The overall threat level for OT in Germany, Austria and Switzerland is elevated for calendar week 44/2026. Power & grids, food & beverage and machine builders are each rated high. PHP2Shell (CVE-2026-109618/-109619) dominated the week. CISA added it to its KEV catalog on 26 October. In parallel, attackers exploited a Cisco ASA/FTD zero-day that crashes SSL-VPN devices, which are the remote access many operators use for remote maintenance.
Key developments this week
1. PHP2Shell: in CISA KEV, PAN-OS affected, OT vendors confirm affected products
CISA listed both PHP vulnerabilities as actively exploited on 26 October. Palo Alto PAN-OS is also affected. Several OT vendors have confirmed affected products: Siemens (RUGGEDCOM APE1808), Schneider Electric, B&R (APROL), Belden NetModule (no patch yet), HMS (Netbiter, Talk2M) and Wibu-Systems (CodeMeter License Central). The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- SANS ICS Critical Control: CC5 Risk-Based Vulnerability Management (plus CC2 Defensible Architecture for management access)
- Source: CISA KEV alert, 26.10.2026
2. Cisco Secure Firewall ASA/FTD zero-day crashes SSL-VPN devices
Attackers are exploiting this flaw to make SSL-VPN devices restart, and Cisco has confirmed exploitation. Until you can update, check the configuration-dependent mitigations in Cisco's advisory carefully. Cisco warns that they weaken security.
- SANS ICS Critical Control: CC4 Secure Remote Access
- Source: Cisco Security Advisory
3. Siemens SIMATIC S7-1500, ET 200SP & co.: eight web server vulnerabilities, no fix for many products
The advisory covers the web server of S7-1500, ET 200SP and other SIMATIC devices. For some products, fixes are not or not yet available. These controllers are built into countless machines running in the field.
- SANS ICS Critical Control: CC2 Defensible Architecture
- Source: CISA ICSA-26-295-14
4. Mitsubishi Electric ICONICS GENESIS64 / MC Works64: authentication bypass (ICSA-26-300-02)
Attackers can bypass the login. Check the CISA advisory for affected products and available mitigations.
- SANS ICS Critical Control: CC5 Risk-Based Vulnerability Management
- Source: CISA ICSA-26-300-02
What it means per sector
Power & grids: There was no confirmed attack on grid control systems in DACH this week. However, several actively exploited vulnerabilities affect the Edge devices that municipal utilities and grid operators use to connect remote maintenance and outstations. The Siemens RUGGEDCOM APE1808 with PAN-OS is also affected. Siemens refers customers to its support for patch information. In October, Cisco confirmed exploitation of the SSL-VPN DoS flaw. Full report (German)
Food & beverage: This week's focus was refrigeration. Forescout reports refrigeration control systems openly reachable on the internet, among them Copeland/Dixell XWEB and Danfoss StoreView (Forescout). Anyone who runs cold stores, fermentation cellars or tank farms through a web HMI with remote maintenance is particularly exposed. A pre-auth flaw in Veeam Backup & Replication 13 also puts recovery capability at risk. Full report (German)
Machine builders: For component manufacturers, PHP2Shell is relevant to the CRA reporting obligation. If you ship PHP inside products with digital elements, check now (via SBOM or firmware analysis) whether a report is required, and inform your customers proactively (SecurityWeek). The unpatched S7-1500/ET 200SP web server flaws affect machines already installed at customer sites, so send customers a short service notice and track Siemens' patch date. Full report (German)
What to do now
- Lock down management interfaces: Make firewall and Edge device management reachable only via a Jump Host and apply the PHP2Shell fixes. On NetModule routers without a patch, disable the web interface. (CC2)
- Secure and back up remote access: Update Cisco ASA/FTD, monitor ASA restarts in your SIEM or syslog, and set up a second, independent remote access path for on-call staff and service providers in your Incident Response plan. (CC4, CC1)
- Reduce the PLC web server attack surface: Inventory S7-1500/ET 200SP web servers and HMI access, disable what is not needed, and otherwise restrict web access to trusted IPs. Regularly check what is reachable from outside. (CC2, CC5)
- Get refrigeration and HVAC controllers off the internet: Bundle contractor access through a Remote Access gateway with MFA and personal accounts, retire shared service-provider credentials, and evaluate temperature alarms independently of the controller. (CC4)
- Prioritize by exploitation and exposure: Add PHP-based web UIs, ICONICS installations and SCADA legacy systems to your asset inventory, and patch KEV-listed and externally reachable items first. Keep at least one backup copy offline or immutable. (CC5, CC1)
Full sector reports (German)
- All sectors (DACH overview)
- Power & grids
- Utilities (water, wastewater, municipal)
- Food & beverage production
- Machine builders (CRA)
- All sectors at a glance
Max Gilg is an OT cybersecurity consultant based in Rosenheim, Germany (OT-Cyber.de).
Top comments (0)