Security Advisories & OT Threat News

What changed, where it runs in a plant, and what to do about it. Red Tiger's plain-language read on the vulnerabilities and alerts that matter to industrial operators.

October 21, 2026

Siemens Software Center CVE-2026-110936 Exploited: What It Means for Engineering Workstations

Siemens confirmed active exploitation of CVE-2026-110936, a DLL side-loading flaw in Siemens Software Center, and CISA added it to the KEV catalog. Attackers shipped a genuine signed copy with malicious DLLs, tied to the Romulus ClickFix campaign, so engineering workstations are the place to check first.

Read the advisory →

October 21, 2026

SafePay Ransomware: CISA/FBI Joint Advisory and the Path Into the Plant

CISA, the FBI, the U.S. Secret Service and international partners released a joint #StopRansomware advisory (AA26-293A) on the SafePay ransomware group, which has hit at least 600 victims across critical infrastructure. SafePay gets in through stolen passwords, phishing and known flaws in firewalls and VPNs, then works toward the plant.

Read the advisory →

October 21, 2026

Node.js October 2026 Security Release: Where It Runs in OT

The Node.js project released security updates for all three supported lines, fixing ten vulnerabilities, four rated high. Node.js runs in edge gateways, control room servers and engineering tools across industrial environments.

Read the advisory →

October 21, 2026

php2shell: Critical PHP Vulnerabilities, From the Plant Floor to the Cloud

CISA is urging immediate patching of two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. PHP often hides inside OT products, from field devices to cloud portals, so finding it is the hard part.

Read the advisory →