[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fm2TKjP7CK07dd53AQtgeTSVTbtN1W9pzGbX4aGsqtSY":3},{"article":4,"iocs":51,"watch_terms":66,"solutions":67,"lesson":159},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"8af375c5-054e-44fc-8f9d-082bdb9fa4f3","Max-severity bug in widely used OT programming tool exploited to deliver Linux malware","max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-m-bfaf44","Your industrial IoT gateway isn't exposed to the internet, right? RIGHT?!","Attackers are actively exploiting a critical vulnerability (CVE-2026-58115) in Node-RED, a widely used flow-based programming tool in industrial control systems. The bug allows unauthenticated remote attackers to execute system commands, enabling the deployment of Linux malware. Researchers observed opportunistic mass scanning targeting this and other vulnerabilities, indicating a broad threat to operational technology environments.","Max-severity bug in Node-RED exploited to deploy Linux malware on OT systems.","https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F11\u002F02\u002Fmax-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware\u002F5307086","https:\u002F\u002Fimage.theregister.com\u002F?imageId=5307102&width=800","2026-11-02T22:55:17+00:00","2026-11-02T23:00:09.023523+00:00",9,[17,20,23,26],{"name":18,"type":19},"Node-RED","product",{"name":21,"type":22},"Siemens","vendor",{"name":24,"type":25},"Industrial Control Systems","technology",{"name":27,"type":25},"Operational Technology","d6f63bb8-0801-486a-be7f-171400700454",{"id":28,"icon":30,"name":31,"slug":32},null,"IoT\u002FOT","iot-ot",[34,39,44,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":28,"icon":30,"name":31,"slug":32},{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56,60,63],{"type":53,"value":54,"context":55},"cve","CVE-2026-58115","Maximum-severity vulnerability in Node-RED",{"type":57,"value":58,"context":59},"ip","4.201.105.116","IP address observed exploiting CVE-2026-58115",{"type":57,"value":61,"context":62},"85.215.73.250","Server hosting malware payload",{"type":53,"value":64,"context":65},"CVE-2019-17558","Apache Solr flaw exploited alongside Node-RED vulnerability",[21,18],{"controls":68,"vendors":153},[69,98,127],{"slug":70,"name":71,"problem":72,"products":73},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":99,"name":100,"problem":101,"products":102},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[103,111,119],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":128,"name":129,"problem":130,"products":131},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[132,140,145],{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"nozomi-networks","Nozomi Networks","\u002Fvendor-logos\u002Fnozomi-networks.png","guardian","Nozomi Networks Guardian","https:\u002F\u002Fwww.nozominetworks.com\u002Fplatform\u002Fguardian","Passive monitoring, asset inventory and threat detection for OT and IoT networks.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":141,"product_name":142,"url":143,"description":144},"tenable-ot-security","Tenable OT Security","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fot-security","Asset inventory, vulnerability and threat detection for industrial networks.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"dragos","Dragos","\u002Fvendor-logos\u002Fdragos.png","dragos-platform","Dragos Platform","https:\u002F\u002Fwww.dragos.com\u002Fcybersecurity-platform\u002F","OT asset visibility, threat detection and response guidance for industrial environments.",[154],{"slug":155,"name":21,"logo_path":156,"roles":157},"siemens","\u002Fvendor-logos\u002Fsiemens.png",[158],"affected",{"slug":160,"title":161,"body":162,"framework_refs":163,"framework_notes":171},"critical-node-red-flaw-exploited-to-deploy-linux-malware-in-ot-environments","Critical Node-RED Flaw Exploited to Deploy Linux Malware in OT Environments","A max-severity unauthenticated remote code execution vulnerability in Node-RED, a widely adopted flow-based programming tool used in industrial control systems, is being actively exploited by attackers to deliver Linux malware. The root cause is a failure to apply timely patches to a critical internet-facing component in sensitive operational technology (OT) environments. The ability to execute system commands without authentication represents a catastrophic access control failure compounded by delayed remediation. Because OT systems often run legacy software with long patch cycles, this kind of vulnerability becomes an attractive, high-yield target for opportunistic mass scanning campaigns. The consequences extend beyond data theft to potential disruption of physical industrial processes, making timely patching in OT contexts not just a best practice but a safety imperative.",[164,165,166,167,168,169,170],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":172,"NIST SP 800-53 SI-2: Flaw Remediation":173,"CIS Control 17: Incident Response Management":174,"OWASP A06:2021 Vulnerable and Outdated Components":175,"CIS Control 7: Continuous Vulnerability Management":176,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":177,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":178},"NIS2 requires operators of essential services to implement vulnerability handling and patching policies; exploitation of this OT tool in industrial environments falls squarely within NIS2's scope and obligations.","SI-2 requires organisations to identify, report, and correct information system flaws within defined timeframes; a formal flaw remediation process would have accelerated patching of this critical RCE vulnerability.","Active mass-scanning exploitation requires a prepared incident response capability to detect, contain, and eradicate malware deployments rapidly across potentially large numbers of affected OT systems.","Node-RED is a third-party open-source component; running an unpatched version with a known critical CVE is a textbook instance of the risk described by this OWASP category.","Routine vulnerability scanning and a defined patching cadence would have flagged this max-severity flaw and driven remediation before opportunistic attackers could exploit it at scale.","A.8.8 mandates timely identification and remediation of technical vulnerabilities, directly addressing the failure to patch Node-RED before active exploitation began.","The vulnerability allows unauthenticated remote command execution, meaning the absence of any authentication requirement for a critical function directly enabled the attack; enforcing access controls would have raised the bar for exploitation."]