CrunchAtlasThis week, CrunchAtlas CEO Ben joined representatives from the New Hampshire Department of Information Technology, Primex³, McDonald Hopkins, and the New Hampshire Department of Environmental Services at the 2026 Primex Cybersecurity Summit. The November 5 event is featured as a special addition to this week's roundup. Elsewhere, Siemens expanded its warning about an exploited industrial software vulnerability, DOE and DARPA announced new research opportunities, and cyberattacks continued to disrupt European supermarket refrigeration.
Special Event Feature: November 5 | CrunchAtlas CEO Ben Joins CISA and Industry Experts at Primex Cybersecurity Summit
On November 5, the 2026 Primex Cybersecurity Summit brought together municipal leaders, water and wastewater operators, IT professionals, and industry experts at The Lake Estate on Winnisquam in Tilton, New Hampshire. The summit focused on understanding current cyber threats, strengthening preparedness, and protecting the systems that support essential public services.
CrunchAtlas CEO Ben participated in two sessions throughout the day:
Ask an Expert – Cybersecurity Edition | 10:30–11:30 AM
Ben joined a panel with representatives from the New Hampshire Department of Information Technology, Primex³, McDonald Hopkins, and the New Hampshire Department of Environmental Services.
The panel gave attendees an opportunity to ask questions about cyber threats, limited budgets, leadership responsibilities, and building effective security programs.
How Hackers Hack | 1:45–2:45 PM
Ben joined a practical demonstration and discussion of how attackers identify targets, initiate attacks, and exploit vulnerabilities. The session examined common attacker techniques and how organizations can recognize potential weaknesses before they are exploited.
Why it matters: Municipalities are responsible for protecting critical systems with limited staff and budgets. The summit gave local leaders an opportunity to exchange experiences with their peers and speak directly with federal and industry experts about preparing for and responding to cyber threats.
Want to learn how CrunchAtlas helps organizations detect, investigate, and respond to threats?
November 4 | Siemens Expands Warning as Attackers Exploit Node-RED
Siemens updated its security advisory on November 4 concerning CVE-2026-58115, a critical missing-authentication vulnerability affecting Node-RED on certain SIMATIC IoT2050 industrial devices.
The vulnerability carries a CVSS score of 10.0 and could allow an unauthenticated attacker to create malicious automation flows and execute commands with elevated privileges.
The update followed research published by VulnCheck, which documented exploitation attempts against its Node-RED monitoring systems between October 30 and November 1. Researchers observed 16 attempts from one source, including attempts to download and execute malicious software.
On November 4, WaterISAC warned utilities to examine exposed Node-RED installations. Siemens expanded its affected-product list to include three additional SIMATIC IoT2050 models and reiterated its recommendation to update affected devices to version 4.3.4-1 or later.
Why it matters: Node-RED's automation flows can execute commands and interact with connected equipment. An attacker who can create those flows may gain more than access to an application interface. The consequences depend on which systems the installation can reach and what it is authorized to control.
November 3 | CISA Discloses Critical Vulnerabilities in Electric-Sector Software
CISA published an industrial control systems advisory covering two vulnerabilities in Subnet Solutions PowerSYSTEM Center, software deployed in the energy and critical manufacturing sectors.
The vulnerabilities, CVE-2026-63017 and CVE-2026-63774, involve incorrect authorization and SQL injection. The first could allow a low-privileged authenticated user to access administrator-restricted resources, while the second could allow an authenticated user to execute unauthorized SQL commands through the application's report designer.
Affected versions include PowerSYSTEM Center 2020, 2024, and 2026, depending on the vulnerability. Both flaws carry CVSS v3.1 scores of 9.0.
Subnet Solutions has released fixes and recommends updating affected installations. CISA has not reported confirmed exploitation against an electric utility.
Why it matters: The vulnerabilities affect software supporting electric-sector workflows, but there is no reported resulting compromise of grid operations. The identified exposure concerns application access and potentially affected data, not demonstrated control of electrical equipment.
November 3 | DARPA Seeks New Cyber Planning Technology Through HYPER-CAP
The Defense Advanced Research Projects Agency announced HYPER-CAP, a research opportunity focused on improving cyber course-of-action planning when information is incomplete, communications are degraded, or adversaries attempt deception.
The program seeks technologies using hyperdimensional and neurosymbolic reasoning to help operators generate, compare, explain, and revise response plans as conditions change.
DARPA is particularly interested in systems that maintain structured representations of objectives, constraints, dependencies, uncertainty, and alternative actions. The solicitation excludes generic dashboards, static playbooks, and chatbot-style recommendations without auditable reasoning.
HYPER-CAP is a Direct-to-Phase-II SBIR opportunity. Applicants must demonstrate that they have already established the equivalent of Phase I technical feasibility.
The application period opens December 2, 2026, and closes January 6, 2027, at noon ET.
Why it matters: The research focuses on a problem that detection alone does not solve: deciding what to do when evidence is incomplete and operational consequences are uncertain. DARPA wants systems capable of comparing responses, accounting for constraints, and revising decisions as conditions change.
Applications through the Defense SBIR/STTR Innovation Portal (DSIP). Topic DPA27BZ02-DV001.
November 2 | NIST Releases New Cybersecurity Guidance for America's Smallest Businesses
The National Institute of Standards and Technology published Cybersecurity White Paper 50, providing practical cybersecurity guidance for businesses with no paid employees beyond their owners.
The publication adapts the NIST Cybersecurity Framework 2.0 for organizations with limited technical resources. It includes editable worksheets, hypothetical business scenarios, and guidance on establishing basic cybersecurity practices.
According to NIST, 81.9% of U.S. small businesses are non-employer firms. The new publication is intended to make cybersecurity risk management accessible to these businesses without requiring specialized technical expertise.
Why it matters: Small contractors and service providers often work with much larger organizations without having comparable cybersecurity resources. NIST's simplified framework gives those businesses a starting point for managing their own risks and gives larger customers a practical resource to share with suppliers.
November 2 | Another Wave of Cyberattacks Disrupts European Supermarket Refrigeration
Cyberattacks targeting commercial refrigeration systems spread across Europe on November 2, affecting supermarkets in Belgium, Luxembourg, Sweden, Ireland, and other countries.
According to Reuters, attackers manipulated refrigeration controls, causing temperatures to rise and forcing retailers to discard food. At one Swedish supermarket, freezer temperatures reportedly reached 50°C.
The disruptions followed similar attacks against French supermarkets in October. Several affected facilities used refrigeration technology from Danish manufacturer Danfoss, which said it was working with customers on fixes. No group has claimed responsibility, and investigators have not established whether the incidents are connected.
Why it matters: Refrigeration equipment does not need to shut down to cause losses. Unauthorized temperature changes can spoil inventory while the system continues operating. Independent temperature alarms and records of control changes become particularly important when remote management systems are compromised.
October 30 | DOE Announces More Than $200 Million in Small Business Innovation Funding
The U.S. Department of Energy announced its Fall 2026 SBIR/STTR Phase I funding topics, opening a funding pathway exceeding $200 million across research and commercialization phases.
The topics include cybersecurity, electric-grid innovation, nuclear detection, and other energy and national security technologies.
Administered through DOE's Office of Technology Commercialization and ConnectWerx, the initial Phase I opportunity anticipates approximately 160 awards totaling up to $50 million. Eligible small businesses can request up to $300,000 for Phase I, with follow-on funding dependent on technical progress and funding availability.
Applicants must first submit an initial pitch. Only successful pitches will receive invitations to complete a full application.
The pitch deadline is December 16, 2026, at 2 p.m. ET.
Why it matters: This funding is intended to develop new technologies, not purchase existing cybersecurity products. Its value to utilities and industrial operators will depend on whether the selected projects solve operational problems that existing commercial tools have not adequately addressed.
Application through the ConnectWerx Acquisition Management Portal (AMP). An account is required.
October 29-30 | CISA Flags Exploited Cisco, GitLab and Ivanti Vulnerabilities
On October 29, CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog, affecting Cisco Secure Firewall ASA and FTD, as well as GitLab.
The Cisco vulnerability, CVE-2026-76418, can allow an unauthenticated attacker to force affected firewalls to restart, disrupting VPN connectivity. The GitLab vulnerability, CVE-2026-97229, affects self-managed installations and can expose vulnerable systems to further compromise.
On October 30, CISA expanded its warning concerning Ivanti Connect Secure to include two additional exploited vulnerabilities, CVE-2026-111357 and CVE-2026-118527. Attackers have exploited vulnerabilities affecting these appliances to execute commands, steal credentials, and extract information. CISA also cautioned that some evidence of exploitation may not appear in Ivanti's Integrity Checker Tool.
Why it matters: The Ivanti warning raises a problem that patching alone cannot resolve. If attackers extracted credentials before the vulnerability was fixed, those credentials may remain usable afterward. For affected organizations, the investigation must account for access already obtained, not just the vulnerable appliance.
That's it for this week. We'll be back next Thursday with the next Weekly Roundup.
