US warns of active cyber threat targeting critical infrastructure

Live updates

1. 4d ago

   Dell warns of critical vulnerability in System Update tool

   Dell has issued an urgent warning for customers to patch a critical vulnerability found in the System Update (DSU) command-line interface (CLI) deployment tool. This flaw allows hackers to gain root privileges on affected systems. The discovery adds a specific technical vector to the ongoing threat environment where ransomware groups and state actors target critical infrastructure. Organizations must prioritize this patch to prevent unauthorized administrative access to their hardware environments.

   Why it matters

   The US government previously identified active threats against the energy sector involving generative AI and Chinese state actors. These actors often exploit system vulnerabilities to compromise critical infrastructure. Root privilege escalation represents a severe risk as it grants attackers full control over a machine.

   What is confirmed

   • Dell warned customers to patch a critical vulnerability in the System Update (DSU) command-line interface (CLI) deployment tool.
   • The vulnerability in the Dell System Update tool allows hackers to gain root privileges.

   What to watch next

   • Confirmation of whether state actors have exploited the Dell DSU flaw in the wild
   • Release of specific CVE identifiers for the System Update vulnerability
   Sources used for this update (3)

   1. jen.jiji.com — Ovarian cancer, patients: "Drug reimbursed but access test not for everyone"
   2. jen.jiji.com — Nations League, today Italy-Turkey - Live
   3. www.bleepingcomputer.com — New Dell System Update flaw lets hackers gain root privileges - BleepingComputer
   confidence 100%
2. 6d ago

   US warns of active cyber threat to critical infrastructure

   The US has warned of an active cyber threat targeting critical infrastructure, particularly the energy sector, with ransomware groups and state actors, including those from China, exploiting vulnerabilities and leveraging generative AI. Organizations are advised to harden systems through consistent patching and monitoring for indicators of compromise. The threat is part of a broader US-China rivalry in AI, with clashes over areas like chip exports and military applications.

   Why it matters

   The US and China are in a growing rivalry over AI, with tensions in areas like chip exports, model distillation, safety concerns, humanoid robots, and military applications. This rivalry has implications for the global tech industry and national security. The US has been actively warning of cyber threats and advising organizations to take precautions. The critical infrastructure sector is a prime target for these threats.

   What is confirmed

   • The US and China clash over AI in areas like chip exports, model distillation, safety concerns, humanoid robots, and military applications.
   • The US has warned of an active cyber threat targeting critical infrastructure, specifically the energy sector.
   • Ransomware groups and state actors, including those from China, are leveraging generative AI and exploiting vulnerabilities like CVE-2026-59310 in VMware vCenter.
   • Organizations are advised to harden systems through consistent patching and monitoring for indicators of compromise.

   Still unconfirmed

   • Amentum joint venture secures preferred position for major UK nuclear contract.

   What to watch next

   • Details on the Cyber Incident Reporting for Critical Infrastructure Act
   • Evidence of compromise in critical infrastructure sectors
   • US-China diplomatic talks on AI and cybersecurity
   Sources used for this update (4)

   1. www.straitstimes.com — Five ways the US and China clash over AI - The Straits Times
   2. www.fairn.co.kr — [김관호 안보브리핑] 미, 드론 조건만 입력하면, 즉각 구매가능한 D/B구축 완료
   3. www.amentum.com — Amentum Joint Venture Secures Preferred Position for Major UK Nuclear Contract | Amentum
   4. www.infosecurity-magazine.com — US: Critical Infrastructure Braces for New Cyber Reporting ...
   confidence 85%
3. 8d ago

   US warns of active cyber threat targeting critical infrastructure

   The US has warned of an active cyber threat targeting critical infrastructure, specifically the energy sector. Ransomware groups and state actors, including those from China, are leveraging generative AI and exploiting vulnerabilities like CVE-2026-59310 in VMware vCenter. Organizations are advised to harden systems through consistent patching and monitoring for indicators of compromise.

   Why it matters

   This threat is part of an ongoing campaign targeting US critical energy infrastructure. The Cybersecurity and Infrastructure Security Agency (CISA) has issued advisories warning of unsophisticated cyber attackers actively targeting the oil and gas sector. The threat is not limited to the energy sector, as other critical infrastructure areas are also at risk.

   What is confirmed

   • CISA warned federal agencies that ransomware gangs are exploiting a critical JetBrains TeamCity vulnerability patched in July.
   • The US critical energy infrastructure faces ongoing cyber threats from ransomware groups and state actors, specifically those from China.
   • Attackers leverage generative AI to increase risk and exploit the CVE-2026-59310 vulnerability in VMware vCenter.
   • Human error continues to be the primary security risk.
   • Organizations are advised to harden systems through consistent patching and monitoring for indicators of compromise to mitigate these systemic vulnerabilities.

   Still unconfirmed

   • Volt Typhoon, a Chinese-linked APT group, launched a prolonged Energy Grid Cyberattack against a US power utility.

   What to watch next

   • Further advisories from CISA on critical infrastructure threats
   • Exploitation attempts of Citrix NetScaler RCE zero-days
   • Patching and mitigation efforts by organizations
   Sources used for this update (11)

   1. jen.jiji.com — Gf Vip, Marina La Rosa remembers Pietro Taricone: "He had an incredible light in his eyes"
   2. jen.jiji.com — Fuel prices, IP also caps prices after Eni: discount for 8,500 distributors
   3. jen.jiji.com — Nations League, today Turkey-Italy: time, probable lineups and where to watch it on TV (free-to-air)
   4. www.foxnews.com — Real winner of Xi summit revealed as Trump looks to usher in new era with China
   5. www.techradar.com — Citrix says two worrying NetScaler RCE zero-days exploited in attacks
   6. www.bleepingcomputer.com — CISA: Ransomware gangs now exploiting critical TeamCity flaw
   7. dailysecurityreview.com — Volt Typhoon Energy Grid Cyberattack Exposes US ...
   8. dailysecurityreview.com — CISA Warns of Ongoing Cyber Threats to U.S. Oil and Gas ...
   9. therealnews.com — Trump, Rúbio and the Bolsonaros’ electoral fraud and cyber attacks - The Real News Network
   10. www.cybersecuritydive.com — Citrix urges immediate upgrades of NetScaler amid widespread exploitation attempts | Cybersecurity Dive
   11. threatbeat.com — Threat Beat - Cyber and Critical Infrastructure News
   confidence 85%
4. 16d ago

   US Critical Infrastructure Cyber Threat Warning Remains Active

   US critical energy infrastructure faces ongoing cyber threats from ransomware groups and state actors, specifically those from China. Attackers leverage generative AI to increase risk and exploit the CVE-2026-59310 vulnerability in VMware vCenter. While technical exploits are a priority, human error continues to be the primary security risk. Organizations are advised to harden systems through consistent patching and monitoring for indicators of compromise to mitigate these systemic vulnerabilities.

   Why it matters

   Security gaps in VMware vCenter provide a known entry point for ransomware. The integration of AI into hacking tools allows for more sophisticated attacks against energy grids.

   What to watch next

   • Reports of new CVE exploits targeting energy sectors
   • Official US government attribution of specific AI-driven attacks
   Sources used for this update (2)

   1. thehackernews.com — Phishing | Breaking Cybersecurity News | The Hacker News
   2. jen.jiji.com — Surgery, operating on the brain of an awake patient: Sinch congress in Catania
   confidence 100%
5. 19d ago

   Generative AI increases cyberattack risks to energy infrastructure

   Generative AI in the wrong hands elevates the risk of cyberattacks against critical energy infrastructure. This development adds to existing systemic security concerns, including the exploitation of the CVE-2026-59310 vulnerability in VMware vCenter by ransomware groups. While AI introduces new threats, human error remains the primary cybersecurity risk to energy systems. Organizations must continue patching systems and monitoring for indicators of compromise as part of a broader effort to harden infrastructure against threats, particularly those originating from China.

   Why it matters

   The U.S. government has previously responded to these vulnerabilities by launching the Gold Eagle AI Clearinghouse via CISA and the Treasury Department. The Federal Transit Administration also issued security guidance for transit agencies to mitigate systemic risks.

   What is confirmed

   • Generative AI in the wrong hands raises the risk of cyberattack on critical energy infrastructure.
   • Humans are still the biggest cybersecurity risk to energy systems.

   What to watch next

   • Updates from CISA regarding specific AI-driven threat vectors targeting energy grids
   • New guidance from the Gold Eagle AI Clearinghouse on mitigating generative AI risks
   Sources used for this update (4)

   1. jen.jiji.com — Sandro Mazzola, the last (unpublished) interview: "Inter is a mother to me"
   2. jen.jiji.com — Trump's axe on journalists: no White House access for CNN, Ms Now, and Politico. "Assault on rights, we'll continue our work"
   3. www.theverge.com — Humans, not rogue AI, are still the biggest cybersecurity risk to energy systems
   4. jen.jiji.com — Juve-Atalanta, Nerazzurri protests for missed penalty on Rowe: what happened
   confidence 100%
6. 21d ago

   US Infrastructure Vulnerable to Chinese Cyber Threats

   The United States remains highly vulnerable to cyber threats originating from China, necessitating a multipronged approach to harden critical infrastructure. This follows CISA warnings that ransomware groups are currently exploiting the CVE-2026-59310 vulnerability in VMware vCenter. To mitigate these systemic security risks, CISA and the Treasury Department launched the Gold Eagle AI Clearinghouse, while the Federal Transit Administration issued specific security guidance for transit agencies. Organizations are instructed to patch systems immediately and monitor for indicators of compromise.

   Why it matters

   Cyberattacks on critical infrastructure can disrupt essential services and national security. The focus on VMware vulnerabilities highlights a specific vector being used by ransomware actors to gain unauthorized access.

   What is confirmed

   • CISA reports ransomware groups are exploiting VMware vCenter vulnerability CVE-2026-59310.
   • The Gold Eagle AI Clearinghouse is a joint CISA and Treasury initiative to mitigate systemic security risks to infrastructure.
   • The Federal Transit Administration has provided security guidance for transit agencies.

   Still unconfirmed

   • The United States is highly vulnerable to cyber threats from China.

   What to watch next

   • Evidence of specific Chinese state-sponsored actors exploiting CVE-2026-59310
   • Updated patching statistics from CISA regarding VMware vCenter systems
   Sources used for this update (5)

   1. jen.jiji.com — Mystery in London, Nicholas Brandram found dead: the banker was suspected of being the "Putney pusher", the story
   2. jen.jiji.com — Alemanno denounces: "Flyer with Vannacci upside down, Anpi thus calls for mobilization against us"
   3. jen.jiji.com — Hemophilia A, physiotherapist Bruno: "It's possible to exercise and play team sports"
   4. jen.jiji.com — Teacher stabbed in Rome, the 13-year-old's plan: at school with diving knives and phone on helmet to film the ambush
   5. www.cfr.org — The U.S. Is Highly Vulnerable to Cyber Threats From China. Here’s What It Should Do
   confidence 80%
7. 23d ago

   CISA Warns of Active Cyber Threats to Critical Infrastructure

   The Cybersecurity and Infrastructure Security Agency (CISA) reports that ransomware groups are exploiting a critical VMware vCenter vulnerability, CVE-2026-59310. CISA instructs organizations to patch systems immediately and search for compromise indicators. This alert coincides with broader security efforts, including Federal Transit Administration guidance for transit agencies and the launch of the Gold Eagle AI Clearinghouse, a joint CISA and Treasury initiative designed to mitigate systemic security risks to infrastructure.

   Why it matters

   Critical infrastructure protection is a priority as ransomware gangs target systemic vulnerabilities in enterprise software. Patching CVE-2026-59310 is necessary to prevent unauthorized access to virtualized environments. The Gold Eagle AI Clearinghouse aims to address these risks using artificial intelligence.

   What is confirmed

   • Ransomware gangs are exploiting a critical VMware vCenter vulnerability identified as CVE-2026-59310.
   • CISA and the Treasury launched the Gold Eagle AI Clearinghouse initiative to address systemic security risks.
   • The Federal Transit Administration advised transit agencies to review CISA updates.

   What to watch next

   • Reports of successful exploitation of CVE-2026-59310 in the wild
   • Updates on the implementation of Gold Eagle AI Clearinghouse
   • New patching guidance from VMware regarding vCenter
   Sources used for this update (5)

   1. www.yahoo.com — Oil prices near 4-month high as Iran and Oman delay Strait of Hormuz talks
   2. jen.jiji.com — Building collapses in Gaza, at least 11 dead: "50 children among 100 trapped people, they were sleeping"
   3. www.yahoo.com — White House backs Hegseth as new details come out about Iran war's cost
   4. jen.jiji.com — Icardi, Lazio hypothesis fades? Here's where the former Inter captain could go
   5. www.wfmz.com — No active shooter found after threat report triggers shelter-in-place order at ESU, police say
   confidence 100%
8. 24d ago

   CISA warns ransomware gangs are exploiting critical VMware vCenter flaw

   The Cybersecurity and Infrastructure Security Agency (CISA) confirms that ransomware gangs are exploiting a critical VMware vCenter vulnerability, identified as CVE-2026-59310. CISA is urging organizations to patch their systems immediately and investigate for signs of compromise. This warning adds to a broader push for critical infrastructure protection, including the Federal Transit Administration's guidance for transit agencies to review CISA updates and the launch of the Gold Eagle AI Clearinghouse initiative by CISA and the Treasury to address systemic security risks.

   Why it matters

   The alert follows a period of heightened tension involving cyber threats from Russia, China, and Iran against water utilities and energy infrastructure. These threats include Iranian activity targeting Middle East energy assets on September 7. The US government is prioritizing the hardening of operational technology to prevent large-scale service disruptions.

   What is confirmed

   • CISA confirmed ransomware gangs are exploiting the critical VMware vCenter flaw CVE-2026-59310.
   • CISA is urging organizations to patch the VMware vCenter flaw and investigate for compromise.
   • The Federal Transit Administration urged public transit agencies and operational technology operators to review CISA updates.
   • CISA and the Treasury launched the Gold Eagle AI Clearinghouse initiative.

   What to watch next

   • Reports of successful ransomware deployments using CVE-2026-59310
   • Further CISA guidance on the Gold Eagle AI Clearinghouse implementation
   Sources used for this update (6)

   1. economictimes.indiatimes.com — Indian Rupee
   2. jen.jiji.com — Donnarumma, mastermind of brutal home robbery in Paris sentenced to nine years (2)
   3. jen.jiji.com — Russia, Rublev icon moved from St. Sergius convent after media reported on conditions in which it was kept
   4. english.aawsat.com — China State Newspaper Blasts Anthropic’s Calls to Slow AI as ‘Cold War’ Tactic
   5. jen.jiji.com — Center-left poll, Conte beats Schlein in primaries
   6. The420.in — CISA Warns Ransomware Gangs Are Exploiting Critical VMware vCenter Flaw
   confidence 100%
9. 28d ago

   US expands cyber warnings to public transit agencies

   The Federal Transit Administration is urging public transit agencies and operational technology operators to review Cybersecurity and Infrastructure Security Agency (CISA) updates. This includes the new Gold Eagle AI Clearinghouse initiative launched by CISA and the Treasury. These warnings follow previous alerts regarding cyber threats from Russia, China, and Iran targeting water utility systems. The broader security environment remains tense following Iranian threats to Middle East energy infrastructure on September 7 and subsequent US strikes on Iranian assets.

   Why it matters

   US critical infrastructure is under systemic pressure from multiple nation-state actors. CISA previously ordered operators to secure Siemens S7 PLCs to block attack paths. Geopolitical instability has already impacted markets, pushing Brent crude to US$97.31 a barrel.

   What is confirmed

   • The Federal Transit Administration is urging public transit agencies and operational technology operators to review updates from CISA.
   • CISA and the Treasury launched the Gold Eagle AI Clearinghouse initiative.

   What to watch next

   • Implementation status of Gold Eagle AI Clearinghouse among transit agencies
   • Further CISA directives for other critical infrastructure sectors
   Sources used for this update (6)

   1. aptapassengertransport.com — Critical Cybersecurity Updates for Transportation Stakeholders
   2. jen.jiji.com — Fenerbahce-Roma, Gasperini demands three penalties: what happened in Champions
   3. jen.jiji.com — Blasphemy in the street, police hear it: 102 euro fine in Venice
   4. jen.jiji.com — 9/11: Trump: "We will never forget, it's why we fight today"
   5. thediplomat.com — Bangladesh and the Perils of Pax Silica
   6. jen.jiji.com — 'Arianna's Thread', the film about kidney cancer at the Venice exhibition (2)
   confidence 100%
10. 31d ago

    US Infrastructure Faces Cyber Threats Amid Rising Middle East Tensions

    US critical infrastructure faces cyber threats from Russia, China, and Iran, specifically targeting water utility systems. Simultaneously, the Cybersecurity and Infrastructure Security Agency has directed operators to harden Siemens S7 PLCs through firmware updates and communication limits to close attack paths. These digital risks coincide with geopolitical volatility as Iran threatened to attack Middle East energy infrastructure on September 7, 2026, following US strikes on Iranian assets. This escalation drove Brent crude to a six-week high of US$97.31 a barrel.

    Why it matters

    The convergence of state-sponsored cyberattacks and physical threats to energy assets creates a dual-risk environment for national security. Aging utility systems and unpatched hardware like Siemens PLCs provide entry points for adversaries. These vulnerabilities are exacerbated by active conflicts in the Middle East.

    What is confirmed

    • Brent crude settled at US$97.31 a barrel on September 7, 2026.
    • Iranian Parliament Speaker Mohammad Baqer Qalibaf stated that if US assets are struck, Iran will strike back.
    • CISA has instructed operators to harden Siemens S7 PLCs by updating firmware or limiting S7 communications.

    Still unconfirmed

    • Cyberattacks from Iran, China, and Russia are targeting American water critical infrastructure.
    • Hundreds of vulnerable Exchange servers remain active in Australia.
    • Goldman Sachs warns oil could reach US$120 if vessel attacks intensify.

    What to watch next

    • CISA updates on Siemens PLC vulnerability exploitation
    • Further Iranian threats to Middle East energy infrastructure
    • Evidence of successful breaches in US water utility systems
    Sources used for this update (6)

    1. jen.jiji.com — Iran energy threats lift oil prices to six-week highs
    2. www.itnews.com.au — Hundreds of old, vulnerable Exchange servers remain in Australia
    3. www.foxnews.com — If hackers cripple America's water, the consequences could be catastrophic
    4. jen.jiji.com — Move to call VP Sara Duterte as witness ‘not expected,’ defense says
    5. www.cfr.org — Twenty-Five Years After 9/11, the United States Is Unprepared for Terrorism’s Next Wave
    6. www.csoonline.com — CISA tells operators to harden Siemens S7 PLCs. Here’s how to do it without disrupting production
    confidence 80%
11. 32d ago

    Cyber Attackers Use Trusted Google Services and QR Codes to Steal Credentials

    Attackers are leveraging trusted Google services and text-based QR codes to bypass security measures and steal corporate credentials. Current threats include phishing campaigns that install ScreenConnect via fake verification pages and supply chain attacks where trusted software sources deliver credential-stealing code. These activities coincide with active attacks on routers, browsers, and online stores. While the US continues to manage critical infrastructure vulnerabilities, educational institutions like the University of Bristol are expanding dedicated cyber security suites to address these evolving digital threats.

    Why it matters

    These tactics represent a shift toward abusing trusted platforms to evade traditional email filters and image blocking. This follows previous reports of zero-day vulnerabilities in SonicWall hardware and reliance on foreign AI hardware. The persistence of these threats drives investment in specialized security infrastructure and academic research.

    What is confirmed

    • Phishers are using trusted Google services to install ScreenConnect and steal corporate credentials through fake verification pages.
    • The University of Bristol opened the Sloane Robinson Building at its 500 million pound Temple Quarter Enterprise Campus, featuring cyber security suites.
    • Attackers have used scannable QR codes built from text to bypass email image blocking.

    Still unconfirmed

    • A trusted software source delivered code that stole credentials.
    • A network management protocol provided outsiders clues before login.

    What to watch next

    • Reports on the effectiveness of text-based QR code filters
    • Updates on the exploitation of the SonicWall SMA1000 zero-day vulnerabilities
    • Federal policy changes regarding Chinese hardware in US AI data centers
    Sources used for this update (5)

    1. londonlovesbusiness.com — There is ‘zero chance of reaching an agreement’ as the Kremlin dictator wants Donetsk
    2. jen.jiji.com — SEPO maps ‘3+8’ overhaul of Thailand’s state enterprises
    3. thehackernews.com — ⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
    4. cybersecuritynews.com — Hackers Abuse Trusted Google Services to Hide Credential-Stealing Phishing Attacks
    5. news.europawire.eu — University of Bristol Opens £500 Million Temple Quarter Enterprise Campus, Creating New Innovation Gateway for 4,500 Students, 650 Staff and Regional Industry Partners
    confidence 90%
12. 34d ago

    US Critical Infrastructure Faces Active Cyber and Geopolitical Threats

    United States critical infrastructure faces continuous exposure to active cyber threats and supply chain vulnerabilities, underscored by SonicWall reporting the active exploitation of two SMA1000 zero-day vulnerabilities, including a remote code execution flaw with a maximum severity rating of 10.0. This digital pressure compounds broader geopolitical risks as US AI data centers rely heavily on Chinese hardware despite federal restrictions, while regional conflicts expose physical vulnerabilities. Simultaneously, global technical and infrastructure policy measures expand, with international bodies and local policy committees grappling with the mounting demands and resource pressures driven by expanding data center developments.

    Why it matters

    Critical infrastructure protection remains a high-priority national security challenge as cyber intrusions target essential software and hardware systems. Geopolitical tensions, including recent missile exchanges involving Iran and the Strait of Hormuz, highlight the vulnerability of strategic assets. Meanwhile, policy advisers warn that massive technological expansions require rigorous regulation to manage national resource costs effectively.

    What is confirmed

    • SonicWall reported the active exploitation of two SMA1000 zero-day vulnerabilities, including a remote code execution flaw with a maximum severity rating of 10.0.

    What to watch next

    • Further official advisories regarding the remediation of the SonicWall SMA1000 zero-day vulnerabilities.
    • Updates on federal enforcement rules concerning foreign bulk-power equipment in US AI data centers.
    Sources used for this update (6)

    1. www.securityweek.com — In Other News: Microsoft’s Cloud Patches, Hacked Dropbox Accounts, Guardio’s $1.1B Valuation
    2. jen.jiji.com — Thailand must Weigh Data Centre Boom Against National Resource Costs
    3. jen.jiji.com — Thai Monarchs Dispatch Royal Relief Supplies to Flood-Stricken Nepal
    4. jen.jiji.com — Over 583,000 military, uniformed personnel to get 5% pay hike in 2027
    5. en.ara.cat — This is how the hybrid war that attacks us Europeans works
    6. jen.jiji.com — VP Duterte posts bail; arrest warrant lifted in QC grave threats case
    confidence 100%
13. 36d ago

    US Infrastructure Risks Persist Amid Iranian Aggression and Hardware Gaps

    US critical infrastructure faces a combined threat of geopolitical aggression and technical vulnerabilities. Iran recently launched missiles and drones at Kuwait in retaliation for US strikes on rocket launchers in the Strait of Hormuz. Simultaneously, US AI data centers remain dependent on Chinese transformers, batteries, and switchgear despite stricter federal rules on foreign bulk-power equipment. Cyber threats continue to evolve, with SonicWall reporting the active exploitation of two SMA1000 zero-day vulnerabilities, including one with a maximum severity rating of 10.0, allowing for remote code execution.

    Why it matters

    These developments follow a July 2026 campaign that disrupted US water utility monitoring. The reliance on foreign power hardware creates a potential structural weakness in the AI sector. Ongoing Iranian hostilities increase the likelihood of the unexpected critical events previously warned by Iranian hackers.

    What is confirmed

    • Iran fired drones and missiles at Kuwait to retaliate for US strikes on Iranian rocket launchers in the Strait of Hormuz.
    • US AI data centers depend on Chinese optics, batteries, switchgear, and transformers.
    • SonicWall identified two SMA1000 zero-days being chained by attackers, one of which is a pre-auth SSRF flaw with a CVSS 10.0 rating.

    What to watch next

    • US government response to the kinetic attacks in Kuwait
    • Implementation of new federal rules regarding foreign bulk-power equipment
    • Reports of SMA1000 exploit activity in US infrastructure networks
    Sources used for this update (4)

    1. www.briefs.co — U.S. AI Data Centers Lean on Chinese Power Gear as Washington Tightens the Screws
    2. www.foxnews.com — Iran retaliates against US by firing at Kuwait in 'blatant' aggression
    3. thehackernews.com — ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories
    4. thecyberexpress.com — SonicWall Warns of Two Actively Exploited SMA1000 Zero-Days, One Rated Maximum Severity
    confidence 100%
14. 37d ago

    Iran targets US infrastructure as cyber threats expand to UK power plants

    Iranian hackers have attempted multiple cyberattacks against a variety of US infrastructure targets. While these attempts were unsuccessful, an Iranian hacking group warned that American infrastructure will soon face unexpected and critical events. This threat coincides with a separate cyber attack in the UK that forced a power generator offline, highlighting vulnerabilities in connected energy infrastructure. These events follow a July 2026 campaign against US water utilities that disrupted remote monitoring and forced some facilities to switch to manual treatment processes.

    Why it matters

    Critical infrastructure security is under pressure as state-sponsored actors target industrial control systems. The US Cybersecurity and Infrastructure Security Agency previously warned water utilities to secure programmable logic controllers after over 100 systems were compromised. These incidents demonstrate a pattern of targeting essential utilities to cause operational disruptions.

    Still unconfirmed

    • Iranian hacking groups have attempted unsuccessful cyberattacks on a range of US infrastructure.
    • An Iranian hacking group warned that American infrastructure would soon face unexpected and critical events.
    • A cyber attack forced a UK power generator offline.
    • The UK generator attack highlighted security risks associated with connected energy infrastructure.

    What to watch next

    • Official attribution of the UK power plant attack to a specific state actor.
    • CISA updates regarding the success or failure of Iranian intrusion attempts.
    • Evidence of new vulnerabilities in programmable logic controllers across other utility sectors.
    Sources used for this update (7)

    1. jen.jiji.com — DOF risks ₱10-billion revenue loss from proposed power tax exemption
    2. sg.news.yahoo.com — Replay: UK PM Andy Burnham faces lawmakers for first time since taking office
    3. sg.news.yahoo.com — Retro Gaming's Most Electrifying Game Over
    4. www.nbcnews.com — Iran attempted cyberattacks on range of U.S. infrastructure, sources say
    5. jen.jiji.com — Suphachai calls for THB100bn university innovation drive
    6. jen.jiji.com — Toyota’s Vietnam expansion exposes Thailand’s EV-era investment challenge
    7. www.iotinsider.com — The hidden IoT risk behind the UK’s power plant cyber attack
    confidence 70%
15. 40d ago

    CISA Warns Water Systems to Secure PLCs After July Cyberattacks

    The Cybersecurity and Infrastructure Security Agency (CISA) has ordered US water utilities to secure programmable logic controllers (PLCs) and reduce internet exposure. This follows a July 2026 campaign that targeted over 100 internet-exposed systems, including municipal water authorities, rural water districts, and wastewater treatment facilities. While no unsafe drinking water reached the public, the attacks caused operational disruptions and forced some utilities to use manual treatment processes after losing remote monitoring capabilities. CISA issued a formal advisory on August 22 to prevent further compromises of critical infrastructure.

    Why it matters

    Programmable logic controllers manage the physical processes of water treatment and distribution. Compromising these devices can lead to total loss of operational control. This campaign highlights the vulnerability of small and rural utilities to remote cyber threats.

    What is confirmed

    • CISA confirmed hackers targeted more than 100 internet-exposed US water systems in July 2026.
    • The cyber campaign hit wastewater treatment facilities, rural water districts, and municipal water authorities.
    • Operational disruptions included the loss of remote monitoring and a requirement for manual treatment processes.
    • CISA issued an advisory on August 22 urging organizations to secure programmable logic controllers.
    • No unsafe drinking water reached the public during the July attacks.

    What to watch next

    • Reports of further utility compromises following the August 22 advisory
    • CISA updates on the origin or attribution of the July cyber campaign
    Sources used for this update (5)

    1. www.foxbusiness.com — Cyber Security
    2. jen.jiji.com — Bangkok prepares to host Gastech 2026 amid rising Asian energy demand
    3. www.thestar.com.my — Hun Sen declares Thais used ‘scam excuse’ to invade Cambodia, warns of ‘collapse of world order’
    4. jen.jiji.com — Songkhla Lake Bridge contract set to boost southern travel and economy
    5. jen.jiji.com — Marcos keeping track of Pinoys amid widespread flooding, Palace says
    confidence 100%
16. 44d ago

    CISA confirms over 100 US water systems targeted in July cyberattacks

    The Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers targeted more than 100 internet-exposed US water systems in July 2026. The campaign hit wastewater treatment facilities, rural water districts, and municipal water authorities. While no unsafe drinking water reached the public, some utilities suffered operational disruptions, including the loss of remote monitoring and the need for manual treatment processes. CISA issued an advisory on August 22 urging organizations to reduce their exposure and secure programmable logic controllers (PLCs) before attackers compromise them.

    Why it matters

    This escalation follows warnings about attackers using AI and scanning services to find vulnerable Siemens S7 Series PLCs. The vulnerability of these systems poses a risk of cascading failures across energy, manufacturing, and water sectors.

    What is confirmed

    • CISA confirmed over 100 internet-exposed US water systems were targeted in cyberattacks during July 2026.
    • The July attacks affected rural water districts, municipal water authorities, and wastewater treatment facilities.
    • Some utilities experienced operational disruptions, including the defacement of human-machine interfaces and forced manual operation of treatment processes.
    • CISA issued an advisory on August 22 urging water utilities to secure internet-exposed PLCs.
    • There is no evidence that the July attacks resulted in unsafe drinking water reaching the public.

    Still unconfirmed

    • The July water system attacks were Iran-backed.
    • A Chinese hacking group targeted the DOJ, HHS, NIH, and NASA over several years.
    • The President declared a national emergency to secure the United States bulk power system.

    What to watch next

    • Official attribution of the July water system attacks by the US government
    • Evidence of physical equipment damage resulting from PLC exploits
    • Updates on the implementation of the national emergency for the bulk power system
    Sources used for this update (5)

    1. www.securityweek.com — CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks
    2. abcnews.com — FBI says Chinese hacking group targeted US government agencies for years
    3. www.whitehouse.gov — DECLARING A NATIONAL EMERGENCY TO SECURE
    4. www.androguider.com — CISA Confirms 100+ US Water Systems Hacked in July Amid Iran-Backed Cyberattacks
    5. securityaffairs.com — CISA Warns Water Utilities: Find Your Exposed PLCs Before Attackers Do
    confidence 90%
17. 45d ago

    US warns of AI-driven cyberattacks on Siemens industrial controllers

    The US government has identified an active threat targeting internet-exposed Siemens S7 Series programmable logic controllers (PLCs) used in water, energy, and manufacturing sectors. Attackers use AI to write exploit scripts and employ scanning services like ZoomEye and Censys to find vulnerable systems. This activity could lead to industrial process disruptions, equipment damage, safety incidents, and cascading failures across interconnected systems. The warning emphasizes that this is not a theoretical risk but a current operational threat to critical infrastructure.

    Why it matters

    The cyber threats emerge as the Trump administration prepares sweeping economic measures against Iran and its trading partners. This economic pressure coincides with threats from Tehran regarding Gulf oil disruptions and a standoff over the Strait of Hormuz.

    What is confirmed

    • The US government warned that AI-powered attacks on Siemens S7 Series PLCs are an active threat rather than a theoretical risk.
    • Attackers use AI to write exploit scripts targeting critical infrastructure sectors including water, energy, and manufacturing.
    • The Trump administration is preparing economic measures against Iran and its trade partners.
    • Threat actors use scanning services such as Censys and ZoomEye to find internet-exposed PLCs.

    Still unconfirmed

    • Former White House adviser Jake Braun stated the US must prepare for attacks to increase in severity.

    What to watch next

    • Confirmation of specific industrial failures or safety incidents linked to Siemens PLC exploits
    • Implementation of the proposed US economic measures against Iranian trade partners
    • Official attribution of the Siemens PLC attacks to specific Iranian state actors
    Sources used for this update (6)

    1. thehackernews.com — ⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
    2. www.foxbusiness.com — ‘Economic D-Day’ on Iran puts trading partners in crosshairs as Tehran threatens retaliation
    3. www.aljazeera.com — Iran war live: US slaps new sanctions on Iran, warns Tehran trade partners
    4. economictimes.indiatimes.com — Breaking News Live Updates: Doval, Wang hold bilateral talks ahead of Xi’s expected visit to India
    5. www.newsweek.com — Ex-White House Adviser Sounds Alarm Over Iran’s Growing Cyber War on US
    6. www.infosecurity-magazine.com — Australia Warns of Active Exploitation of Critical TeamCity Server Flaw
    confidence 90%
18. 47d ago

    US warns of Iranian cyber threats to critical infrastructure

    The US government has identified an active cyber threat from Iranian hackers targeting critical infrastructure, specifically sewage-treatment and water systems. These attackers use AI-generated scripts to disrupt industrial processes. The FBI and other agencies have detected these activities across multiple US states and issued alerts to warn operators. This digital aggression coincides with a broader geopolitical standoff between Washington and Tehran, particularly regarding the Strait of Hormuz.

    Why it matters

    Targeting water and sewage systems can lead to immediate public health crises or environmental disasters. The use of AI scripts indicates a shift toward automated, scalable attacks on industrial control systems. This activity occurs alongside escalating tensions in the Middle East.

    Still unconfirmed

    • The US and Iran are in an evolving war characterized by a standoff over the Strait of Hormuz.

    What to watch next

    • Reports of successful breaches or service disruptions in water treatment plants
    • Official attribution statements from the FBI regarding specific AI scripts used
    Sources used for this update (5)

    1. timesofindia.indiatimes.com — US Iran War News Live Updates: US Iran War | Iran says Gulf states hosting US bases backed attack, may pursue legal action
    2. jen.jiji.com — US hands over two Marine Protector-class patrol boats to PCG
    3. cyberpress.org — Weekly Cybersecurity Newsletter — Top 50 Cybersecurity Stories of the Week
    4. jen.jiji.com — Marcos admin warns companies of EPR obligations
    5. securityaffairs.com — Security Affairs newsletter Round 591 by Pierluigi Paganini – INTERNATIONAL EDITION
    confidence 70%
19. 48d ago

    US warns of active cyber threat targeting critical infrastructure

    The US has warned of an active cyber threat targeting critical infrastructure, including water and sewage-treatment systems. The threat is attributed to Iranian hackers and involves the use of AI-generated scripts to disrupt industrial processes. The FBI and other agencies have issued alerts about the threat, which has been detected in multiple states.

    Why it matters

    The threat is significant because it targets essential services that Americans rely on daily. A successful attack could have serious consequences, including disruptions to water and sewage services. The US has been working to improve its cybersecurity defenses, but the threat highlights the ongoing challenges in protecting critical infrastructure. The Iranian government has been accused of sponsoring cyberattacks in the past.

    What is confirmed

    • The US government has warned of an active cyber threat targeting critical infrastructure.
    • The threat involves the use of AI-generated scripts to disrupt industrial processes.
    • The FBI and other agencies have issued alerts about the threat.
    • The threat has been detected in multiple states, including Washington.

    Still unconfirmed

    • The Iranian government has been accused of sponsoring the cyberattacks.

    What to watch next

    • Further alerts from US agencies about the threat
    • Reports of successful attacks on critical infrastructure
    • Iranian government response to the allegations
    Sources used for this update (7)

    1. The Economist — Why the world’s richest country can’t defend vital infrastructure
    2. slate.com — So About That Iranian Cyberattack on Our Water Supply
    3. Fox Business — US warns of active cyber threat targeting critical infrastructure
    4. Industrial Cyber — CISA, NSA, FBI warn of Siemens S7 PLC exploitation using AI-generated scripts to disrupt critical industrial processes
    5. Bellingham Herald — WA officials issue alert about threat to water, sewage-treatment systems
    6. Yahoo — FBI warns of nationwide cyberattacks targeting water systems
    7. consent.yahoo.com — FBI warns of nationwide cyberattacks targeting water systems
    confidence 85%