--- title: Daily OT Security News: November 06, 2026 | daily.dev description: Five operational technology vendors disclosed or updated security advisories on November 4 and 5, 2026. Johnson Controls warned that installer builds for... canonical: https://daily.dev/posts/daily-ot-security-news-november-06-2026-kbyoadelh twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Daily OT Security News: November 06, 2026 | daily.dev og:description: Five operational technology vendors disclosed or updated security advisories on November 4 and 5, 2026. Johnson Controls warned that installer builds for... og:url: https://daily.dev/posts/daily-ot-security-news-november-06-2026-kbyoadelh og:image: https://api.daily.dev/og/posts/KbyOAdELH.png og:image:alt: Daily OT Security News: November 06, 2026 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Daily OT Security News: November 06, 2026 **[Security Boulevard](https://daily.dev/sources/securityboulevard)** · 5 min read · 0 upvotes · 0 comments ## Summary Five operational technology vendors disclosed or updated security advisories on November 4 and 5, 2026. Johnson Controls warned that installer builds for C•CURE 9000 3.20 and victor 8.0 wrote admin credentials to cleartext logs (CVE-2026-106019), fixed in builds 3.20.607 and 8.0.607. Mitsubishi Electric and CISA expanded a CC-Link IE TSN advisory (CVE-2026-13584) to cover two more products with no fix planned. Festo revised guidance for PHP2Shell flaws in FactoryViews and MES4, recommending FactoryViews 1.12.2. WAGO disclosed an already-fixed cloud account-recovery flaw (CVE-2026-18963) letting attackers reset passwords without email verification. Phoenix Contact flagged CodeMeter Runtime risks in PLCnext and Virtual Controls firmware, with a fix planned for Q4. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-106019 in Johnson Controls C-CURE 9000 and victor installers? It is a flaw where affected installer builds for C•CURE 9000 3.20 and victor 8.0 write administrative credentials or other sensitive authentication information in cleartext to local logs during installation, upgrade or repair. It affects installer builds 3.20.597 and 8.0.597, available from July 1 through September 18, 2026. Builds 3.20.607 and 8.0.607 or later fix the issue. _Teams managing physical-security systems track fixes like this for Johnson Controls installers on daily.dev._ ### Is there a fix for the Mitsubishi Electric CC-Link IE TSN vulnerability CVE-2026-13584? No fix is planned for the newly added affected models, the NZ2CT-GN CC-Link IE TSN coupler and FR-D800-E inverter, according to CISA. An attacker on the same network segment could send crafted packets under specific timing conditions to tamper with control data, causing incorrect operation or denial of service. Mitigation relies on restricting physical and network access and isolating trusted control segments. _Industrial network engineers weighing segmentation strategies follow advisories like this via daily.dev._ ### What is the PHP2Shell vulnerability affecting Festo FactoryViews and MES4? PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, flaws in Apache/PHP components used by FactoryViews and MES4 with XAMPP that can lead to remote code execution. FactoryViews 1.0.0 through 1.12.1 and all MES4 versions are affected; FactoryViews 1.12.2 fixes the issue, while no fix exists yet for MES4 with XAMPP. CISA lists the underlying PHP CVEs as known exploited. _Developers patching PHP stacks after known-exploited CVEs keep track of advisories like this on daily.dev._ ## Similar posts on daily.dev - [Daily OT Security News: September 23, 2026](https://daily.dev/posts/daily-ot-security-news-september-23-2026-vwdy21qxx) · Security Boulevard · 0 upvotes · 0 comments - [Security briefing: October 2026](https://daily.dev/posts/security-briefing-october-2026-uxnqjrxgv) · Sysdig Blog · 0 upvotes · 0 comments - [Daily OT Security News: October 16, 2026](https://daily.dev/posts/daily-ot-security-news-october-16-2026-iwpd6rtc8) · Security Boulevard · 0 upvotes · 0 comments - [September 2026 CVE Landscape](https://daily.dev/posts/september-2026-cve-landscape-7rqel5aap) · Recorded Future Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php) [View this post on daily.dev](https://daily.dev/posts/daily-ot-security-news-november-06-2026-kbyoadelh) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Daily OT Security News: November 06, 2026","url":"https://daily.dev/posts/daily-ot-security-news-november-06-2026-kbyoadelh","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/daily-ot-security-news-november-06-2026-kbyoadelh"},"datePublished":"2026-11-06T14:49:18.406Z","dateModified":"2026-11-06T14:49:56.197Z","description":"Five operational technology vendors disclosed or updated security advisories on November 4 and 5, 2026. Johnson Controls warned that installer builds for...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fe9eeb967de205fd6743e2535f16178?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fe9eeb967de205fd6743e2535f16178?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Security Boulevard","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Security Boulevard","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3613c832180040de8d85bb29f74395be","url":"https://daily.dev/sources/securityboulevard"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/daily-ot-security-news-november-06-2026-kbyoadelh","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,php","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Boulevard","item":"https://daily.dev/sources/securityboulevard"},{"@type":"ListItem","position":3,"name":"Daily OT Security News: November 06, 2026"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/daily-ot-security-news-november-06-2026-kbyoadelh#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-106019 in Johnson Controls C-CURE 9000 and victor installers?","acceptedAnswer":{"@type":"Answer","text":"It is a flaw where affected installer builds for C•CURE 9000 3.20 and victor 8.0 write administrative credentials or other sensitive authentication information in cleartext to local logs during installation, upgrade or repair. It affects installer builds 3.20.597 and 8.0.597, available from July 1 through September 18, 2026. Builds 3.20.607 and 8.0.607 or later fix the issue. Teams managing physical-security systems track fixes like this for Johnson Controls installers on daily.dev."}},{"@type":"Question","name":"Is there a fix for the Mitsubishi Electric CC-Link IE TSN vulnerability CVE-2026-13584?","acceptedAnswer":{"@type":"Answer","text":"No fix is planned for the newly added affected models, the NZ2CT-GN CC-Link IE TSN coupler and FR-D800-E inverter, according to CISA. An attacker on the same network segment could send crafted packets under specific timing conditions to tamper with control data, causing incorrect operation or denial of service. Mitigation relies on restricting physical and network access and isolating trusted control segments. Industrial network engineers weighing segmentation strategies follow advisories like this via daily.dev."}},{"@type":"Question","name":"What is the PHP2Shell vulnerability affecting Festo FactoryViews and MES4?","acceptedAnswer":{"@type":"Answer","text":"PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, flaws in Apache/PHP components used by FactoryViews and MES4 with XAMPP that can lead to remote code execution. FactoryViews 1.0.0 through 1.12.1 and all MES4 versions are affected; FactoryViews 1.12.2 fixes the issue, while no fix exists yet for MES4 with XAMPP. CISA lists the underlying PHP CVEs as known exploited. Developers patching PHP stacks after known-exploited CVEs keep track of advisories like this on daily.dev."}}]} ```