{
  "id": 17889199,
  "title": "Max-severity bug in widely used OT programming tool exploited to deliver Linux malware",
  "url": "https://urgent.news/2026/11/02/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-17889199",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-02T22:55:17.000Z",
  "source": {
    "name": "The Register",
    "slug": "the-register",
    "url": "https://www.theregister.com/security/2026/11/02/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware/5307086"
  },
  "original_language": "en",
  "account": "Node-RED, a popular programming tool used in critical infrastructure, has been targeted by criminals exploiting a critical vulnerability. This flaw, assigned CVE-2026-58115 by Siemens, allows unauthenticated remote attackers to deploy malware that can execute system commands on affected devices. Node-RED, built on Node.js, is commonly used for workflow automation in industrial control systems and operational technology environments. The vulnerability arises from insufficient authentication on the Node-RED HTTP interface, enabling unauthorized access to programming nodes that can execute system commands. Last Friday, VulnCheck researchers documented an attack that exploited this vulnerability. Two Node-RED built-in nodes, an inject node and an exec node, make this exploitation \"trivial to weaponize.\" The inject node fires a message either on a schedule or at startup, while the exec node can run shell commands. Once exploited, an attacker can create malicious flows without further interaction. Researchers tracked a single IP address, originating from Microsoft’s AS8075 network in Brazil, that repeatedly targeted this Node-RED vulnerability between October 30 and November 1. This activity included exploiting a seven-year-old Apache Solr flaw and 125 hits against eight different CVEs across their wider canary network. The attack suggests opportunistic mass scanning rather than a targeted assault. After infecting a vulnerable Node-RED instance, attackers likely pulled the implant from a separate server. As such exploits become more common, it is crucial for organizations using Node-RED, especially in OT environments, to check their systems for external reachability, apply updates, and implement detection measures to mitigate the risk of exploitation.",
  "summary": "Your industrial IoT gateway isn't exposed to the internet, right? RIGHT?!",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}