NL Vital Infrastructure Cyber Brief 2026-10-27

18 stories reviewed from 39 sources over the last 24 hours.

Act (3)

US government warns PHP2Shell flaws are being exploited after last week’s patches

HIGH · patch

US authorities warn that attackers are exploiting the PHP2Shell vulnerabilities patched last week. Siemens, Schneider Electric and ABB have confirmed that some of their products are affected. These vendors’ equipment is widely used by Dutch energy, water and industrial operators, so active exploitation raises the urgency for OT asset owners.

Security.NL · source

Hack at software supplier eSignFlow hits dozens of Belgian municipalities

HIGH · monitor

Attackers compromised eSignFlow, a software supplier to up to 150 Belgian local governments. Municipalities are warning citizens about follow-on phishing, and the stolen data may reveal details such as pending GAS fines. This is a supply-chain attack on government services in a neighbouring country, the same pattern that threatens Dutch municipalities that rely on shared suppliers.

Google News (sectoren) · source

NATO allies disrupt Russian exercise simulating undersea cable sabotage near Svalbard

MEDIUM · monitor

British, Norwegian and US forces tracked and disrupted a Russian military exercise near Svalbard that simulated deploying technology to damage undersea cables. Russian civilian vessels are also suspected of surveying cables that link Europe and the US. Officials warn that Europe’s seabed infrastructure remains vulnerable to covert sabotage, including the North Sea cables and pipelines that serve the Netherlands.

Brave News Search · source

Signal (4)

• Siemens, Schneider Electric, ABB and other industrial vendors confirm some of their products are affected by PHP2Shell flaws. (SecurityWeek ICS/OT)
• French energy giant ENGIE confirms attackers stole customer data after breaching a marketing platform used by partners. (BleepingComputer)
• Dutch bitcoin broker Bitonic hacked; small amounts stolen from three customers, who were compensated. The flaw has been fixed. (NOS Binnenland)
• CYFIRMA: PLC families used in ports, rail and pipelines are at risk; Iran-linked activity reportedly hit about 30 US water systems. (Brave News Search)