Hello readers!

This week, we’re talking about botnets reaching the industrial edge, IoT connectivity myths that won’t die, the engineering behind smart rings, and more!

For most of the last decade, the threat model for industrial gateways assumed someone had to go looking for them. Attacking a plant meant knowing it existed, mapping its network and finding a way past the perimeter, work that pointed to patient, well-funded attackers with a specific target in mind. That assumption is wearing out. The software on edge devices now overlaps heavily with the software on ordinary web servers, and the crews that sweep the internet for vulnerable web servers have started adding industrial tools to the same lists. To a botnet, a gateway on a factory floor and a forgotten Git server in a cloud account look alike: an open port, a version string and a known flaw. Nobody has to pick an industrial target for an industrial device to get hit. The scanner only has to reach it.

The clearest example arrived on October 30, when a decoy system run by VulnCheck caught an attacker exploiting a maximum-severity flaw in Node-RED, the browser-based flow programming tool used in building automation, manufacturing and Siemens’ SIMATIC IoT2050 gateway. Siemens disclosed the bug in August: affected devices don’t require authentication on Node-RED’s HTTP interface, so anyone who can reach it can create flows that run commands with full privileges. The attacker needed one request. That request deployed a flow pairing an inject node, which fires at startup, with an exec node, which runs a shell command, then pulled a Linux bot from a remote server. The same address went after the flaw 16 times in three days, and VulnCheck’s wider sensor data logged it hitting eight CVEs across products like Apache Solr, Gitea, MLflow and Joomla. VulnCheck researcher Patrick Garrity read it as opportunistic scanning, most likely from a rented or compromised cloud machine.

Node-RED suits that kind of sweep because the features that make it useful are the ones an attacker wants. It exists so an engineer can wire a sensor reading to an action in minutes, and a node that runs shell commands is a standard part of the kit. Expose the editor without authentication and the attacker inherits the same convenience. Exposure usually happens for ordinary reasons. IXT noted last month that vendor remote access often depends on inbound ports opened on a router or gateway, which anyone scanning the internet can see along with the vendor they were opened for. The payloads also outlast the obvious cleanup. The bot runs from memory and disappears on reboot, but several of the attacks planted webshells inside Node-RED’s own configuration that stay in place after a restart. A plant that power-cycles the gateway and moves on may still be leaving a door open.

The two months between Siemens’ advisory and the first observed attack are where regulation is starting to press. Since September 11, the EU Cyber Resilience Act has required manufacturers of connected products sold in Europe to report actively exploited vulnerabilities within 24 hours of becoming aware of them. The CVE belongs to Siemens’ devices, but Garrity warns that any Node-RED instance running without adminAuth is being found and exploited automatically, and Siemens is one of several vendors that embed the tool in commercial OT products. A 24-hour clock assumes a manufacturer knows what it ships and in which version. Platanor made the point in a recent guide to firmware inventories: an SBOM with gaps lets a scanner report a clean result for components it never checked. Public signals lag as well. VulnCheck added the flaw to its exploited-vulnerabilities catalog after its decoy caught the attack, while CISA’s KEV list hadn’t picked it up as of early November, so teams waiting on the government list are working behind attackers who have had the advisory since August.

Start by finding every Node-RED instance you operate, including the ones embedded in vendor hardware, and check whether its editor can be reached from outside your network. Turn on adminAuth, move Siemens devices to Industrial OS V4.3.4.1 or later, or remove Node-RED where nobody uses it, which is Siemens’ own fallback recommendation. Review deployed flows for exec nodes and HTTP endpoints nobody remembers adding, since those are where the webshells live. Then look at how outside parties reach the device in the first place: brokered, outbound-only sessions leave no listening port for a scanner to find. Finally, list Node-RED and tools like it in the SBOM as named components with exact versions. When the next advisory lands, answering “are we affected?” becomes a search across your inventory instead of a walk through every site, and the patch can start before the scanners add the new CVE to their lists.

Some ideas refuse to stay buried. The IoT industry has changed dramatically over the last decade. Networks have evolved. SIM technology has changed. Satellite connectivity is becoming part of the mix. Devices are being deployed farther from where anyone can reach them, and are expected to stay in the field for years.

Read more

Most GTM problems aren’t one big failure. They’re one or two weak spots quietly dragging down the rest.

The free GTM Audit scores your go-to-market across four dimensions, then sequences a 90-day roadmap for your stage.

Drop your URL. Get your score in about 10 minutes.

Get My GTM Score

In this episode of the IoT For All Podcast, Alper Yegin, CEO of the LoRa Alliance, joins Ryan Chacon to discuss the state of LoRaWAN in 2026. The conversation covers what's driving LoRaWAN adoption, how LoRaWAN compares to other connectivity options, new LoRaWAN capabilities, LoRaWAN deployments in smart buildings and other verticals, moving from a pilot to large-scale deployment, misconceptions about LoRaWAN, the role of LoRaWAN in physical AI, and the future of LoRaWAN.

YouTube • Spotify • Apple • YT Music • Amazon