--- title: Daily OT Security News: October 16, 2026 | daily.dev description: A roundup of five OT/ICS and critical-infrastructure security developments from mid-October 2026: CISA's advisory on six Eclipse Milo OPC UA stack... canonical: https://daily.dev/posts/daily-ot-security-news-october-16-2026-iwpd6rtc8 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Daily OT Security News: October 16, 2026 | daily.dev og:description: A roundup of five OT/ICS and critical-infrastructure security developments from mid-October 2026: CISA's advisory on six Eclipse Milo OPC UA stack... og:url: https://daily.dev/posts/daily-ot-security-news-october-16-2026-iwpd6rtc8 og:image: https://api.daily.dev/og/posts/iwpd6rtC8.png og:image:alt: Daily OT Security News: October 16, 2026 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Daily OT Security News: October 16, 2026 **[Security Boulevard](https://daily.dev/sources/securityboulevard)** · 16 min read · 0 upvotes · 0 comments ## Summary A roundup of five OT/ICS and critical-infrastructure security developments from mid-October 2026: CISA's advisory on six Eclipse Milo OPC UA stack vulnerabilities (CVSS up to 9.1) affecting chemical, manufacturing, energy, and water sectors; three vulnerabilities in Guangzhou Juan IoT's EseeCloud camera app/firmware that could allow camera takeover; FERC's audit findings on power-sector CIP compliance gaps including AI tool access governance; MITRE ATT&CK v20's new ICS techniques and documented campaigns against Minnesota water utilities and Mexican government infrastructure; and extortion group n0n's claimed leak targeting 38 maritime and logistics organizations across 18 countries. Each item is followed by concrete remediation steps for asset owners, with careful distinction between confirmed facts and unverified claims. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What versions of Eclipse Milo are affected by the recent OPC UA vulnerabilities and what should I upgrade to? Eclipse Milo versions 0.6.0 through 1.1.4 are affected by six CVEs (CVE-2026-63252, CVE-2026-63248, CVE-2026-60007, CVE-2026-62927, CVE-2026-58080, and CVE-2026-61387), with CVSS v4.0 scores ranging from 6.9 to 9.1. The fix is version 1.1.5 or later, which addresses all six flaw classes including a padding oracle, a RoleMapper authorization bypass, and memory exhaustion issues. _Teams tracking OPC UA stack vulnerabilities can follow patch guidance like this on daily.dev._ ### What is the most severe CVE in the Eclipse Milo OPC UA advisory and how does it work? CVE-2026-60007 is the most severe, scoring CVSS v4.0 9.1 Critical. It is a Basic128Rsa15 username-token padding oracle vulnerability requiring an on-path attacker to capture a victim's token and then send repeated unauthenticated ActivateSession requests to recover credentials or session information. _Developers patching OPC UA deployments can keep up with critical CVE breakdowns on daily.dev._ ### Has MITRE ATT&CK confirmed who attacked the Minnesota water utilities exposed PLC incidents? No, MITRE's campaign C0066 covering attacks on more than 30 Minnesota water and wastewater utilities has not been formally attributed to any actor. The incidents involved exposed PLC access and operators being locked out after password or IP changes, and FBI/EPA and CISA separately warned of similar exposed-PLC attacks across at least seven states. _Security teams monitoring unattributed ICS campaigns can track developments like this on daily.dev._ ## Similar posts on daily.dev - [Daily OT Security News: September 23, 2026](https://daily.dev/posts/daily-ot-security-news-september-23-2026-vwdy21qxx) · Security Boulevard · 0 upvotes · 0 comments - [September 2026 CVE Landscape](https://daily.dev/posts/september-2026-cve-landscape-7rqel5aap) · Recorded Future Blog · 0 upvotes · 0 comments - [Juniper, EV Charging & ICS Vulnerabilities Raise Risks](https://daily.dev/posts/juniper-ev-charging-ics-vulnerabilities-raise-risks-hdpxlix1x) · Cyble · 0 upvotes · 0 comments - [23rd February – Threat Intelligence Report](https://daily.dev/posts/23rd-february-threat-intelligence-report-4m6vt9dhh) · Check Point Research · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/daily-ot-security-news-october-16-2026-iwpd6rtc8) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Daily OT Security News: October 16, 2026","url":"https://daily.dev/posts/daily-ot-security-news-october-16-2026-iwpd6rtc8","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/daily-ot-security-news-october-16-2026-iwpd6rtc8"},"datePublished":"2026-10-16T13:41:53.276Z","dateModified":"2026-10-16T13:43:08.386Z","description":"A roundup of five OT/ICS and critical-infrastructure security developments from mid-October 2026: CISA's advisory on six Eclipse Milo OPC UA stack...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fe9eeb967de205fd6743e2535f16178?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fe9eeb967de205fd6743e2535f16178?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Security Boulevard","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Security Boulevard","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3613c832180040de8d85bb29f74395be","url":"https://daily.dev/sources/securityboulevard"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/daily-ot-security-news-october-16-2026-iwpd6rtc8","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Boulevard","item":"https://daily.dev/sources/securityboulevard"},{"@type":"ListItem","position":3,"name":"Daily OT Security News: October 16, 2026"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/daily-ot-security-news-october-16-2026-iwpd6rtc8#faq","mainEntity":[{"@type":"Question","name":"What versions of Eclipse Milo are affected by the recent OPC UA vulnerabilities and what should I upgrade to?","acceptedAnswer":{"@type":"Answer","text":"Eclipse Milo versions 0.6.0 through 1.1.4 are affected by six CVEs (CVE-2026-63252, CVE-2026-63248, CVE-2026-60007, CVE-2026-62927, CVE-2026-58080, and CVE-2026-61387), with CVSS v4.0 scores ranging from 6.9 to 9.1. The fix is version 1.1.5 or later, which addresses all six flaw classes including a padding oracle, a RoleMapper authorization bypass, and memory exhaustion issues. Teams tracking OPC UA stack vulnerabilities can follow patch guidance like this on daily.dev."}},{"@type":"Question","name":"What is the most severe CVE in the Eclipse Milo OPC UA advisory and how does it work?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-60007 is the most severe, scoring CVSS v4.0 9.1 Critical. It is a Basic128Rsa15 username-token padding oracle vulnerability requiring an on-path attacker to capture a victim's token and then send repeated unauthenticated ActivateSession requests to recover credentials or session information. Developers patching OPC UA deployments can keep up with critical CVE breakdowns on daily.dev."}},{"@type":"Question","name":"Has MITRE ATT&CK confirmed who attacked the Minnesota water utilities exposed PLC incidents?","acceptedAnswer":{"@type":"Answer","text":"No, MITRE's campaign C0066 covering attacks on more than 30 Minnesota water and wastewater utilities has not been formally attributed to any actor. The incidents involved exposed PLC access and operators being locked out after password or IP changes, and FBI/EPA and CISA separately warned of similar exposed-PLC attacks across at least seven states. Security teams monitoring unattributed ICS campaigns can track developments like this on daily.dev."}}]} ```