Vendors and CVEs › Sectors › Critical infrastructure
Critical infrastructure: industrial cyber security news for the sector
11 stories in Industrial Cyber Brief name Critical infrastructure, from Thursday 22 October 2026 to Wednesday 11 November 2026. Newest first; each links the full story with who is affected and what to do.
The stories
Medium
CISA launches programme to find internet-exposed industrial devices with manufacturers
The US Cybersecurity and Infrastructure Security Agency (CISA) launched an Installed Base Program with original equipment manufacturers (OEMs).
Low
Dragos appoints Rob T. Lee as first chief AI officer
Dragos announced that Rob T. Lee, who joins from the SANS Institute, is its first chief AI officer. He will advise industrial customers on adopting and securing AI in operational technology (OT).
Medium
Agencies publish questions to ask vendors about post-quantum cryptography
CISA, Australia's ACSC and the NSA released joint guidance and a quick-reference list for judging vendor readiness for post-quantum cryptography.
Medium
Industry groups urge ten-year renewal of US cyber information-sharing law
The OT Cyber Coalition and 34 organisations asked US congressional leaders to include a ten-year renewal of the Cybersecurity Information Sharing Act of 2015 in the 2027 defence bill. The law expires on 11 December 2026.
Low
UK cyber agency warns of AI-powered attacks within two years
The National Cyber Security Centre (NCSC) says cheap technology choices have left UK organisations exposed to AI finding and exploiting long-standing weaknesses. It calls for urgent investment in resilience.
Critical
Maximum-severity Node-RED flaw exploited to install Linux malware
Unknown attackers are exploiting CVE-2026-58115 in Node-RED, a programming tool used in industrial systems.
High
Volt Typhoon rotates short-lived hacked devices to hide its access
Lumen's Black Lotus Labs reports that Volt Typhoon, a China-backed group, uses chains of compromised home-office routers, internet of things devices and enterprise equipment.
Medium
CISA publishes 2030 strategy focused on critical infrastructure and resilience
CISA published a 10-page strategy, 'CISA 2030: Defend, Harden, Prevail'. It reaffirms existing roles.
Medium
OT-ISAC maps Asia-Pacific policy rules for critical infrastructure and operational technology
OT-ISAC's report, current as of 20 October 2026, tracks Asia-Pacific policy.
High
CISA warns SafePay has hit 600 critical infrastructure victims
A new CISA advisory warns of the threat SafePay poses to businesses and critical infrastructure. It urges defenders to act to reduce the risk from the group's tactics. The headline puts its victims at 600 worldwide.
High
CISA says SafePay ransomware has breached over 600 critical infrastructure organisations
CISA says the SafePay ransomware gang has breached more than 600 critical infrastructure organisations worldwide since 2024.