OT Security Weekly DACH, KW 46/2026: Remote Access & Refrigeration

The overall threat level for OT in Germany, Austria and Switzerland stays elevated for KW 46/2026 (06 to 13 November). Two topics stood out this week: attacks on refrigeration systems and weaknesses in remote access. Industrial remote maintenance portals, PHP2Shell vulnerabilities and an SSL VPN under active exploitation were the main problems on the access side.

Key developments this week

• mbCONNECT24: Remote Code Execution without authentication (VDE-2026-128, CVSS 3.1: 9.8 and 8.1). On 10 November, MB connect line published two PHP2Shell vulnerabilities in the mbCONNECT24/mymbCONNECT24 remote maintenance portal through CERT@VDE. Version 2.21.6 fixes them. Helmholz also reported vulnerabilities in its myREX24V2 remote maintenance server. CERT@VDE advisory · SANS ICS Critical Control: CC4 Secure Remote Access

• Refrigeration attacks: France blames an IRGC-linked unit. According to BleepingComputer (09 November), France attributes the October attacks on Danfoss refrigeration controllers in around 700 targeted stores to Shahid Kaveh, a unit linked to Iran's Revolutionary Guards. France has not attributed the later November wave in six European countries. BleepingComputer · SANS ICS Critical Control: CC1 ICS Incident Response

• SonicWall SonicOS SSL VPN: CVE-2026-19868 actively exploited. Since 06 November, this vulnerability has been listed in CISA's Known Exploited Vulnerabilities catalog. CISA · SANS ICS Critical Control: CC4 Secure Remote Access

• OpenSSH SSHole: login without a valid password. The flaw affects Linux systems using musl libc without PAM and is fixed in OpenSSH 10.6p2. This matters for embedded Linux devices that offer SSH access. SecurityWeek · SANS ICS Critical Control: CC5 Risk-Based Vulnerability Management

What it means per sector

Power & grids. Operators should ask two questions: would their own separation between IT and control systems hold in a real incident, and can they keep operating without IT? Show that there is no permanent link from office IT into control systems, such as a shared Active Directory, a jump host or file shares. Practise running with office IT isolated, including billing, feed-in payments and the report to BSI (CC2, CC1). For PHP2Shell, ask your system supplier which components use PHP. Until updates are in place, allow access to web interfaces only from fixed admin hosts and monitor that traffic (CC2, CC3). Full report (German)

Food & beverage. This week, the cold chain dominated this sector. Anyone running refrigeration systems with remote maintenance has to expect state actors too. For dairies, meat processors and cold stores, this was the most important news of the week. Our assessment is that devices from the affected vendors are also likely to be in use in DACH. Find every refrigeration controller with remote access, remove public IP addresses, and allow access only through a hardened VPN with MFA. Set temperature and setpoint alarms so that someone responds at night as well (CC2). We found no confirmed ransomware case with a production stoppage at a DACH food or beverage manufacturer in this period. Full report (German)

Machine builders. The week was mostly about vulnerabilities in remote maintenance portals and edge software. If you run your own mbCONNECT24 instances, update them to 2.21.6 right away, then review the access logs and inform affected customers. Update myREX24V2 to the latest version and make its admin interface reachable only from the management network. Open engineering project files only from known sources and keep engineering stations without email or internet access (CC2). For product security under the Cyber Resilience Act, SSHole is relevant. Practise incident response for a compromised remote maintenance setup, including customer notification and the CRA reporting process (CC1). Full report (German)

What to do now

• Patch remote maintenance portals now. Have your service provider update mbCONNECT24 to 2.21.6 and myREX24V2 to the latest version. For hosted instances, ask the machine builder in writing for the patch level and date. Until then, open connections only when needed (CC4).
• Harden the SSL VPN. Read the vendor notice for CVE-2026-19868 and patch. Enforce phishing-resistant MFA, and check VPN logs from the past weeks for logins at unusual times or from foreign countries (CC4, CC3).
• Take refrigeration off the internet. Allow access only through a VPN with MFA, set plausibility limits on setpoints with alarms, and decide who shuts the system down in an emergency and how it runs without remote control (CC2, CC1).
• Track embedded SSH and PHP exposure. In your asset inventory, flag embedded Linux devices with SSH access and ask the vendors whether they are affected by SSHole and PHP2Shell. Until the update, disable password logins or allow SSH only from the management network (CC5).
• Test your IT/OT separation. Verify that there is no permanent path from office IT into control systems, and practise running with office IT isolated (CC2, CC1).

Full sector reports (German)

• All sectors (DACH overview)
• Power & grids
• Utilities (water, wastewater, municipal)
• Food & beverage production
• Machine builders (CRA)
• All sectors at a glance

Max Gilg is an OT cybersecurity consultant based in Rosenheim, Germany (OT-Cyber.de).