Max-severity bug in widely used OT programming tool exploited to deliver Linux malware

A max-severity unauthenticated remote code execution vulnerability in Node-RED, a widely adopted flow-based programming tool used in industrial control systems, is being actively exploited by attackers to deliver Linux malware. The root cause is a failure to apply timely patches to a critical internet-facing component in sensitive operational technology (OT) environments. The ability to execute system commands without authentication represents a catastrophic access control failure compounded by delayed remediation. Because OT systems often run legacy software with long patch cycles, this kind of vulnerability becomes an attractive, high-yield target for opportunistic mass scanning campaigns. The consequences extend beyond data theft to potential disruption of physical industrial processes, making timely patching in OT contexts not just a best practice but a safety imperative.