Public preview. Built from real public data on November 9, 2026, 5:41 AM UTC.
Securidigm Watch Transportation cyber intel
Brief for November 9, 2026

What changed for transportation cyber

Public advisories, known-exploited vulnerabilities and rule changes for six U.S. transportation modes, from government and CVE Program sources.

  1. 24Vulnerabilities joined CISA's known-exploited list in 30 days. 10 are in network and remote-access gear used in every mode; 7 in software from big control-system makers; 7 in equipment specific to one mode (ABB, Siemens, Cisco and Ivanti).
  2. 18Pipeline had the most mode-specific advisories in 90 days. The newest is IPEC Standalone iSM PHP2Shell and NTFS-3G Vulnerabilities, published November 6, 2026.
  3. 5TSA cybersecurity directives are current. The newest revisions are dated May 1, 2026. Each one shows its expiration date on the calendar.

Data collected November 9, 2026, 5:39 AM UTC.

New items per week

Specific to one mode: 24Shared by every mode (network gear, big control makers): 132
Specific to Maritime: 2Shared by every mode (network gear, big control makers): 132
Specific to Pipeline: 22Shared by every mode (network gear, big control makers): 132
Specific to Freight rail: 0Shared by every mode (network gear, big control makers): 132
Specific to Passenger rail and transit: 0Shared by every mode (network gear, big control makers): 132
Specific to Highway and motor carrier: 0Shared by every mode (network gear, big control makers): 132
Specific to Postal and parcel: 0Shared by every mode (network gear, big control makers): 132

Advisories and known-exploited or new vulnerabilities, by the week they appeared. Pick a mode to change the chart. The last week is still in progress.

Modes at a glance

ModeMode-specific advisories, 90 daysKnown exploited, 90 daysRules trackedLatest
MaritimeMode-specific advisories 2Known exploited 33Rules tracked 46MSCI Advisory 2026-014: Worldwide-Foreign Adversarial Technological, Physical, and Cyber Influence, October 21, 2026
PipelineMode-specific advisories 18Known exploited 40Rules tracked 21IPEC Standalone iSM PHP2Shell and NTFS-3G Vulnerabilities, November 6, 2026
Freight railMode-specific advisories 0Known exploited 33Rules tracked 18Revision of Agency Information Collection Activity Under OMB Review: Cybersecurity Measures for Surface Modes, September 1, 2026
Passenger rail and transitMode-specific advisories 0Known exploited 33Rules tracked 18Revision of Agency Information Collection Activity Under OMB Review: Cybersecurity Measures for Surface Modes, September 1, 2026
Highway and motor carrierMode-specific advisories 0Known exploited 33Rules tracked 40NMFTA Cybersecurity AI Governance Framework, June 1, 2026
Postal and parcelMode-specific advisories 0Known exploited 33Rules tracked 12Town Hall Meetings To Provide Input on Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Rulemaking, May 26, 2026

Every mode page also lists advisories from big control-system makers and the network gear used in all modes.

Known exploited, last 30 days

From CISA's Known Exploited Vulnerabilities list. Exploit likelihood is FIRST's EPSS score for the next 30 days.

Rule changes

  1. October 21, 2026 · MARAD
    MSCI Advisory 2026-014: Worldwide-Foreign Adversarial Technological, Physical, and Cyber Influence
    Voluntary guidance
  2. October 20, 2026 · Coast Guard
    Coast Guard Releases New Maritime Cybersecurity Compliance Guidance
    Voluntary guidance
  3. September 1, 2026 · Transportation Security Administration
    Revision of Agency Information Collection Activity Under OMB Review: Cybersecurity Measures for Surface Modes
    Not yet labeled
  4. August 31, 2026 · Coast Guard
    U.S. Coast Guard established the Office of Maritime Cybersecurity Policy
    Voluntary guidance
  5. August 27, 2026 · Coast Guard
    Marine Safety Information Bulletin (MSIB) 04-26: Applicability of MTSA Cybersecurity Requirements to Inactive Vessels
    Voluntary guidance
  6. July 22, 2026 · Coast Guard
    33 Code of Federal Regulations, Part 101, Subpart F – Cybersecurity, information for regulated entities with existing waivers of certain requirements of 33 CFR Parts 104, 105, or 106
    Voluntary guidance
  7. June 16, 2026 · Coast Guard
    Cyber Command Releases Fifth Annual Cyber Trends and Insights in the Marine Environment (CTIME) Report
    Voluntary guidance
Automated labels; not legal advice. Whether a rule applies to you depends on your designation and the official text. All rules and directives

Reported incidents

Public reports of cyber incidents at transportation operators. Each is labeled: Confirmed by the operator, Government statement (CISA, FBI, TSA or Coast Guard), Reported by media (headline, publisher, date and link only) or Analyst inference.

No reported incidents collected yet.

Latest industrial control advisories

Industrial control makers used in every mode (54)
Network and remote-access gear used in every mode (25)