{
  "id": 17888344,
  "title": "Max-severity bug in widely used OT programming tool exploited to deliver Linux malware",
  "url": "https://urgent.news/2026/11/02/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-02T22:55:17.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/11/02/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware/5307086"
  },
  "original_language": "en",
  "account": "A critical vulnerability in Node-RED, a popular programming tool used in critical infrastructure and operational technology environments, has been exploited by unknown criminals to deliver Linux malware. This maximum-severity bug, identified as CVE-2026-58115 by Siemens, allows unauthenticated remote attackers to create malicious flows that execute system commands on devices. Node-RED, built on Node.js, is commonly used for workflow automation in industrial control systems. Affected devices do not enforce authentication on the Node-RED HTTP interface, enabling unauthenticated remote attackers to create malicious flows. The exploit involves two built-in Node-RED nodes: an inject node, which fires a message either on a schedule or at startup, and an exec node, which can run shell commands. These exploits highlight the increasing targeting of internet-exposed OT and ICS devices, which can impact the physical world and cause real-life harm. The research on this attack was conducted by VulnCheck, which observed a single IP address, 4.201.105[.]116 in Microsoft’s AS8075 network and geolocated to Brazil, repeatedly sending the exploit and dropper in a single POST request. Between October 30 and November 1, the same IP address targeted the Node-RED vulnerability 16 times and logged 125 hits against eight different CVEs. The malware, named bot-linux-amd64, targets Linux running on AMD64 processors, and it is unclear what the malware does once running. While the bug has been added to VulnCheck’s Known Exploited Vulnerabilities catalog, it hasn’t appeared in the US Cybersecurity and Infrastructure Security Agency’s KEV.",
  "summary": "Your industrial IoT gateway isn't exposed to the internet, right? RIGHT?!",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}