix in the Fortinet advisory. The report names no versions.

MediumPatch available

Memory flaw in Schneider Electric switchboard design software

Schneider Electric CPCERT

What happened. Schneider Electric reports a use-after-free flaw in EcoStruxure Power Build Rapsody, software for entering single line diagrams and listing switchboard parts. Local attackers could potentially run arbitrary code. CVE-2026-119055, base score 5.3.

Who is affected. Users of Schneider Electric EcoStruxure Power Build Rapsody software. The report gives no version numbers and names no sector.

What to do. Apply the remediations in the Schneider Electric advisory for EcoStruxure Power Build Rapsody. Check where the software is installed and who has local access to those machines.

MediumCheck your exposure

Multiple flaws in Helmholz myREX24V2 remote-access routers

CERT@VDE advisories

What happened. CERT@VDE reports multiple vulnerabilities in Helmholz myREX24V2 and myREX24V2.virtual. They could allow remote code execution, denial of service or information leakage. The advisory is VDE-2026-141.

Who is affected. Sites using Helmholz myREX24V2 or myREX24V2.virtual for remote access are exposed, because vendors and engineers often reach plant systems this way. Versions are not given.

What to do. Check whether you run myREX24V2 or myREX24V2.virtual and follow the fix guidance in advisory VDE-2026-141.

MediumCheck your exposure

Bundled PHP flaws called php2shell affect Helmholz myREX24V2

CERT@VDE advisories

What happened. CERT@VDE reports that Helmholz myREX24V2 and myREX24V2.virtual ship with a bundled PHP version affected by two vulnerabilities known as "php2shell". The advisory is VDE-2026-160. The report gives no impact details.

Who is affected. Sites using Helmholz myREX24V2 or myREX24V2.virtual for remote access are exposed, because vendors and engineers often reach plant systems this way.

What to do. Check whether you run myREX24V2 or myREX24V2.virtual and follow the fix guidance in advisory VDE-2026-160.

MediumCheck your exposure

Multiple flaws in mbCONNECT24 and mymbCONNECT24 remote-access services

CERT@VDE advisories

What happened. CERT@VDE reports multiple vulnerabilities in MB connect line mbCONNECT24 and mymbCONNECT24. They could allow remote code execution, denial of service or information leakage. The advisory is VDE-2026-079.

Who is affected. Sites using mbCONNECT24 or mymbCONNECT24 from MB connect line for remote access are exposed, because vendors and engineers often reach plant systems this way.

What to do. Check whether you use mbCONNECT24 or mymbCONNECT24 and follow the fix guidance in advisory VDE-2026-079.

MediumCheck your exposure

Opening files in Siemens WinCC Graphics Designer can run attacker code

Siemens ProductCERT

What happened. Siemens reports that Graphics Designer in SIMATIC WinCC before V8.2 runs active content implicitly when a file is opened. An attacker could run arbitrary code on the device. Siemens is preparing fixes and gives mitigations meanwhile.

Who is affected. Users of Siemens SIMATIC WinCC Graphics Designer before V8.2. The report names no sector.

What to do. Check whether you run SIMATIC WinCC before V8.2 and apply the mitigations in Siemens advisory SSA-979641 until fixes are available.

LowAwareness

Six-month US pilot offers water utilities free help fixing security gaps

Industrial Cyber

What happened. Project Watershed 250 launched in San Antonio on 31 August 2026. The six-month pilot gives participating water utilities free red-team assessments, AI tools, threat intelligence, training, help fixing problems and defensive tools. Long-term funding remains unresolved.

Who is affected. Water utilities, especially small and mid-sized ones running ageing SCADA networks with small security teams and tight budgets. The report names Texas and Minnesota as places under attack.

What to do. No action required. Read it if it applies to your sector or regulator.