Weekly digest · Issue 7

An FCC commissioner takes over the Cyber Trust Mark: IoT weekly #7

Issue 7: an FCC commissioner takes over the Cyber Trust Mark label, Nordic demonstrates Bluetooth HDT, ST and NXP grow, and CISA flags flaws in Siemens and Hitachi Energy devices.

In an electronics shop, a woman holds a small white home security camera in its box and checks her phone, shelves of smart plugs, bulbs and cameras beside her and a shop assistant at the counter behind

AI-generated image: Internet of Things News / Google Gemini

By IoT News Editorial Published October 30, 2026 Updated November 8, 2026 12 min read

Drafted with AI from primary sources · checked by a separate AI agent · spot-checked by our editors · How we check

This week in brief
  • FCC Commissioner Olivia Trusty said on 28 October that she now supervises the U.S. Cyber Trust Mark, a day after the FCC asked for comments on the label's design and on checks after products reach the market.
  • Nordic Semiconductor said on 29 October that it is the first to prove Bluetooth High Data Throughput in silicon, a feature it says almost quadruples the top speed of Bluetooth LE.
  • STMicroelectronics and NXP both reported third-quarter revenue up 17.9% and 19.3% from a year earlier; ST put its growth in embedded processing mainly down to general-purpose microcontrollers.
  • CISA flagged flaws in Siemens Industrial Edge devices and operator panels, many with no fix yet, and in Hitachi Energy's TRO600 industrial routers, where an attacker without a password can download files.
  • Home Assistant announced its feedback month for November and asked for complaints from everyone in the household, not only the person who set the system up.

This issue covers the news from 22 October to today, 30 October, because the last issue was a special on China. It comes out a day later than our usual Thursday.

An FCC commissioner takes charge of the Cyber Trust Mark

On 28 October, FCC Commissioner Olivia Trusty said, in a keynote at a Cyber Trust Mark event at the Consumer Technology Association’s Innovation House, that at Chairman Brendan Carr’s direction she has “assumed supervision of the U.S. Cyber Trust Mark program for the FCC”. The FCC announced the same day that she will lead the program’s rollout. The Cyber Trust Mark is a voluntary U.S. security label for wireless consumer IoT products. Trusty said the label is meant to come with a QR code that leads to more detail on the product’s security, including how to change a default password and the minimum period for which the manufacturer has committed to providing security support. The day before, the FCC had released a public notice seeking comment on the label design, on how often certifications must be renewed and on post-market surveillance, meaning the checks that labeled products keep meeting the rules once they are on sale. A second notice, on the technical requirements and testing procedures, is expected “in the coming months”. Her stated hope is that “in the next year” consumers will begin to see products bearing the label, in shops or online. She added that no label can promise that a connected product will never face a cyber threat.

Why it matters: Products with the Cyber Trust Mark are not in shops yet. A commissioner in charge and two rounds of public comments are the first signs of a timetable, even if the date is only a hope. The detail that matters most to buyers is the one the QR code will carry: the security support period, the length of time the maker promises updates. Europe is asking for the same information under the Cyber Resilience Act, and a study we explained last week found that most online stores in the EU do not show it yet (EU online stores rarely say how long IoT devices get security updates). For a product team selling on both sides of the Atlantic, the support period is becoming a number to decide early and publish. IoT security regulation puts the U.S., UK and EU rules side by side.

Nordic shows Bluetooth High Data Throughput running on a chip

On 29 October, Nordic Semiconductor said that it has become “the first to prove the upcoming Bluetooth High Data Throughput (HDT) feature in silicon”. According to Nordic, HDT uses longer packets and new ways to fit more data into each transmission, which increases the maximum transfer speed “almost fourfold” compared with Bluetooth LE while keeping its energy efficiency. Nordic says HDT is expected to be released by the Bluetooth Special Interest Group in late 2026, and that it will deliver the feature through its existing software and tools, so designers will not need a new software stack. The company names wearables, smart home devices, PC accessories and hearing aids among the targets. It did not name the chip used or say when products will ship; it will show the technology at electronica 2026 in Munich.

Why it matters: Bluetooth Low Energy was designed for small, infrequent messages, which is why sending a firmware image, a recording or a burst of sensor data over it can take a long time. A faster mode on the same low-power radio would shorten those transfers, including OTA updates, and could let some products drop the classic Bluetooth or Wi-Fi radio they carry only for speed. There are two cautions. The feature is not yet a published specification of the Bluetooth SIG, so details can still change, and a speed gain needs both ends of the link to support it: a new headset gains nothing from an old phone. Bluetooth Low Energy for IoT explains how the radio works today.

ST and NXP report a fifth more revenue, led by chips for devices

On 29 October, STMicroelectronics reported third-quarter net revenues of USD 3.76 billion, up 17.9% from a year earlier and 7.7% from the second quarter, with a gross margin of 37.3%. Revenue in its Embedded Processing segment rose 24.1% from a year earlier to USD 1.21 billion, “mainly due to General Purpose MCU”, the general-purpose microcontrollers used in everything from appliances to industrial sensors. At the mid-point of its guidance, ST expects fourth-quarter net revenues of USD 4.15 billion, “an increase of 10.5% sequentially”. Two days earlier, on 27 October, NXP’s quarterly report to the U.S. Securities and Exchange Commission showed revenue of USD 3.79 billion, up 19.3% from a year earlier, with every end market up from the second quarter; its Industrial & IoT market grew by USD 47 million, or 6.2%.

Why it matters: ST and NXP are two of the largest suppliers of the microcontrollers inside connected devices, so their results are a reading of how many devices are being built. With Nordic’s record quarter in issue 5 and the growth at Espressif and Quectel in issue 6, the picture this month is of a market that is growing. For anyone buying parts, growth has a cost: when demand rises, lead times and prices can rise with it, and two of the Chinese suppliers in issue 6 said they were building up stocks of components.

CISA flags unpatched flaws in Siemens operator panels and edge devices, and an open file download in Hitachi Energy routers

On 22 October, CISA republished a Siemens advisory, first issued by Siemens on 13 October, for two flaws in its Industrial Edge devices, including the SIMATIC IoT2050 and several industrial PCs, and in dozens of SIMATIC operator touch screens (HMI panels). Both come from internal programming interfaces and paths that are not properly restricted for users who are logged in, and both need an attacker with a high-privilege account. CVE-2026-44414, scored 6.8 on CVSS v3.1, affects the Industrial Edge devices and can expose sensitive internal information; fixes exist for the Industrial Edge software (version 1.28.1), the IoT2050 (1.28.1-2) and the industrial PCs, but not for the SCALANCE LPE9413 and LPE9433. CVE-2026-44415, scored 9.1, affects the HMI panels and can also lead to unauthorized system access or data deletion; none of the panels has a fix yet. Siemens says further fixes are in preparation and recommends limiting network access to trusted parties. On 29 October, CISA republished Hitachi Energy’s advisory of 27 October (ICSA-26-302-02) for the TRO600 series, Hitachi Energy’s industrial wireless routers, used in the energy sector worldwide. CVE-2026-106087, a missing authentication check scored 8.7 on CVSS v4, lets an attacker with no password read or download any file on the router, including configuration files and password data. A second flaw lets a logged-in user reach services meant to be used only from inside the router. Version 9.2.2.1 fixes both.

Why it matters: An edge gateway or a field router sits between the machines and the wider network, which is what makes it valuable to an attacker. The Hitachi Energy flaw is the more urgent of the two because it needs no login: a configuration file often holds network addresses and credentials that open the way to the next device. The Siemens case shows the other common problem in industrial IoT, a fix that is not yet available for every model. Until it is, the protection is on the network side, keeping management interfaces on a separate segment as described under network segmentation. The industrial IoT guide explains where these devices sit in a plant.

Arduino App Lab adds on-board pose recognition and your own language models

On 22 October, Arduino released version 0.11 of App Lab, the development environment for its UNO Q and VENTUNO Q boards. A new Pose Estimation Brick (Arduino’s name for a ready-made building block) runs locally on the VENTUNO Q board and tracks a 17-point body skeleton at up to 10 frames per second; it recognizes standing, sitting and arms up or down without a separate training step, and it can learn a custom pose from one folder of photos that show it and one that does not. A “bring your own model” option lets developers add language models from Hugging Face by model ID or URL, with App Lab checking compatibility and choosing a supported quantization, a compressed version of the model. Projects can now be packaged as App Releases, frozen packages with locked dependencies meant to behave the same on every compatible board, and a side panel lets an AI agent edit the code from plain-language requests. The release also adds a building block to try Qualcomm’s Terrestrial Positioning Service, which estimates position from nearby Wi-Fi, cellular and Bluetooth LE signals.

Why it matters: Recognizing a pose from a camera, or running a small language model, has often meant sending data to a cloud service. Doing it on a board on the desk is edge AI made easy enough for a maker: the video does not have to leave the device. The App Releases feature is the more telling change, because it is about installing the same app on many boards, a step from prototype towards small production runs. The limits are the usual ones of small hardware, here 10 frames per second for pose tracking, and the announcement does not list which language models fit. Edge AI explained and on-device computer vision cover the trade-offs.

Renesas launches a low-power 16-bit controller for home appliances

On 28 October, Renesas launched the RL78/G21, a 16-bit microcontroller for the control boards of air conditioners, refrigerators, washing machines and microwave ovens. It has 128 or 256 KB of code flash and 4 KB of data flash, runs from 1.6 to 5.5 V and draws 34 µA per MHz, which Renesas says is about half the current of its RL78/G13. An on-chip oscillator with ±1.0% accuracy and the data flash remove the need for an external oscillator and EEPROM, and a self-test library compliant with IEC 60730, the safety standard for automatic electrical controls in household appliances, supports the chip’s self-diagnostic functions. Security features include flash read protection and a unique ID against cloning and tampering. The part is available now, from USD 0.56 per unit in quantities of 10,000 for the 128 KB, 44-pin version, according to Renesas. The company also added versions of the RL78/G23 with more touch channels.

Why it matters: Not every chip in a smart appliance needs to be powerful. In many connected appliances the network connection comes from a separate wireless module, while a small, cheap controller like this one runs the motor, the compressor or the heater, and has to keep doing so safely for years. Low current matters for standby consumption, and protection against copying matters to appliance makers whose boards can be cloned. This is the part of a smart home device that rarely makes the news, and it is where the self-tests for IEC 60730, the safety standard for appliance controls, run. The smart home guide explains how the connected part fits on top.

Home Assistant asks the whole household what is confusing

On 29 October, Home Assistant announced that its “Month of ‘What the Heck?!’”, a forum category where users post whatever they find hard, confusing or annoying, will be open for the whole of November. The post says the event runs every two years and that this time the project wants to hear from new and non-technical users and from people who live in a home where someone else runs Home Assistant; it asks the person who maintains the system to ask the rest of the household what annoys them and where they get lost. The project says it reads every post, but promises no fixes. Two days earlier, on 27 October, Home Assistant said that Everything Smart Home, a family-run UK company, had joined its Works with Home Assistant program with three Everything Presence sensors. All three use mmWave radar, which the post says picks up movements as small as breathing, run ESPHome, the open-source firmware that connects devices directly to Home Assistant over the local network, and act as Bluetooth proxies that extend Home Assistant’s Bluetooth range. The top model, the Everything Presence Pro, can be powered over its Ethernet cable.

Why it matters: A smart home is used by everyone in the house, but it is usually set up by one person, and the others are the ones who live with the confusing parts. Asking them directly is a sign that Home Assistant wants to reach people who do not tinker. The sensor news points the same way from the hardware side: devices certified to work locally, without a cloud account, with code that is public. Presence sensors that can tell whether someone is sitting still also reveal a lot about who is home and when, which is why keeping their data on the local network is a selling point. Matter vs Zigbee, new on the site today, compares two other ways such sensors connect.

Also worth your time

  • 22 October: the Bluetooth SIG wrote that all five of the largest hearing aid makers, Sonova, Demant, GN, WS Audiology and Starkey, which it says hold about 90% of the world market, now offer hearing aids that support Auracast broadcast audio, the Bluetooth feature that lets a venue stream sound directly to listeners’ devices.
  • 27 October: the European Commission approved a direct grant of 319 million euros in Austrian state aid for Infineon’s plant in Villach, which builds on its existing production of gallium nitride (GaN) power chips on 200 mm wafers to move to larger 300 mm wafers; the Commission says the facility will be the first of its kind in the EU.

From the site this week

Term of the week: software bill of materials (SBOM), the list of every software component and version inside a product. When a flaw is found in a widely used component, it is how a manufacturer finds out which of its products contain it, and the EU Cyber Resilience Act will require one from December 2027.

Sources

Corrections and updates
  • November 8, 2026: shorter title; the other stories of the issue are listed in the summary

How corrections are handled: editorial policy.

Topics: FCC, Cyber Trust Mark, Nordic Semiconductor, Bluetooth, Home Assistant, STMicroelectronics, NXP, Arduino, Renesas, industrial IoT

Diagram