Topic

PLC: news, advisories and analysis

12 articlesUpdated 13 Oct 2026

CyberSecureToday covers PLC across 12 articles published between 14 Sep 2026 and 13 Oct 2026. The coverage includes 12 vulnerability advisories. 12 advisories are rated critical or high severity.

Stories on PLC most often intersect with IEC 62443, SCADA and ICS-CERT, with Industrial, OT & IoT the most affected sector. The most recent story, “Honeywell MasterLogic-200 PLC Ethernet Module Vulnerability Enables Unauthenticated Memory Overwrite and Controller Takeover (CVE-2026-79110)”, was published 13 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

ICS/OT advisory hub: severity, KEV status and fixes in one table

Latest coverage

NewsIndustrial & OTCritical
Honeywell MasterLogic-200 PLC Ethernet Module Vulnerability Enables Unauthenticated Memory Overwrite and Controller Takeover (CVE-2026-79110)
Honeywell releases emergency firmware for MasterLogic-200 PLCs (CVE-2026-79110, CVSS 9.4) addressing an unauthenticated Ethernet stack buffer overflow.
CST Editorial Desk13 Oct 20268 min read
NewsIndustrial & OTCritical
Mitsubishi Electric MELSEC-Q PLC Vulnerability Enables Unauthenticated Memory Corruption via SLMP Protocol Injection (CVE-2026-78820)
Mitsubishi Electric issues an emergency advisory for MELSEC-Q PLCs (CVE-2026-78820, CVSS 9.3) resolving an unauthenticated SLMP protocol injection flaw.
CST Editorial Desk12 Oct 20268 min read
NewsIndustrial & OTCritical
Mitsubishi Electric MELSEC iQ-F PLC Flaw Enables Memory Overwrite and Axis Stoppage
Mitsubishi Electric and CISA disclose advisory for MELSEC iQ-F compact PLCs, patching a critical Modbus RTU communication buffer overflow (CVE-2026-75890).
CST Editorial Desk12 Oct 20268 min read
ThreatsIndustrial & OTCritical
Schneider Electric Modicon M580 Ethernet Communication Module Flaw Enables Remote Controller Takeover
A critical buffer overflow in Schneider Electric Modicon M580 and M340 Ethernet communication modules enables unauthenticated remote code execution.
CST Editorial Desk10 Oct 20268 min read
ThreatsIndustrial & OTCritical
Siemens SIMATIC S7-1500 Web Server Overflow Opens Controllers to Remote Disruption
A critical buffer overflow in the integrated HTTPS web server of Siemens SIMATIC S7-1500 and S7-1200 CPU firmware enables remote disruption of industrial automation controllers.
CST Editorial Desk10 Oct 20268 min read
ThreatsIndustrial & OTHigh
Mitsubishi Electric MELSEC iQ-R Series PLCs Vulnerable to Unauthenticated Industrial Network Memory Tampering (CVE-2026-59820)
Mitsubishi Electric and CISA warn of a high-severity flaw in MELSEC iQ-R controllers allowing remote network adversaries to alter device memory registers without authentication.
CST Editorial Desk9 Oct 20268 min read
ThreatsIndustrial & OTHigh
Schneider Electric Modicon M580 Ethernet Modules Vulnerable to Unauthenticated Malformed Packet Denial-of-Service (CVE-2026-55829)
Schneider Electric and CISA warn of a critical vulnerability in Modicon M580 communication modules allowing remote attackers to trigger unrecoverable PLC controller halts.
CST Editorial Desk9 Oct 20268 min read
ThreatsIndustrial & OTHigh
Omron Sysmac NJ/NX Series Machine Automation Controllers Vulnerable to EtherNet/IP CIP Session Hijacking (CVE-2026-53891)
Omron and JPCERT/CC issue security advisories detailing an unauthenticated session hijacking flaw in Sysmac NJ and NX controllers exposing industrial motion controls.
CST Editorial Desk8 Oct 20268 min read
ThreatsIndustrial & OTHigh
Siemens SIMATIC S7-1500 and ET 200SP CPUs Exposed to Denial-of-Service Flaw
CISA Advisory ICSA-26-279-01 details a critical denial of service flaw in Siemens SIMATIC S7-1500 and ET 200SP programmable logic controllers.
Mei-Lin Chen6 Oct 20268 min read
ThreatsIndustrial & OTCritical
Schneider Electric Modicon M580 PAC Memory Corruption Flaw Disclosed by CISA Advisory ICSA-26-278-02
CISA Advisory ICSA-26-278-02 details a critical memory corruption vulnerability in Schneider Electric Modicon M580 and M340 industrial controllers.
Mei-Lin Chen6 Oct 20268 min read
ThreatsIndustrial & OTHigh
OpenPLC Runtime Stored XSS Flaw Enables Operator Session Hijacking and Unauthorized Physical Process Control CVE-2026-88020
CISA warns of CVE-2026-88020 in OpenPLC Runtime v3 web interface, allowing attackers to hijack operator sessions and manipulate physical industrial processes.
CST Editorial Desk23 Sep 202615 min read
ThreatsIndustrial & OTCritical
Rockwell Automation Logix Controllers Exposed to Critical Remote Firmware Tampering Flaws
CISA alerted industrial manufacturing operators to severe vulnerabilities in Rockwell Automation Logix controllers and 1756 communication modules allowing PLC tampering.
Mei-Lin Chen14 Sep 20267 min read