[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-cisa-warns-of-openplc-v3-bug-that-hijacks-operator-sessions":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},7218,"cisa-warns-of-openplc-v3-bug-that-hijacks-operator-sessions","CISA Warns of OpenPLC v3 Bug That Hijacks Operator Sessions","A newly disclosed XSS bug in unsupported OpenPLC Runtime v3 lets attackers hijack operator sessions and send commands to industrial control systems.","A cross-site scripting bug in OpenPLC Runtime v3 lets attackers hijack operator sessions and issue commands to the physical processes those controllers run.\n\nCISA published an advisory (ICSA-26-265-09) for CVE-2026-88020, a cross-site scripting flaw in OpenPLC Runtime v3, made by Autonomy Logic. The web interface routes pages using a query string parameter that isn't encoded, so a crafted link can run script in a logged-in operator's browser. From there, an attacker can hijack session cookies and send state-changing requests as that operator, effectively taking control of the PLC. CISA rates it 6.1 on CVSS 3.1, medium severity, and it requires the operator to click a malicious link first.\n\nOpenPLC is open-source controller software deployed worldwide across critical manufacturing, energy, transportation, and water and wastewater systems. Because v3 is end-of-life, Autonomy Logic isn't patching it - the fix is upgrading to v4, something industrial operators are historically slow to do. That leaves a session-hijacking flaw sitting in live controllers with no vendor fix coming, only CISA's standard advice to isolate control networks and avoid exposing them to the internet.\n\nIt's a reminder that in ICS land, end of life rarely means end of deployment.","[\"ics-security\",\"openplc\",\"xss\",\"cisa\"]","2026-09-22T12:00:00.000Z","2026-09-22T16:39:20.658Z","2026-09-22T16:39:23.677Z","published",null,[],"security",[26,27,28,29],"ics-security","openplc","xss","cisa",[31],{"name":32,"url":33},"CISA Advisories","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-265-09",0,{"sections":36},[37,42,46,51,56,61,66,70,75,80,85,90,95,100],{"name":38,"slug":39,"count":40,"latest_published_at":41},"AI","ai",4195,"2026-09-22T19:28:23.000Z",{"name":43,"slug":24,"count":44,"latest_published_at":45},"Security",702,"2026-09-22T21:01:05.000Z",{"name":47,"slug":48,"count":49,"latest_published_at":50},"Policy","policy",366,"2026-09-22T18:04:41.000Z",{"name":52,"slug":53,"count":54,"latest_published_at":55},"Deals","deals",200,"2026-09-22T19:28:55.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Hardware","hardware",167,"2026-09-22T20:00:00.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Science","science",131,"2026-09-22T16:26:30.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":60},"Consumer Tech","consumer-tech",110,{"name":71,"slug":72,"count":73,"latest_published_at":74},"Software","software",79,"2026-09-22T19:44:31.000Z",{"name":76,"slug":77,"count":78,"latest_published_at":79},"Dev Tools","dev-tools",78,"2026-09-18T04:00:00.000Z",{"name":81,"slug":82,"count":83,"latest_published_at":84},"Startups","startups",63,"2026-09-22T21:24:11.000Z",{"name":86,"slug":87,"count":88,"latest_published_at":89},"Gaming","gaming",45,"2026-09-22T15:35:06.000Z",{"name":91,"slug":92,"count":93,"latest_published_at":94},"General","general",43,"2026-09-21T23:48:56.000Z",{"name":96,"slug":97,"count":98,"latest_published_at":99},"Reviews","reviews",27,"2026-09-22T13:00:00.000Z",{"name":101,"slug":102,"count":103,"latest_published_at":104},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]