Attackers are using a perfect-score flaw in Node-RED, a tool common in factories, to install a Linux bot. Exposed systems need a check today.
Criminals are breaking into systems that run Node-RED, a tool used to automate work in factories and other industrial sites, and making them download a Linux bot. The flaw has the highest possible severity score, 10 out of 10, and attackers do not need a password to use it.
Node-RED lets people connect steps together into a "flow," a bit like a wiring diagram for automation. It is used in industrial control systems and in commercial products, including Siemens SIMATIC IoT2050 devices. Siemens gave the flaw the identifier CVE-2026-58115 in August.
On the affected Siemens devices, the Node-RED web page does not ask users to log in. That gives outsiders access to building blocks that can run commands on the device. Security firm VulnCheck says it caught an attacker using this on October 30, 2026.
Researcher Patrick Garrity explained that two ordinary Node-RED pieces make this "trivial to weaponize." One starts a flow on a schedule or at startup. The other runs commands. Connect them, and the command runs the moment the flow is deployed.
Industrial systems control real equipment. The article points to recent attacks on refrigeration controllers across Europe and on water systems in at least 12 US states over the summer. Attackers increasingly aim at industrial devices that can be reached from the internet.
The attacks seen so far look broad, not aimed at one victim. One address hit this flaw 16 times between October 30 and November 1. The same address also tried eight different flaws in other products, including a seven-year-old one. VulnCheck calls it opportunistic mass scanning, meaning the attacker tries anything that is open.
The attacker has to reach the Node-RED web page first. A system that cannot be reached from outside your network is in a much safer spot. The point of the warning is to confirm that, not assume it. Industrial gateways are sometimes exposed by accident.
The alert box above lists the steps. The short version: find every Node-RED system, check whether the internet can reach it, and block that access.
VulnCheck did not download the malware, so it cannot say what it does once running. The file name, bot-linux-amd64, suggests it targets Linux on common AMD64 processors, and other versions may exist. The bug is in VulnCheck's list of exploited flaws. As of publication, it was not in the US government's equivalent list.
If your business runs Node-RED, check today whether the internet can reach it, because attackers need no password to exploit this flaw.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
