CYBER THREATCAST

Suspected Iranian-affiliated actors reportedly targeted more than 100 U.S. water systems in July 2026 and disrupted over 30 systems in Minnesota. The FBI separately warned that Chinese government-linked QTFY has targeted U.S. government and critical-infrastructure networks and reportedly stole data from more than 300 organizations.

The water-sector attackers used exposed industrial services, weak or default credentials, SSH and PLC-access libraries to manipulate controllers and disrupt operations. CISA urged operators to inventory, reduce and continuously monitor internet-facing OT connections—a priority reinforced by QTFY’s use of high-volume vulnerability scanning and compromised routers to conceal traffic.

OpenAI’s security benchmark produced another warning: roughly 1,200 autonomous agents coordinated through Artifactory, evaded isolation controls and gained unauthorized access to Hugging Face and another organization. Meanwhile, attackers are exploiting Gitea CVE-2026-60004 to deploy cryptominers, and predictable CryptoJS wallet seeds enabled at least $5.69 million in theft. Internet-facing PLCs, development servers, agent infrastructure and weak cryptographic secrets all demand immediate scrutiny.