At the 40th Small Satellite Conference in Salt Lake City on August 26, a panel of satellite and cybersecurity experts warned that small satellites are drawing more hostile attention as they take on communication, Earth-observation, and navigation roles that once belonged to a handful of large, custom-built spacecraft, SpaceNews reported. The warning reflects how these satellites get built: the choices that make them cheap and quick to launch also mean many run the same underlying software, copied from the same public repositories.
One framework, from cubesats to flagships
Consider NASA's core Flight System, the open-source framework that runs on a spacecraft's onboard computer. NASA released it publicly in 2015, partly to help universities building cubesats, and it has spread well beyond them. A NASA presentation from September 2025 counts more than 40 missions built on it, including the Roman Space Telescope, and names it the primary software architecture for the Lunar Gateway. NASA's own repository lists the same framework running on flagship spacecraft, crewed vehicles, cubesats, and even Raspberry Pi boards. A three-unit cubesat assembled by graduate students can share large parts of its flight code with a multibillion-dollar observatory.
Trivial to break
In August 2025, two researchers from the space-security firm VisionSpace, Andrzej Olchawa and Milenko Starcik, put that reused code to the test. At Black Hat USA and DEF CON, they reported 37 separate vulnerabilities across the core Flight System and Yamcs, an open-source mission-control system built by Belgium's Space Applications Services and used by ground teams to command satellites, IEEE Spectrum reported. In one demonstration they sent a command that fired a simulated spacecraft's thruster and shifted its orbit. Olchawa, who once worked at the European Space Agency's operations center, said they had found the flaws within an hour or two and considered them easy to exploit. The vulnerabilities have since been patched.
The two systems fail in different ways. Breaking into the core Flight System takes access to a ground station operating on unprotected frequencies, which is realistic for a well-resourced state actor. Yamcs is easier and reachable from anywhere, since a phishing email that gets one operator to load a malicious configuration file can be enough to issue commands to a spacecraft. Starcik tied that to a broader shift, as operators move from private networks and leased lines toward cloud services, VPNs, and staff commanding satellites from home. Each step leaves the ground segment more connected and harder to wall off.
Olchawa was blunt about why the gaps persist. Security, he said, tends to be "the last bullet point in requirements for any mission."
The same problem, one layer down
The pattern repeats below the flight software. Small-satellite developers routinely pull code from GitHub and buy commercial off-the-shelf parts, often without time to audit either, a point Aerospace Corporation researchers have made for years. Ground networks, long described as the soft underbelly of satellite operations, add their own difficulty, since operators patch slowly when configuration freezes and expensive regression testing make updates costly. Gregory Falco, now at Cornell, has likened cubesats to Internet of Things devices that run open-source operating systems, and told SpaceNews that "anyone with money can throw one up there." That cheapness is also why a compromised cubesat can serve as a foothold into larger, more valuable systems sharing the same network.
What the advisory recommends
Governments have begun to formalize the concern. In March 2026, a joint advisory led by the Australian Signals Directorate's Australian Cyber Security Centre, with the Australian Space Agency, Canada's Centre for Cyber Security, the U.S. National Security Agency, and New Zealand's National Cyber Security Centre, warned that the growing number of low-Earth-orbit communications satellites is enlarging the attack surface for cyber actors, Breaking Defense reported. It flagged risk across the satellites, ground stations, user terminals, communication links, and the supply chain, and told operators to set explicit security requirements with their providers and to keep incident-response plans for a satellite service being lost or compromised. The advisory described those links as "susceptible to jamming, spoofing and interception."
The fleet that all of this has to protect keeps growing. A May 2026 forecast from Novaspace, reported by SpaceNews, projects 16,900 small satellites under 500 kilograms launching between 2026 and 2035, roughly a third of all satellites expected to reach orbit in that period.
News first reported by SpaceNews, with additional reporting by IEEE Spectrum and Breaking Defense.
