A newly disclosed long-term vulnerability in braking systems could let hackers remotely stop trains, with a potential risk of derailments.