Briefings

OT security information for the people actually defending OT/ICS environments. Advisory breakdowns, periodic roundups, and incident analyses.

Advisory BreakdownOctober 22, 202611 min

PHP2Shell in OT: What's Confirmed Affected, Where PHP Hides, and How to Triage It

Two unauthenticated RCE flaws in PHP itself. Palo Alto PAN-OS and Panorama management interfaces are confirmed affected with no fix yet. Here is what is confirmed, where PHP turns up in OT environments, and how to triage it.

Bi-Weekly BriefingJune 29, 20269 min

OTPulse Bi-Weekly Briefing - June 29, 2026

Handala breached California Water's billing database and GNSS correction platform. The OT network held. Here is what the RTKBase exposure actually means and what to patch this week.

Bi-Weekly BriefingJune 1, 20267 min

OTPulse Bi-Weekly Briefing - June 1, 2026

CVSS 8.8, KEV-listed May 28. The CopyFail and DirtyFrag Linux kernel LPE chain is in active exploitation and now on Moxa industrial edge hardware. Here is what the chain does, why OT environments are more exposed than the preconditions suggest, and what to check this week.

Bi-Weekly BriefingMay 18, 20267 min

OTPulse Bi-Weekly Briefing - May 18, 2026

CVSS 10.0, KEV-listed, federal deadline May 17. Cisco Catalyst SD-WAN CVE-2026-20182 is actively exploited by UAT-8616 using a version-downgrade-to-conceal technique that makes version checks unreliable. Here is the full attack chain and what to do this week.

Weekly BriefingMay 4, 202611 min

OTPulse Weekly Briefing - May 4, 2026

Moxa just patched a CVSS 8.7 unauthenticated DoS across six product families, including the OnCell LTE routers most utilities run at remote sites. The patch only fixes half the problem. Here is what to do for the other half, and why this is the third edge-device advisory in three weeks.

Weekly BriefingApril 27, 20269 min

OTPulse Weekly Briefing - April 27, 2026

ArcaneDoor is back. Cisco and CISA confirmed this week that the Chinese state-sponsored group developed a persistence mechanism that lives in the FXOS layer - below the ASA/FTD software - and survives the September 2025 patches intact. If your device was exposed before you patched, the attacker may still be there.

Weekly BriefingApril 20, 202610 min

OTPulse Weekly Briefing - April 20, 2026

Cisco shipped three critical ISE advisories, and one of them has been actively exploited since July. Windows IKE got an unauthenticated 9.8. Siemens RUGGEDCOM CROSSBOW and Schneider Modicon switches rounded out a busy week for anyone running OT.

Case StudyApril 14, 20268 min

No Malware, No Exploit, No Signatures to Catch: The Iranian PLC Campaign Targeting US Infrastructure

Six agencies confirmed it. Iranian-affiliated CyberAv3ngers used legitimate Rockwell engineering software to disrupt US water, energy, and government facilities. Here is what happened and what to do about it.

RoundupApril 7, 20265 min

OTPulse Weekly - April 7, 2026

ABB 800xA contains an actively exploited 7-Zip CVE. WAGO had a rough week with two critical advisories covering 45 CVEs across their engineering toolchain. All five advisories this week are Act Now.

Case StudyMarch 31, 202610 min

The axios npm Supply Chain Attack: What Happened, How to Check if You're Affected, and How to Remediate

On March 31, 2026, axios was compromised in a targeted supply chain attack. Attackers deployed a cross-platform RAT on developer machines, then erased all evidence before anyone noticed. Here is the full breakdown.

GuideMarch 24, 20266 min

What CISA ICS Advisories Actually Tell You (and What They Don't)

CISA publishes hundreds of ICS advisories every year. Most go unread. Here's how to quickly extract what actually matters from them, and what you'll need to find elsewhere.

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.