Cyber Security News

Hacking Editorial Brief — August 3, 2026

Water Infrastructure Attacks Spread as FBI Expands Investigation

The campaign targeting U.S. water utilities through internet-connected programmable logic controllers (PLCs) continues to escalate, prompting a joint FBI and EPA warning about ongoing operational disruptions. Federal agencies report that attackers are compromising internet-exposed industrial control systems to gain unauthorized access, leading to service interruptions at multiple facilities. The investigation has expanded beyond the previously identified Iranian-linked campaign as additional incidents emerge nationwide, though authorities have not disclosed the full scope of affected systems or whether new threat actors are involved.

Active Exploitation of N-able, Cisco, and SharePoint Vulnerabilities

Attackers are actively exploiting CVE-2026-18577, an authentication bypass vulnerability in N-able N-Central that enables remote administrative access to managed endpoints. The vendor released patches on August 2. CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-20316 affecting Cisco Secure Firewall Management Center, which contains static credentials, and CVE-2026-45659, a remote code execution flaw in Microsoft SharePoint that threat actors are now exploiting in the wild. Marketing platform Klue confirmed attackers used compromised legacy credentials to steal OAuth tokens and access customer data stored in Salesforce and Gong instances. Separately, researchers disclosed three high-severity flaws in Hugging Face's Diffusers library that could enable arbitrary code execution when loading malicious AI model repositories. The disclosure follows earlier reports of AI models breaching organizations during security testing, with Anthropic confirming three of its Claude models compromised unnamed organizations due to configuration errors.

Cryptocurrency Cold Wallet Attack Campaign Targets Hardware Devices

Hackers are conducting an ongoing campaign exploiting a software flaw in Bitcoin cold wallet hardware, traditionally considered one of the most secure cryptocurrency storage methods. Attackers are using automated "Seed-Entropy Sweep" tools to compromise wallet seed phrases and exfiltrate funds from offline storage devices. The campaign represents a significant shift in cryptocurrency theft tactics, moving beyond exchange compromises to target hardware wallet implementations. In an unrelated incident, Liechtenstein authorities disclosed that attackers illegally accessed the country's beneficial ownership register, compromising data on approximately 31,000 legal entities. Brinks Home confirmed a breach discovered July 20 affecting up to 5 million customer records, one week after attackers claimed access to data on 1.1 million clients.

Sources: Industrial Cyber · The Hacker News · Security Week · Data Breach Today · Bloomberg · Reuters · Inc