October 2026 in industrial cyber security: the whole month

Cybersecurity Awareness Month, seen from the plant: 50 CISA ICS advisories, 36 newly exploited flaws, the supermarket refrigeration attacks, and the remote-access products attackers kept using.

7 November 2026 · 11 min read · From Brief stories, 1 Oct to 31 Oct 2026

Written with AI at the editor's request, from the Brief's stories and the public sources listed at the end, and checked against them. Every chart and count is made by code: the Brief's from its briefing files, CISA's from its published advisory and known-exploited data. How posts are made · Report an error

October from the plant floor

October is Cybersecurity Awareness Month, and most of what gets written in it is about phishing, passwords and staff training. For people who run plants, utilities and buildings, the month's events made a different point. The serious incidents came through equipment that could be reached from the internet, and through the VPNs, firewalls and remote-support tools that connect sites to the outside.

The Brief started on 18 October, so its own stories cover the second half of the month. To cover all of it, this report adds two public sources counted day by day for the whole month: every ICS advisory CISA published, and every flaw CISA added to its list of vulnerabilities known to be used in attacks. Events from 1 to 17 October come from public reporting, each linked at the end.²⁸²⁹

How the month unfolded

The first half of the month brought the event that mattered most, the supermarket refrigeration attacks of 11 October, and seven of the month's eleven exploited flaws in edge and remote-access products. The second half brought the largest advisory batch, on 22 October, and the PHP flaws that reached industrial vendors.

The pace

ICS advisories arrive in batches. CISA published 13 in the first week, 5 in the second and 8 in the third, then 21 between 22 and 28 October, 19 of them on 22 October alone, when it republished the Siemens advisories of 13 October. Additions to the known-exploited list were steadier: 4, 11, 9 and 8 in the four full weeks and 4 more from 29 to 31 October.²⁹²⁸

The gap between those two lines matters for planning. Advisories tell you what could be attacked; the known-exploited list tells you what is being attacked. In October the two barely overlapped: of 36 additions, only one was a product from an industrial vendor.

Refrigeration attacks: the month's physical event

Overnight on Sunday 11 October, attackers switched refrigeration units in French supermarkets to defrost, spoiling fresh food. Early reports put it at about 300 Intermarché and Netto stores and fewer than 100 Coopérative U stores. The controllers were reported to be Danfoss units running older software, and France's cyber agency ANSSI said it was handling the incident.²⁴

Over the following two weeks the count of affected stores passed 700, the reports widened to Copeland and Dixell controllers, and some stores reported fires. A later scan found exposed refrigeration controls in 99 countries.²³¹⁵

It did not end with October. In the first week of November a second wave was reported in at least 11 European countries and reached the cold rooms of France's blood service through a refrigeration supplier, and CISA and the FBI told operators to harden their cooling systems.³⁰³¹

The common factor was exposure, not a single vendor or bug. Cooling, building and cold-chain controllers are often installed and run by contractors and missing from the site's own asset list. Researchers had warned about these controllers months earlier, and one report showed an AI tool rebuilding the attack on Danfoss controllers in 28 minutes. If a controller can change a physical process, it should not be reachable from the internet, whatever it controls.⁴⁶

What CISA added to the known-exploited list

CISA added 36 flaws in October. Grouped by what the product is, 11 were in edge and remote-access products, 7 in shared components and platforms that other products are built on (PHP, the Linux kernel, Windows), 17 in business and web applications, and 1 in industrial software: Siemens Software Center, added on 20 October.²⁸⁷

The shared components are where industrial products get caught. Two PHP flaws, added on 26 October and known as PHP2Shell, reached three industrial vendors within a week: Siemens began assessing its products, METTLER TOLEDO named its Octo Image Server and ABB named gateway and NAM products. The useful question is not only whether you run PHP, but which of your vendors' products do.⁸¹⁰¹¹

Age is no protection either. On 8 October five flaws between three and eleven years old were added on the same day, among them a 2015 ISC BIND flaw and a 2016 Apache Struts flaw. Plants run old software for a long time, so an old CVE on this list deserves the same attention as a new one.²⁸

The way in: edge and remote-access devices

Eleven of the 36 additions were in the products that connect a site to the outside: Fortinet, Citrix NetScaler, Ivanti Connect Secure (three flaws), Palo Alto PAN-OS, two Cisco products, BeyondTrust Remote Support and an Arista VeloCloud SD-WAN orchestrator. These are not plant products, but they are how vendors and engineers reach plant systems, and whoever controls them controls that path.²⁸

BeyondTrust Remote Support shows how long that window can be. Two compromises were dated to 29 August. The flaw was disclosed on 15 October, 47 days later, and added to CISA's list the next day; Mandiant attributed the activity to a suspected China-linked espionage group. Patching does not remove anything an attacker left behind, so a patched remote-support server still needs to be checked.²⁷

The Brief's own stories from the second half of the month say the same: Fortinet flaws used to hide malware on firewalls, ransomware groups using a Palo Alto GlobalProtect VPN flaw since June, a state-linked group planting a backdoor through a Cisco SD-WAN flaw, and Volt Typhoon rotating short-lived hacked devices to hide its access.^12131415

CISA's ICS advisories

CISA published 50 ICS advisories in October, 3 of them for medical devices. In 16 the most serious flaw scored 9.0 or higher. Siemens accounted for 18 and Hitachi Energy for 8, mostly because both publish on a fixed schedule that CISA then republishes; a high count reflects how much a vendor discloses, not how safe its products are.²⁹

Counting CVEs on their own would mislead. The advisories carried 969 CVE entries, but 805 sit in two Siemens advisories for S7-1500 MFP CPUs, most of them in the Linux subsystem. The other 48 advisories carried 164.²⁹¹⁶

Around Patch Tuesday on 13 and 14 October, Schneider Electric published two advisories (Pro-face STW6000 and Harmony STW6, and Sage RTUs), Rockwell fixed a critical ArmorBlock flaw that lets an unauthenticated attacker change the web server password, and ABB reported a dynovaPRO account flaw; its logs showed 26 password changes across 9 customers that may have been reconnaissance.²⁵

CISA listed the energy sector in 39 of the 50 advisories, critical manufacturing in 29 and transportation in 24. Plants rarely run a single vendor, so the vendor list is a better guide to what to check than the sector list.²⁹

What the Brief saw: where in the plant

From 18 to 31 October the Brief published 65 main stories: 20 critical, 23 high and 22 medium. It began recording Purdue levels on 20 October. Of the 38 stories since then that name a level, 26 reached the control layer (levels 0 to 2), where a fault can affect the physical process. Level 2, supervisory control such as HMIs and SCADA, came up most, in 22 stories. Six reached level 3.5, the industrial DMZ and remote access.

When to act

From 24 October each story was labelled with when to act: Now, Next or Later (called Act now, Plan and Track until 9 November). Of the 22 labelled stories, 6 were Now, 7 Next and 9 Later. All six Now stories came from 27 October onwards, and all six were about flaws already being exploited. Most news, even critical-sounding news, is something to plan for; knowing which is which is most of the work.

Ransomware, rules and guidance

CISA said the SafePay ransomware group had breached more than 600 critical infrastructure organisations. The Warlock group hit a water utility, most likely through SharePoint, and the extortion group n0n claimed 38 maritime and logistics organisations. Each time the way in was ordinary IT, which is why the separation between business and plant networks matters.¹⁷¹⁸¹⁹

On rules: India set binding cybersecurity rules for the power sector from April 2027, CISA published its strategy to 2030, the US Coast Guard issued guidance for maritime operators, FERC audits found gaps at US power companies including risks from AI access, and NERC's vendor remote-access rules added audit and record-keeping work.^20212223

What to do in November

Plant and site managers: list every controller that can change a physical process and can be reached from the internet, including refrigeration, building and cold-chain controllers put in by contractors. Take them off the internet, or put them behind a VPN with multi-factor sign-in.

OT engineers: ask your vendors in writing which of their products use PHP and the other shared components on October's known-exploited list, and when fixes will come. Apply Siemens' fix for Software Center and check the Mitsubishi Electric ICONICS and GENESIS advisory wherever those products run.⁷⁹

Security teams: treat VPNs, firewalls, SD-WAN and remote-support tools as plant assets. Patch the 11 edge and remote-access flaws from October's list first, check patched remote-support and VPN servers for signs of earlier access, and watch their logs for new accounts and sessions you did not expect.

And if this year's awareness campaign was about phishing, add one slide for the plant: the October incidents came through exposed controllers and remote-access products, not through an email.

How this was counted

CISA figures are counted by code for 1 to 31 October 2026 from CISA's own published data: ICS advisories by the day CISA published them (from the advisory number), and known-exploited additions by the day they were added. Grouping the known-exploited flaws by product type is the Brief's own reading and is listed in full in the figure.²⁸²⁹

Brief figures cover the main stories published from 18 to 31 October, each counted once on the day it first ran. Purdue levels were recorded from 20 October and when-to-act labels from 24 October, so those counts cover fewer stories. Events before 18 October and after 31 October come from the public reports linked below. These are patterns in what was published, not in every incident in the world.