Today's briefing covers a joint #StopRansomware advisory on the SafePay group, CISA's addition of six actively exploited vulnerabilities to the KEV catalog, and nine CVEs in Hitachi Energy RTU500 remote terminal unit firmware. The first two turn on vulnerabilities already being exploited, where patch timing decides exposure, and the third shows embedded energy-sector firmware inheriting flaws from common open-source libraries.
The FBI, CISA, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the United Kingdom's National Crime Agency and the UK's North West Regional Organised Crime Unit released AA26-293A with tactics, techniques and indicators drawn from investigations as recent as August 2026. SafePay has been active since August 2024, has affected at least 600 victims across multiple critical infrastructure sectors in North America, South America, Europe and Australia, and was among the most active ransomware groups in 2026.
Initial access comes through credential exposure, brute-force password attacks and VPN access: the actors use phished account profiles and IP addresses of the VPN provider Mullvad to exploit CVE-2020-3259 and CVE-2023-20269 on edge devices, and automated scripts to exploit CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766 on internet-exposed systems. Inside the network they take administrative control of existing or new accounts, move with PsExec, WinRM, RDP and remote monitoring tools, enumerate shares with ShareFinder.ps1 and SharpShares.exe, disable security software, and escalate through a UAC bypass and token impersonation. Data is collected and compressed with tools including FileZilla, 7-Zip, RClone and WinRAR, and exfiltrated with WinSCP, RClone and in some cases OneDrive. Before encryption they stop the Volume Shadow Copy Service and reset network-attached storage holding backups to factory settings; files are then encrypted with a ChaCha20 and RSA hybrid scheme and given a .SafePay extension, followed by a Tor chat portal ransom note, phone calls to the victim and a leak site.
The entry points are known, patchable vulnerabilities in edge devices and internet-exposed systems, so the advisory's first mitigation is to prioritize KEV remediation on internet-facing systems, followed by MFA on webmail, VPNs and accounts that reach critical systems. Because SafePay deliberately destroys shadow copies and resets NAS backups, recovery depends on offline, encrypted and immutable backups that cover the whole estate. Defenders should also review domain controllers and servers for new or unrecognized accounts, restrict command-line and scripting permissions, apply just-in-time admin access, and hunt for the listed tools and indicators, which the authoring agencies say were observed between November 2024 and August 2026 and should be verified before blocking because some are legitimate software.
On 2026-10-20 CISA added six vulnerabilities to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation: CVE-2026-96652 and CVE-2026-96655, both server-side request forgery in Plex Media Server; CVE-2026-96654, improper neutralization of encoded URI schemes in a Plex Media Server web page; CVE-2026-96656, external control of file name or path in Plex Media Server; CVE-2026-106931, OS command injection in EG Secure Solutions SiteGuard Server Edition; and CVE-2026-110936, an uncontrolled search path element in Siemens Software Center. The alert ties the additions to Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk, which requires federal civilian executive branch agencies to prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control of the asset after exploitation, while deferring action on lower-risk vulnerabilities.
Four of the six entries are in one product, so Plex Media Server installations should be handled as a single remediation item rather than patched one CVE at a time. BOD 26-04 binds only federal civilian agencies, but CISA encourages all organizations to adopt the same risk-based prioritization, and the directive also sets expectations for checking whether a system was compromised before the patch was applied. Teams should inventory exposed instances of the three products, patch or mitigate those first, and look for signs of earlier compromise on any that were reachable from the internet.
ICSA-26-293-05 covers RTU500 series CMU firmware 12.7.1 to 12.7.7, 13.5.1 to 13.5.4, 13.6.1 to 13.6.3, 13.7.1 to 13.7.8 and 13.8.1 to 13.8.2, deployed worldwide in the energy sector. It lists nine CVEs with CVSS v3.1 scores from 5.3 to 8.8. CVE-2026-17539 is specific to the RTU: under high load, such as GI requests sent at short intervals, a NULL pointer dereference in the enhanced message queue causes a fatal write error, connection interruption and restart, and ultimately denial of service for bidirectional IEC 60870-5-104 communication. The rest come from bundled libraries: an OpenSSL NULL dereference when verifying a malformed delta CRL (CVE-2026-28388, denial of service only); a libxml2 type confusion and a libxml2 use-after-free in xmlParseInternalSubset in the XML-based services (CVE-2026-6732 and CVE-2026-6653, the latter scored 8.8); and five libcurl issues in the web-based management functions in which cookies, proxy credentials, Digest Authorization headers or mTLS connections can carry over to the wrong host or request (CVE-2026-6276, CVE-2026-9079, CVE-2026-11856, CVE-2026-8927 and CVE-2026-8932). The fix is CMU firmware 13.9.1 for every affected line, with 12.7.8 offered for the 12.7 line and 13.8.3 or 13.7.9, the latter when available, for the 13.8 and 13.7 lines.
An RTU that drops its IEC 60870-5-104 sessions under load loses the telemetry and control link it exists to provide, and the remaining eight CVEs show how embedded firmware inherits the patch cadence of OpenSSL, libxml2 and libcurl. The advisory's SSVC entry records no known exploitation, which gives operators time to schedule firmware upgrades through normal outage planning rather than as an emergency. Until then, Hitachi Energy and CISA recommend keeping control systems off the internet, behind firewalls with minimal exposed ports and isolated from business networks, and using more secure methods such as up-to-date VPNs where remote access is required.
