Five source-verified developments affecting operational technology, connected devices and physical security, with practical implications for operators. The WAGO advisory was revised four hours before the usual 24-hour news window; its timing is identified below.

1. CISA flags an exploited SonicWall SSL VPN authentication flaw

Source date: November 6, 2026

News briefing

CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. SonicWall says that when SAML is enabled for SSL VPN logins, a user with valid credentials for an alternative authentication method may bypass SAML and SAML-enforced multifactor authentication. The vendor lists affected Gen7 and NSv firewalls running SonicOS 7.3.3-7015 and earlier, and listed Gen8 models running 8.2.2-8015 and earlier; it identifies fixes in 7.3.4-7013 or later for Gen7 and 8.2.3-8015 or later for Gen8. The sources do not identify an affected OT organization or describe a specific OT incident.

OT implications

Inventory remote-access gateways that can reach operational networks, check the exact model, firmware and SSL VPN SAML settings, and apply the appropriate vendor update through an approved maintenance process. SonicWall lists no workaround. Where operationally safe, restrict VPN and OT-zone access while updates are pending, and review VPN and identity-provider logs for unexpected activity; patching alone does not establish whether earlier compromise occurred.

Sources: CISA: Known Exploited Vulnerability alert; SonicWall: SNWLID-2026-0014; CVE Program: CVE-2026-19868.

2. Unit 42 measures exposure after European refrigeration attacks

Source date: November 6, 2026

News briefing

Unit 42 reported finding more than 5,000 internet-exposed devices worldwide from manufacturers named in a French government alert about attacks on refrigeration controllers. The measurement does not establish that every counted device is a refrigeration controller, runs vulnerable software, or was exploited. This is a new exposure measurement and analysis of previously reported refrigeration attacks, not a report of a new incident.

OT implications

Inventory cold-chain equipment and verify models, firmware, remote-access configuration and actual internet exposure with the refrigeration provider. Government guidance urges limiting public access, separating OT networks, changing default passwords, updating supported firmware, retaining logs and testing offline backups. Coordinate changes with equipment owners; CERT-FR also advises checking service-provider and insurance terms before disconnecting telemetry.

Sources: Unit 42: Turning Up the Heat; CERT-FR: Refrigeration-controller alert; CISA: Cold-chain hardening guidance.

3. Censys highlights blind spots in industrial internet exposure

Source date: November 6, 2026 analysis; figures from its earlier 2026 report

News briefing

A new Censys analysis uses the earlier refrigeration attacks to illustrate broader industrial-control-system exposure, rather than reporting a new attack. Its 2026 State of the Internet Report estimated an early-2026 average of roughly 134,000 internet-exposed hosts running industrial services and tooling, about 4% above roughly 129,000 in 2024; about 70% of those observed ICS hosts were on consumer and mobile networks combined. These are observed hosts, not a census of physical devices or confirmed compromises, and the figures are not new November 6 measurements.

OT implications

A corporate IP-range inventory alone may miss equipment connected through cellular or consumer networks. Reconcile site, supplier and modem records, establish asset ownership, review internet-reachable management interfaces and restrict unnecessary exposure. Validate updates and plan isolation or replacement of unsupported equipment around operational requirements.

Sources: Censys: What Refrigerator Hacks Reveal About ICS Exposure; Censys: 2026 State of the Internet, ICS exposure; Censys: 2026 State of the Internet report.

4. ZeroFox reports October extortion activity in manufacturing

Source date: November 6, 2026 report; incidents reported for October

News briefing

ZeroFox reported at least 855 ransomware and digital-extortion incidents worldwide during October, including at least 151 involving manufacturing. Its counts draw on open and other intelligence sources; ZeroFox cautions that some information cannot be independently verified, and its methodology does not establish a complete census. The sector-level figures do not establish that OT systems were compromised or that industrial operations were disrupted.

OT implications

Manufacturers can use the findings to review IT–OT segmentation, maintain inventories of critical connected devices and rehearse recovery plans with plant owners. Device-hardening and recovery plans should reflect operational dependencies and safety constraints; sector statistics alone are not evidence of an incident at a particular site.

Sources: ZeroFox: October 2026 Ransomware Wrap-Up.

5. WAGO revises affected-device list for CODESYS flaws

Source date: November 6, 2026, 02:00 Pacific; four hours outside the preceding 24-hour window

News briefing

WAGO revised its advisory for three CODESYS vulnerabilities, adding PFC300 and removing WP400 from the affected-device list. Two flaws can cause denial of service under the conditions described by the advisories; a separate manipulated-project-file flaw can execute code in the engineering user’s context. The advisory has conflicting PFC300 model identifiers in its product information, so customers should confirm applicability with WAGO. The reviewed advisories do not report actual exploitation.

OT implications

Inventory the listed product families and firmware, verify the PFC300 model discrepancy with WAGO, and restrict access to control and visualization services to authorized hosts. WAGO recommends standard FW32 4.10.0 or later and contacting support for custom firmware; CODESYS recommends Development System 3.5.21.40 for the project-file issue. Use trusted engineering files and test updates under control-system change procedures.

Sources: CERT@VDE: WAGO VDE-2025-081; WAGO: Machine-readable advisory revision; CODESYS: Development System advisory.

Before making changes, verify product applicability, test where feasible, and coordinate with operational system owners.