Daily OT Security News: October 21, 2026

This public briefing covers five source-verified developments relevant to operational technology. Source dates are shown with each item. The Siemens item confirms active exploitation of a software-center flaw; the other items are vulnerability disclosures or controlled research findings and should not be read as confirmed compromise of production OT systems. 1. Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign Siemens advisory: October 15, updated October 17 and October 19, 2026. Siemens active-exploitation notice and SecurityWeek coverage: October 19. Help Net Security: October 20. Forescout ROMULUS research: October 15 in search results. Siemens validated active exploitation of CVE-2026-110936 in Siemens Software Center. The activity used a genuine, validly signed Siemens Software Center executable alongside attacker-supplied DLL files in a malicious installer distributed outside official Siemens channels. The vulnerable software then loaded the supplied DLLs. Siemens stated that it had no knowledge of a breach of its own systems, products, or update channel. The affected product is Siemens Software Center, not a Siemens PLC. All versions earlier than 4.0.9.8 are…