October is European Cybersecurity Month. In 2026, it was marked by several major security alerts, including one that directly targeted industrial equipment.
They are also a reminder of a basic principle: you cannot protect what you do not know you have.
This is why an OT asset inventory is often the starting point of an industrial cybersecurity approach. It was also the focus of the project carried out in June 2026 by our Lyon team at the Trèbes Seeds site of Bayer Crop Science.
October 2026 alerts: is your equipment affected?
It was a busy month on both the IT and OT sides. Here are the main alerts published by authorities and manufacturers.
CERT-FR alerts
In France, CERT-FR (the French government’s computer emergency response team) published or updated four security alerts between late September and 21 October 2026.
Every European country has an equivalent body, such as the CCB (Centre for Cybersecurity Belgium) in Belgium.
- Remote controllers for refrigeration systems (12 October, CERTFR-2026-ALE-012): CERT-FR reports numerous compromises of Danfoss (AK-SM and AK-SC series), Copeland xweb and Dixell xweb devices, with attack campaigns probably still ongoing. Its first recommendation is to remove these devices from the Internet,
- Ivanti Connect Secure (14 October, CERTFR-2026-ALE-013): a vulnerability in this remote access solution (CVE-2026-104935), actively exploited according to the vendor, allows remote code execution,
- PHP (20 and 21 October, CERTFR-2026-ALE-014): two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) allow arbitrary remote code execution. Many versions are affected, including all versions that are no longer maintained,
- Citrix NetScaler ADC and Gateway (alert of 28 September, updated until 5 October, CERTFR-2026-ALE-011): several actively exploited vulnerabilities, some of them before patches were even available.
The refrigeration controller alert had real-world consequences. On the night of 11 October, hundreds of French supermarkets saw their refrigeration systems disrupted, according to statements by the retailers reported in the press (The Hacker News).
Industrial manufacturers' advisories
Several manufacturers also published security advisories on their industrial solutions, or had them republished in October by CISA (the US Cybersecurity and Infrastructure Security Agency), listed on its ICS advisories page:
- WAGO (1 October, CERT@VDE advisory VDE-2025-081): CODESYS-based controllers and communication components are exposed to an unauthenticated denial of service (CVE-2025-41738, CVSS 7.5). Fix: firmware 4.10.0,
- Moxa (2 October): MGate MB3170 and MB3270 gateways have a critical vulnerability (CVE-2026-86325, CVSS 4.0 score of 9.4) that can be exploited by an authenticated read-only user. The fix is described in Moxa advisory MPSA-269540,
- Hitachi Energy (advisories republished by CISA on 6 and 20 October): RTU500 units running CMU firmware 11.x or earlier, which is no longer supported, notably allow unauthenticated firmware uploads (CVE-2026-8065, CVSS 9.1). Other advisories cover MicroSCADA X SYS600.
The starting point: knowing what you have
For each of these alerts, the response starts with a check:
- Is the affected equipment or software present on my sites?
- Which version is installed?
- Is it reachable from the internet?
Without an up-to-date inventory, these questions are hard to answer quickly.
The refrigeration controller case illustrates this well. CERT-FR mentions data being sent back to the refrigeration service provider: these devices are part of the OT estate, even when a third party looks after them.
OT asset inventory and the NIS2 Directive: what the text requires
The NIS2 Directive (Directive (EU) 2022/2555) requires essential and important entities to take cybersecurity risk-management measures. The measures listed in its Article 21 include asset management (official text on EUR-Lex).
In an industrial environment, asset management notably involves an inventory of OT equipment.
For the full regulatory context, see our article on the NIS2 Directive.
Field report: the OT asset inventory at the Trèbes Seeds site (Bayer Crop Science)
In June 2026, our Lyon team supported the Trèbes Seeds production site of Bayer Crop Science, in France, in a complete update of its OT inventory.
For Bayer, this project is an important milestone in preparing its operations for the NIS2 Directive. Cyril Bouvier, EMEA OT Lead at Bayer Crop Science, highlighted it on LinkedIn, praising the collaboration between the site teams and B2C Engineering.
The project brought together central engineering expertise and local site know-how. As Cyril put it: “we’re not just checking a compliance box, we’re building real industrial resilience hand in hand.”
After the OT asset inventory: the next steps
An up-to-date inventory does not secure a site on its own. It does, however, prepare the next steps:
- Vulnerability management: quickly identifying which equipment is affected when an alert is published,
- IT/OT network segmentation: filtering industrial traffic and limiting the spread of an incident,
- Securing remote access: managing privileged accounts and recording sessions,
- PLC configuration management: tracking versions and backing up configurations.
How B2C Engineering can help
An OT cybersecurity approach can start with an industrial cybersecurity (CSI) audit: an on-site assessment including a first inventory of the OT network and assets, a review of existing measures and a gap analysis against NIS2 requirements.
Depending on your needs, it continues with CSI consulting (OT security policies, asset and vulnerability management, IEC 62443 risk analysis), then the study and securing of OT networks (segmentation, remote access) and the integration of partner solutions, notably for backup and configuration management.
Our teams support manufacturers on these topics in Belgium, France, Luxembourg and Switzerland.
Johan FOIREST
Business Development Engineer Cybersecurity
Email : jfoi@b2c-engineering.com
The alerts mentioned reflect CERT-FR publications as of 22 October 2026: please refer to the official bulletins for up-to-date information.