Breaches

Water utility cyber incidents across at least seven U.S. states disrupted monitoring and control across at least seven U.S. states

Source: Badtech.org Breaches · Radar

CBS News, NBC News, and CNN Newsource via KEYT reported that the FBI and EPA said water and wastewater utilities in at least seven U.S. states experienced malicious cyber incidents, with some activity degrading operations. The reporting says the activity targeted internet-facing programmable logic controllers, or PLCs, which utilities use to monitor and control equipment such as pumps, valves, pressure and chemical processes.

Those outlets reported that more than 30 Minnesota community water systems were affected. Some utilities temporarily shifted to manual operations, and reported impacts included loss of monitoring or control; some accounts also described pressure-related disruption. The supplied reporting says no contamination of Minnesota water supplies had been reported.

CBS News and NBC News said CISA urged operators to remove publicly exposed PLCs and other OT from the internet, secure necessary external connections, strengthen passwords, and review access controls. CBS News and CNN Newsource via KEYT also reported that U.S. investigators were examining possible Iranian involvement, but no formal attribution had been made.

Sources

N-able N-central auth-bypass flaw is under active exploitation; customers told to verify 2026.3.1.7

N-able’s N-central RMM platform is under active exploitation through an authentication-bypass flaw, with Huntress reporting multiple affected organizations and observed follow-on activity including reconnaissance, process-list requests, and abuse of the Take Control remote-access feature on downstream hosts. N-central is a remote monitoring

Broadcom patches critical VMware vCenter and ESXi flaws including auth bypass, RCE, and VM escape

Security Affairs, Mallory.ai, and Field Effect reported that Broadcom released patches on July 29 for five VMware vulnerabilities affecting ESXi, vCenter, Workstation, and Fusion, including three rated critical. They said the most severe issue, CVE-2026-59309, is a critical vCenter authentication bypass rated CVSS 9.8, and that

Sources

Read more

N-able N-central auth-bypass flaw is under active exploitation; customers told to verify 2026.3.1.7

Broadcom patches critical VMware vCenter and ESXi flaws including auth bypass, RCE, and VM escape