UK — The Register

Max-severity bug in widely used OT programming tool exploited to deliver Linux malware

SecurityNovember 3, 20262 min read

Criminals are using a top-severity bug in Node-RED, a tool that runs automated workflows in factories and utilities, to install Linux malware. The bug is tracked as CVE-2026-58115.

What happened

Unknown attackers are exploiting a bug in Node-RED, a flow-based programming tool. They use it to deploy a flow that downloads and runs a Linux bot. Node-RED is often used in industrial control systems (ICS) and operational technology (OT). Security researchers at VulnCheck saw the attack on October 30, 2026. The attacker sent the full exploit in one request, with no need for the attacker to interact with the device after that.

Key numbers and facts

The bug is rated 10 out of 10 for severity (CVSS), the highest score.
The bug is tracked as CVE-2026-58115. Siemens assigned this ID in August.
One IP address made 16 attempts on the Node-RED bug between October 30 and November 1.
The same IP address logged 125 hits against eight different CVEs across VulnCheck's canary network.
Affected Siemens devices, such as the SIMATIC IoT2050, do not require a login for the Node-RED web interface.

Why Node-RED is a risk

Node-RED lets people connect devices and services by drawing flows instead of writing much code. Two built-in parts make this bug easy to abuse. An inject node starts a message on a schedule or at startup. An exec node runs system commands. When they are linked, the flow runs a command as soon as it is deployed.

Why it matters

The bug lets anyone on the internet reach powerful functions on a device without a password. Attacks on factory and utility systems can cause real-world harm, not just data theft. The article also notes recent attacks on refrigeration controllers in Europe and water systems in at least 12 US states. The researchers say this looks like mass scanning, not a targeted attack, but any exposed device is at risk.

What to watch

Whether more attacks use the same flow method against Node-RED systems.
What the downloaded bot-linux-amd64 malware does, since the researchers did not get the file.
Whether the second server at 85.215.73[.]250 hosts more malware.
Siemens and Node-RED updates that add a required login.

Glossary

Node-RED: A tool that lets people build automated workflows by connecting blocks, often used to control devices.
CVE-2026-58115: The official ID number for this specific security bug.
CVSS: A 0-to-10 scale that scores how serious a security bug is. 10 is the most serious.
VulnCheck: A security company that tracks software bugs and attacks on them.

Who Is Responsible at the Embattled GMO Press Conference? CEO Kumagai Describes the "Power Dynamics Within the Group"

At a November 2 press conference on unauthorized access to the "onamae.com Desktop Cloud" FX auto-trading VPS, GMO Internet Group faced questions about its delayed response to a 2024 vulnerability flagged by GMO Cybersecurity by Ierae. CEO Masatoshi Kumagai said he had not been informed of the warning at the time, that he learned of it through this incident, and that the subsidiary's influence within the group grew only gradually as trust was built. He also denied claims by an alleged attacker that vulnerability reports had been ignored, and said he would refrain from posting on social media for a period of time.

Securityheise onlineNov 3

IT attacks with data leaks at notebooksbilliger and Pÿur

Online retailer notebooksbilliger.de and internet service provider Pÿur (formerly known as Tele Columbus) have emailed customers about attacks on their corporate IT, and personal data may have fallen into the wrong hands. notebooksbilliger says IBAN account numbers may have been taken, that passwords and full credit card numbers are not affected, and that a mid-five-figure number of customers may be impacted. Pÿur reports that customer contract numbers, names and account data were likely also exfiltrated in an IT incident between mid-September and early October 2026.

SecurityThe RegisterNov 3

Cops bust botnet of 1.3M infected Android TV boxes

A coalition of security firms working with Japan's National Police Agency disrupted XCPE, a backdoor used to build a botnet of more than 1.3 million Android devices across over 200 countries. Google says Shenzhen-based hardware maker Videostrong Technology deliberately embedded the backdoor in device firmware and sold access to criminal affiliates. The disruption also took down command-and-control domains used to manage affiliate malware modules, which Google says could sever access to at least 10 million more compromised devices.

SecurityTechCrunchNov 3

Germany says lawmakers’ iPhones may have been hacked with spyware

Germany's federal cybersecurity office, the BSI, says members of the Bundestag and other unnamed notable people received Apple threat notifications warning their iPhones may have been targeted by government-backed spyware. Apple does not attribute attacks to specific governments or confirm that devices were compromised, so the BSI advises recipients to assume their devices may have been compromised. Apple said the latest batch of notifications went out to users in 99 countries.